Coins, Clubs, and Crowds:Scaling and Decentralization inNext-Generation Blockchains

Prof. Bryan FordDecentralized/Distributed Systems (DEDIS)

Delft Blockchain Symposium – January 31, 2019

A Fundamental Problem

In today’s IT systems, security is an afterthought● Designs embody “weakest-link” security

Scaling to bigger systems → weaker security● Greater chance of any “weak link” breaking

The DEDIS lab at EPFL: Mission

Design, build, and deploy secure privacy-preservingDecentralized and Distributed Systems (DEDIS)

• Distributed: spread widely across the Internet & world

• Decentralized: independent participants, no central authority,no single points of failure or compromise

Overarching theme: building decentralized systemsthat distribute trust widely with strongest-link security

Weakest-LinkSecurity

Strongest-LinkSecurity

Turning Around the Security Game

Design IT systems so that making them biggermakes their security increase instead of decrease

Weakest-linksecurity

Strongest-linksecurity

ScalableStrongest-link

security

DEDIS Laboratory Members

Bryan FordAssociate Professor

Philipp JovanovicPostdoctoral Scholar

Stevens Le BlondResearch Scientist

Linus GasserSoftware Engineer

Lefteris Kokoris-KogiasPh.D. Student

Kirill NikitinPh.D. Student

Cristina BasescuPh.D. Student

Enis Ceyhun AlpPh.D. Student

Jeff R. AllenSoftware Engineer

Kelong CongSoftware Engineer

Gaylor BossonSoftware Engineer

The Call of the Blockchain

(credit: Tony Arcieri)

Bitcoin (2008)

First successful decentralized cryptocurrency…

Bitcoin (2008)

First successful decentralized cryptocurrency…

...and a fascinating study in seductively wrong answers to key issues in decentralized systems

How to track wealth(or anything)?

Things● Gold, beads, cash...

Ledgers● Who owns what?

Alice 5 BTC

Bob 2 BTC

Charlie 3 BTC

...

Distributed Ledgers

Problem: we don't want to trust any designated,centralized authority to maintain the ledger

Solution: “everyone” keeps a copy of the ledger!– Everyone checks everyone else's changes to it

Alice 5 BTC

Bob 2 BTC

Charlie 3 BTC

...

Alice's copyAlice 5 BTC

Bob 2 BTC

Charlie 3 BTC

...

Bob's copy

Alice 5 BTC

Bob 2 BTC

Charlie 3 BTC

...

Charlie's copy

Four Key Blockchain Challenges

● Scaling: doing enough, fast enough● Availability: is it there when you need it?● Privacy: keeping, storing, processing secrets● Stake: who gets how much, when, and why

Four Key Blockchain Challenges

● Scaling: doing enough, fast enough● Availability: is it there when you need it?● Privacy: keeping, storing, processing secrets● Stake: who gets how much, when, and why

Nakamoto Consensus

Public blockchains such as Bitcoin, Ethereum useconsensus by crypto-lottery

1) Miners print their own “lottery tickets”by solving crypto-puzzle (proof-of-work)

2) Winner gets to add one block to blockchain;typically gets reward: e.g., print new money

3) All miners gravitate to longest chain. Repeat.

Drawbacks of Nakamoto Consensus

● Transaction delay– Any transaction takes ~10 mins minimum in Bitcoin

● Weak consistency: – You’re not really certain your

transaction is committed untilyou wait ~1 hour or more

● Low throughput:– Bitcoin: ~7 transactions/second

● Proof-of-work mining:– Wastes huge amount of energy

Scaling Blockchains is Not Easy

Relevant Scaling Goals

● Increased transaction processing throughput– From 4.7 TPS to VISA (1000s of TPS) and beyond

● Reduced transaction processing latency– From 10s of minutes to seconds to milliseconds…

● Reduced cost of on-chain data storage– Don’t make everyone store everything, forever

● Reduced cost of on-chain computation– Preferably not millions of times slower than native

On- versus Off-Chain Scaling

Scalable BFT

Horizontal Sharding

Sidechains

Payment Networks

L

share window of size w

L

keyblock (co-signed)

microblock (co-signed)

share

miner (co-signer)

leader

Keyblocks

Microblocks

Miners

Transactions

Shard 1Shard 2

Shard 3

ByzCoin: Fast, Scalable BlockchainsScalable PBFT blockchain consensus [USENIX Security ‘16]

● Permanent transaction commitment in seconds

● 700+ TPS demonstrated (100x Bitcoin, ~PayPal)

1 2 3

1 2 3 4 5

...

5-10 sec

BitcoinCothority

Miner Witnesses

Key-Block

Micro-Block

depends on

6

Co-Signature

Horizontal Scaling via Sharding

OmniLedger: A Secure Scale-Out Ledger [S&P 18]● Break large collective into smaller subgroups● Builds on scalable bias-resistant randomness protocol

(IEEE S&P 2017)● 6000 transactions/second: competitive with VISA

Transactions

Shard 1Shard 2

Shard 3

OmniLedger Throughput

Wide range of performance/security settings

Problem: Secure Public Randomness

Vietnam War Lotteries (1969)

RandHound/RandHerd

“Scalable Bias-Resistant Distributed Randomness” [IEEE Security & Privacy ‘17]● Standard t-of-n

threshold model● Efficient, scales to

thousands of parties● Compatible with

ByzCoin, OmniLedgerblockchains

(c,r)

collective randomness

CLCL

TSS group 1 TSS group 2

TSS group 0

GLGLGLGL

(c,r0)

(c,r1) (c,r2)

Four Key Blockchain Challenges

● Scaling: doing enough, fast enough● Availability: is it there when you need it?● Privacy: keeping, storing, processing secrets● Stake: who gets how much, when, and why

Blockchain Availability Challenges

Blockchains need reliable global connectivity● Must gossip: costs bandwidth, energy, time

Unusable in many important environments● Disconnected networks (high-security, IoT)● Intermittent connectivity (developing world)

Outages also compromise blockchain integrity● Eclipse and routing attackers can create

fake chains [Heilman ‘15, Apostolaki ‘16]

Problem: Local/Offline Verification

How can clients know what’s on a blockchain?● Bitcoin offers no absolute truth, only relative:

clients must gossip & seek head w/ most work● Clients must be online, consuming bandwidth

– Even when downloading only block headers (SPV)– Costly catch-up if client app used only intermittently

● Vulnerable to attacks on routing & gossip– Details: see [Heilman ‘15, Apostolaki ‘16]

Can blockchains offer offline-verifiable truth?

Offline-Verifiable SkipChains

CHAINIAC: appeared in [USENIX Security ‘17]● Introduced SkipChains: blockchains supporting

offline cryptographic traversal & verification

Applied to E2E-secure software updates● Decentralized offline/P2P update distribution

Backward and Forward Verifiability

Standard blockchains traversable only backward● Via hash back-links from current head

Chainiac adds traversability forward in time● Collective signature by prior consensus group

Time

Backward hash links, embedded in blocks at commit time

Collectively signed forward links, added later once target exists

Time

Backward hash links, embedded in blocks at commit time

Leaping Through Time: SkipChains

Each block validates prev w/hash, next w/sig● Higher level hashes, sigs → longer hops● O(log N) traversal arbitrarily forward, back

Time

Backward hash links, embedded in blocks at commit time

Collectively signed forward links, added later once target exists

B3

B2

B1

F1

F2

F3

Level

Other Applications of SkipChains

Enable Offline/P2P verification● Works even if Internet is

unavailable, slow, costly

Broad applications● Software/key updates● Blockchain-Attested

Degrees, Awards, … ● Chain-of-Custody,

Bills of Lading, …

See: “How Do You Know It’s On the Blockchain?”

Problem: Local/Offline Transactions

Global blockchains (e.g., Bitcoin, Ethereum) become unusable or inconsistent if disconnected

Can we create resilient blockchains that are● Operable locally without global connectivity

– Secured networks, IoT, remote villages

● Able to sync with global statewhen intermittently connected

● Secure against local compromises– Global state protected from local attacks

Resilience via Localized Structuring

Crux: Locality-Preserving Distributed Systems work-in-progress [preprint]

Four Key Blockchain Challenges

● Scaling: doing enough, fast enough● Availability: is it there when you need it?● Privacy: keeping, storing, processing secrets● Stake: who gets how much, when, and why

The Blockchain Privacy Challenge

Blockchains protect the integrity of data bygiving everyone a copy for independent checking● This works against privacy & confidentiality● Current privacy provisions are leaky● Solvable with proper use of encryption

– It’s the encryption, not the blockchain,that protects privacy.

Key Privacy Challenges

● Ensuring secrets are not disclosed improperly– Off-chain secrets, encryption, ZK proofs are useful

● Ensuring secrets are disclosed when required– Off-chain secrets can be lost, or “lost”

● Ensuring usage of secret data is accountable– Enforcing correct reporting of data access & use

● Enabling rich computation on secret data– Privacy-preserving queries, aggregation, ML, …

Off-Chain Secrets

Most current blockchains address privacy by just keeping sensitive data off-chain● Just put a hash, or ZK proofs about it, on-chain● Encrypt, put ciphertext on-chain, keys off-chain

But off-chain data- or key-holder is a trusted party● May “forget” to report [improper] uses on-chain● May “forget” to store, disclose when required● Off-chain encryption keys irrevocable if leaked

On-Chain Secrets

“CALYPSO: Auditable Sharing of Private Data”

Encrypt(*) secrets care-of the blockchain itself,under a specific access policy or smart contract● Threshold of trustees

mediate all accesses● Enforce policies,

access recording● Ensure data both

hidden and disclosedwhen policy requires

● Can revoke access ifpolicy/ACLs change

Access-control cothorityWanda

Ron

(1.1) Store secret and access policy for idRon

Blockchain

(2.1) Download

encrypted secret

(3.1) Request secret re-encryption

Secret-management cothority

(1.2) Log secret

(2.3) Log access

(4) Decrypt secret

(2.2) Request

access to

secret

(3.2) Deliver re-encrypted secret

Ron’s identity skipchain (idRon)

(*) with post-quantum security if desired

Application: Personalized Health

Application: Data Science

Defense-grade Data Security

Application: Blockchain E-voting

Prototyped blockchain-based e-voting system● State-of-the-art cryptographic security/privacy● Validated, approved for deployment within

EPFL community of 10,000+

Exploring next-generatione-voting technologies● In contact with

Geneva, Swiss Poste-voting efforts

Privacy-Preserving Processing

Can we compute on private data? At what cost?

Intensely active area of cryptography research…● Fully-homomorphic encryption (FHE)● Secure multiparty computation (SMPC)

…and blockchain/smart contract activities, e.g.,● MIT Enigma project● EPFL UnLynx project

UnLynx: Privacy-Conscious, Blockchain-Secured Medical Data Sharing

Functionality:• Allow queriers to query a set of

distributed databases

Requirements:• Data Providers data confidentiality• No single point of failure• Computation correctness• Privacy of data providers (DP) and

individuals storing their data in DPs

Threat model:• Queriers, servers may be compromised• Data providers honest-but-curious

SELECT AVG(cholesterol_rate) FROM DP1, …, DPn

WHERE age in [40:50] AND ethnicity = CaucasianGROUP BY gender

Four Key Blockchain Challenges

● Scaling: doing enough, fast enough● Availability: is it there when you need it?● Privacy: keeping, storing, processing secrets● Stake: who gets how much, when, and why

Any human organization need a way to decide:● Who holds a stake in decision-making● How much

influence eachstakeholderwields

● How decisionsare a actuallyagreed on:consensus

Without consensus, organizations fail

Stake, Influence, and Consensus

Some Approaches to Membership

Permissioned: prove you’re in a meatspace club

Proof-of-Work: prove you’re wasting energy

Proof-of-Stake: prove you’re already rich

Proof-of-Storage: prove you have a big disk

Proof-of-*: prove you have a lot of *’s

Proof-of-Personhood: prove you’re a real person

Proof-of-Work as a Basis for Stake

Proof-of-Work requires miners to expend energy surmounting an artificial barrier to entry,just in order to prove they did that.

Important point: Proof-of-Work servers no purposeother than to erect an artificial barrier to entryand create competition for mining rewards!

Have we seen human practices like this before?

Membership by Hazing Ritual

Anything that not everyone will do on a whim:entire purpose is to create a barrier to entry

May be uncomfortable and/or embarrassing…

Membership by Hazing Ritual

Or just plain weird… ● MIT ‘58: using Oliver Smoot to measure bridge

Membership by Hazing Ritual

Or difficult, requiring energy and cooperation● Yap: chisel a giant circular “coin” out of stone

available only on another, distant island

Bitcoin’s Hazing Ritual

Digitally flip coins.

Many coins.

Billions of them.

By forming new “blocks”and feeding them into acryptographic hash● Converts any information

to pseudorandom number

Repeat endlessly.

Environmental Costs

Proof-of-work = “scorched-earth” blockchains● Bitcoin makes BTC scarce by making miners

prove they wasted energy● Serves no purpose except to prove they did it●

Bitcoin Energy Consumption Index

Bitcoin now wastes more energy than159 countries use for their people to live on!

Not Even Decentralized Anymore

Market incentives drive consolidation of hashrate or “voting power” to a few powerful mining pools● Over 60% currently in one country (China)● Any faction >51%

can control orveto decisions,censor, etc.

A Problem Not Unique to Bitcoin

Most cryptocurrencies aren’t that decentralized

Permissioned Ledgers

Just decide administratively who participates;Fixed or manually-changed group of “miners”

– No proof-of-work needed → low energy cost– More mature consensus protocols applicable– Higher human organizational costs– No longer open for “anyone” to participate

The Weakness of Limited Scale

Public/permissionless designs in principle have the advantage of security scaling with size● As more participants arrive, security increases

Closed participation designs limit security scaling!

Weakest-linksecurity

Strongest-linksecurity

ScalableStrongest-link

security

Alternative: Proof-of-Stake (PoS)

● Proof-of-Stake: assigns consensus shares in proportion to prior capital investment– Could address energy waste problem– Major unsolved security & incentive problems

● Securing proof-of-stakeis a nontrivial, interesting,but mostly-solved problem– e.g., Orobouros, Algorand– Also implementable with

CoSi + SkipChains +OmniLedger + RandHound

How important is Proof-of-Stake?

A Proof-of-Stake cryptocurrency is essentially an automated analog of a shareholder corporation.● May help hasten the takeover of automation,

but won’t fix the world.

It’s all just “Proof-of-Investment”

Proof-of-Work, Proof-of-Stake, Proof-of-* are allProof-of-Investment, aka investment capitalism.● The more * you invest, the greater your reward.

All prone to re-centralization, aka rich get richer● Larger stakeholders always in a better position

to exploit economies of scale – or just cheat –to further increase their percentage of the pie.

Proof-of-stake won’t keep systems decentralized!

Toward People-Centric Blockchains

Can we build decentralized technology that will● Securely stay open and widely decentralized?● Offer a fairness metric meaningful to people?● Be accountable to users rather than wealth?

“We must act to ensure that technology is designed and developed to serve humankind, and not the other way around”

- Tim Cook, Oct 24, 2018

One Person One Vote?

Proof-of-Personhood [IEEE S&B ‘17]● Proof-of-Stake but one stake unit per person

Proof-of-Personhood: Approaches

● Legacy Identities (e.g., government-issued)– Require costly ID-checking, not that hard to fake

● Global Biometric Databases (India, UNHCR)– Huge privacy issues, false positives+negatives

● Trust Networks (PGP “Web of Trust” model)– Unusable in practice, doesn’t address Sybil attacks

● Pseudonym Parties [SocialNets ‘08]– Requires in-person participation, physical security– Low-cost: verifies only personhood, not ID or trust

Conclusion: Key Challenges

● Scaling: doing enough, fast enough● Availability: is it there when you need it?● Privacy: keeping, storing, processing secrets● Stake: who gets how much, when, and why

Conclusion

Blockchains are exciting technology, but have a ways to go to achieve the properties we need!● We’ve taken a few steps in scalability,

availability, privacy, foundation for stake… ● But many open questions and challenges,

in these and many other areas.

Further information: http://dedis.epfl.ch/