Upload
others
View
0
Download
0
Embed Size (px)
Citation preview
Programming Distributed Systems13 Blockchains
Christian Weilbach & Annette Bieniusa
AG SoftechFB Informatik
TU Kaiserslautern
Summer Term 2019
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 1/ 57
Introduction
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 2/ 57
Blockchain?
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 3/ 57
What is a blockchain?
It is a chain of blocks.Actually just the (replicated) transaction logWhat is the point actually???
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 4/ 57
The Bitcoin blockchain: the world’s worst database1
Would you use a database with these features?
Uses approximately the same amount of electricity as could poweran average American household for a day per transactionSupports 3 transactions / second across a global network withmillions of CPUs/purpose-built ASICsTakes over 10 minutes to “commit” a transactionDoesn’t acknowledge accepted writes [..]Can only be used as a transaction ledger denominated in a singlecurrency, or to store/timestamp a maximum of 80 bytes pertransaction
But it’s decentralized! (is it?)
1Source: https://tonyarcieri.com/on-the-dangers-of-a-blockchain-monocultureChristian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 5/ 57
Political motivation
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 6/ 57
Satoshi NakamotoMysterious inventor of BitcoinThis is not Satoshi Nakamoto
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 7/ 57
On 31 October 2008 on some crypto mailing list
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 8/ 57
Anarchocapitalism
Strong form of free market ideologyDirected against (central) banks and statesMarket and money are sacrosanct (following Friedrich Hayek, AynRand)Affiliated to libertarian ideology prominent in Silicon ValleyBut: can also be read as reaction to monopolisation andprivatisation
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 9/ 57
Platform economy
Examples: Facebook, Uber, Google, Amazon, AirBnB, . . .
Strategy:
1) Get users on your platform and grow as fast as possible withvencture capital (VC) money
2) Encourage network effects through open strategy and freeproducts
3) Privatize platform and own data ⇒ profit
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 10/ 57
post-68 Internet vision
Platform economy focuses on individualism of consumerTurned into vague, “Orwellian” startup terminology: disruption,democratization, participation, openness, progress, communityBut: today it is threatening surveillance capitalism
Amazon Teams Up With Law Enforcement to Deploy DangerousNew Face Recognition TechnologyGoogle Is Quietly Providing AI Technology for Drone StrikeTargeting ProjectWe work for Google. Our employer shouldn’t be in the business ofwar
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 11/ 57
What now?
P2P systems & free/open source movementCypherpunks: cryptography, e.g. PGPPolitical ideologies against centralization:
left anti-state, right anti-stateExamples: BitTorrent, Bitcoin, Wikis, gitIdea: Software emancipates from hardwareProblem: no economic systemAnswer: ICO-mania as response to VC funding??
ICO (initial coin offering) = a quantity of cryptocurrency is sold in theform of “tokens/coins” to speculators and investors, in exchange forlegal tender or other cryptocurrencies
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 12/ 57
Bitcoin
Political argument as codeGame theory as programmable economicsTechnical design not from angle of DB architectDistributed system as answer to centralization of power
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 13/ 57
What is a blockchain technically?
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 14/ 57
Blockchain as DB≈ Strongly-consistent database:
⇒ total order of events (like atomic broadcast)
⇒ scalability ≤ any strongly consistent DB
Problem is permissionless environment: Adversarial
Needs to be decentral/neutral w.r.t. to peers running the network
Cannot be privatized
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 15/ 57
Byzantine Fault Tolerance
Paxos, Raft, etc. are supposed to run in trusted environmentAdversarial environment: fake messages, drop messages, delaymessagesThreshold of honest peers (generals), e.g. > 2/3
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 16/ 57
Bitcoin
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 17/ 57
Design objectives
Economics: game theoretic equilibriumState: no censorship or seizing of moneyMoney: no inflation through central banksPolitics: decentralized network
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 18/ 57
Nakamoto consensus[1]
Byzantine fault-tolerance (fake message, dropped messages,delayed messages)Technology existed 10-15 years before BitcoinRecombination is novelInteresting usage of cryptography
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 19/ 57
HashCash (1997)
Problem: spam flooding protectionIdea: To post on message board you have to do a tiny amount ofcrypto work, but spammers have to pay proportional priceUse property of cryptographic hash functions like SHA-256
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 20/ 57
On cryptographic hash functions
Hash function H takes arbitrary string as input and produces fixed-sizeoutput (here: 256 bit)
Properties:
1) Efficient to compute2) Practically collision-free3) Given H(x), it is infeasible to find x4) Puzzle-friendly: For every possible output value y, it is infeasible
to find x such that H(k · x) = y if k is chosen from a distributionwhere every value is chosen with negligible probability
(→ No strategy is much better than trying random values of x)
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 21/ 57
How can cryptographic hashing be useful
If we know H(x) == H(y), then it is safe to assume that x == yUse hash as a message digest (much smaller than message)Can commit to a message, but only reveal it laterSet up “search puzzle”: Given k and a target set Y , find asolution x such that H(k · x) ∈ Y
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 22/ 57
On hash pointers
A hash pointer is a pointer to some information plus the cryptographichash of the information.
Purpose:
Access to the informationVerification that information hasn’t changedBuild temper-evident data structures!
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 23/ 57
Blockchain: A temper-evident log
What happens if somebody tries to modify the data in one block?
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 24/ 57
Merkle Trees
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 25/ 57
Mining a block: Proof of WorkDifficulty target: Hash must be smaller than this value (leadingzero bits, defines Y )H(b · x) ∈ Y , b block bits, x chosen nonceQuadrillions of hash operations per secondToday: mining pools with ASIC hardware
Source: https://www.buybitcoinworldwide.com/mining/hardware/
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 26/ 57
Bitcoin’s block chain
Started with “genesis” block by Satoshi Nakamoto on Jan 3, 2009Blocks can join and leave: ⇒ replay operations to obtain actualstateDistributed ledger of 235 gigabytes (Jan 2019)Most difficult (≈ longest) chain winsRace between minersGossiping P2P network of Bitcoin nodes (aka Bitcoin Core)Milliseconds matter!
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 27/ 57
Block structure
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 28/ 57
Consensus specification
Choice between “Immutability” or “Code as law” . . .Rules: Implementation is specification (including bugs)C++ codebase + dependencies (Ughh)
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 29/ 57
Trust model
Checked before a block is accepted30-40 rules for transactionImportantly: 0 sum changes, positive balance30-40 rules for each blockRules are specified in C++
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 30/ 57
Pseudo-algorithm
1) Take chain with most work behind it2) Take received transactions and build a block3) Try to brute-force a H(b · x) ∈ Y with current difficulty level4) Either find a block first and propagate it as quickly as possible or
receive a new block: Repeat with 1.
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 31/ 57
Transaction-based ledger
Authorize txn by signing with owner’s keySimplification here: only one txn/blockValidation check with hash pointers
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 32/ 57
Miners against users?
Idea: incur cost vs. expected rewardFixed amount of block rewardAssumption: at least 50% of nodes are honestCorresponds to voting/betting on winning chainCheating: create invalid blocks or delay networkBut: does not pay to cheat
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 33/ 57
How high is the probability of a fork of length N?
pN , where p is the probability that both partitions mine a new block ineach step at approximately the same time.
⇒ astronomically small for larger N .
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 34/ 57
(Imaginary) Example of fork
Example: Germany blue ↔ Japan redPartition in network happensNext block either is created in blue or red or in blueOrphan the blockRed wins: Take transactions from orphaned block, replay blue txsOther chain never happened
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 35/ 57
Convergence
Probabilistic convergenceA fork of size 1 happens dailyA fork of size 2 weekly. . .A fork of size 6 practically never happens. . .
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 36/ 57
Bitcoin bugs
April 2013: 7 blocks forkCause: switch to LevelDB in implementationBlock with 1200 transactions⇒ crashed BerkelyDB (max. 1024 txs) (bug)
A block that had a larger number of total transaction inputs thanpreviously seen was mined and broadcasted. Bitcoin 0.8 nodeswere able to handle this, but some pre-0.8 Bitcoin nodesrejected it, causing an unexpected fork of the blockchain.
Source: https://github.com/bitcoin/bips/blob/master/bip-0050.mediawiki
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 37/ 57
Problems
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 38/ 57
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 39/ 57
Currently consumes electricity, powered by coal mines (!!!)High latency: 10− 60 minutes (6 blocks confirmation)Low throughput (< 10 tx/sec)Actually eventually consistent (always reversible)
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 40/ 57
Ethereum
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 41/ 57
Ethereum
Generalization of ledgerCurrency: EtherAttempt to make blockchain programmable: “world computer”
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 42/ 57
I want you to write a program that has to run in a concurrent environmentunder Byzantine circumstances where any adversary can invoke your programwith any arguments of their choosing. The environment in which yourprogram executes (and hence any direct or indirect environmentaldependencies) is also under adversary control. If you make a single exploitablemistake or oversight in the implementation, or even in the logical design ofthe program, then either you personally or perhaps the users of your programcould lose a substantial amount of money. Where your program will run, thereis no legal recourse if things go wrong. Oh, and once you release the firstversion of your program, you can never change it. It has be right first time.
I don’t think there are many experienced programmers that would fancytaking on this challenge. But call it ‘writing a smart contract’ andprogrammers are lining up around the block to have a go! Most of them itseems, get it wrong.2
Source: The morning paper, Zeus: Analyzing safety of smart contracts MARCH 8,2018
2Kalra et al. ZEUS: Analyzing Safety of Smart ContractsChristian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 43/ 57
Ledger → Runtime
Transactions are interpreter state transitionsTuring-complete, general purpose imperative environmentReplicate a deterministic state machinePrograms: Smart ContractsDeployed as immutable code
Low-Level Lisp (LLL)Solidity
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 44/ 57
Example: Solidity
pragma solidity ˆ0.4.0;contract C {
function isSix(uint8 num)returns (bool) {
return num == 6;}
}
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 45/ 57
Ethereum Virtual Machine (EVM)
Stack machineno IO!Ephemeral on-chain memory256 bit words65 logically distinct instructions [2]3
3Implementation in ClojureChristian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 46/ 57
Gas model
Important innovationEvery instruction has a gas price (in Ether)Proportional to memory access costInvoker of smart contract has to provide etherSmart contracts can call each other
What happens if gas runs out?
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 47/ 57
Problems
still PoW (high energy cost)still high latency: 15 secs block time4
still low throughput: (˜ 100 txs/sec)
4https://ethstats.net/Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 48/ 57
Tendermint
Adapted from a traditional BFT style approach5
Immediate finalityLow latency (˜ 2 secs)Fork AccountabilityNo mining
5https://github.com/tendermint/tendermint/wiki/Byzantine-Consensus-Algorithm
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 49/ 57
Tendermint state machine
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 50/ 57
Proof of Stake (PoS)
Desire: Get rid of wasteful miningIdea: Replace PoW leader election by stake based voting.Votes are weighted by their stake or the money you have inyour account.Hard Problem: What are economic incentives for convergence?
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 51/ 57
Delegated Proof of Stake
Idea: Elect validator nodes who run traditional BFT consensus⇒ Small and known subnetworkAdvantage: Higher quality of service (QoS) is possible withknown network topologyProblem: Easier to attack or less decentralized
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 52/ 57
Anonymity
Is Bitcoin anonymous? Nope, rather the opposite6
Zero-knowledge proofs (zksnarks): ZCashIdea: Anonymity by design using alt coins
6https://media.ccc.de/v/FWTYS3Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 53/ 57
Summary: Comparison
System Consensus Finality Network Fork-Acc. Program.
Bitcoin Nakamoto eventual open no no*Ethereum Nakamoto* eventual* open no yesTendermint PoS-based immediate closed yes optionalAvalanche PoS-based immediate open no optional
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 54/ 57
Outlook
Similar to Dotcom bubbleMajority of systems today will not survive / have not survivedBut: “Blockchains” will not go away!Possibility for decentralized funding (ICO, . . . )Possibility to build new forms of society with distributed databasetechnology!
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 55/ 57
Applications
Crypto currenciesSmart propertySmart contractsIdentity managementetc.
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 56/ 57
Further reading I
[1] Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cashsystem”. 2009. url: http://bitcoin.org/bitcoin.pdf.
[2] Dr. Gavin Wood. “Ethereum Yellow Paper: a formal specificationof Ethereum, a programmable blockchain”. In: (2014). url:https://github.com/ethereum/yellowpaper.
Christian Weilbach & Annette Bieniusa Programming Distributed Systems Summer Term 2019 57/ 57