#263 Justin Drake: Ethereum's Audacious Roadmap to Build a True World Computer

Transcript

[Music] this episode of epicenter is brought to you by Microsoft Azure configure and deploy a consortium blockchain network in just a few clicks with pre-built configurations and enterprise grade infrastructure spend less time on blockchain scaffolding and more time building your application learn more visit AKA ems / epicenter hi and welcome to episode my name is Frank rain today I'm gonna speak with Justin Drake he's a researcher at the Kieran foundation we

had a super interesting conversation about the you know future of ethereum this there was a lot of unclear things in my mind before this conversation unfortunately was able to clarify a lot and I hope you will enjoy it as well so yeah please enjoy the conversation hi I'm here today with Justin Drake justness a researcher at the theorem foundation I actually met Justin a few years ago he was back then he was working he was sort of a fellow at Anthem as' and there was this anthem ace retreat somewhere in the Alps and France was very gorgeous and and he was there and you know we spent quite a bit of talking a time talking there he was working at a different project then that was building

on open Bazaar so I've known him for quite a while but recently it's become very involved in in the same space and working on some of the cutting-edge is hearing work to scale and you know kind of build that the new better hiriam that will hopefully live up to its original promise of being this this world computer so thanks so much for joining us today Justin thank you for having me so I'm curious how did you originally become involved in in the cryptocurrency and blockchain space right so I discovered Bitcoin in 2013 and you know in mid 2013 I didn't really understand what was going on but for some reason

and had this appeal to me towards late 2013 I decided we're going to read the white paper I printed it out and you know it took me maybe ten readings to actually understand what was going on but because it's a short paper I read it several times and you know just the intersection of things of the mathematics which I studied at University and cryptography and finance and computer science and networking all these things came together and so in you know just a few days after you know understanding it you know at the high level I created the Bitcoin meetup group in Cambridge UK and then you know a few a

few years later I basically decided to quit my job and work work full-time on in the docking space so I was a programmer part of my time was programming FPGA age and you know I was spending all my free time on Bitcoin and it was just becoming unsustainable so I was I started looking for an opportunity to work full-time in there in the blocking space and I found this program from activists and premises as a venture fund in London and they were offering basically no strings attached a little bit of money to do research for one year

on the blockchain space alright I jumped on this opportunity and during that time I created a company called the duo and as you mentioned it was building infrastructure on top of open Bazaar so why did he decide to build something on top of open bazaar so back then I was taking a user-centric point of view and I was trying to understand okay how can this be useful to people and you know I realized that there was a lot of complexity and that this complexity had to be abstracted somewhere and this kind of appealed to me you know the idea of building a front-end the UX which was totally

minimal and abstracted as much as possible you know to the extent that we don't even realize that you're using Bitcoin or some other technology and back in the day open Bazaar was the most promising actual use case of Bitcoin you know we were talking about remittances and you know getting discount on pozole oh but you know these things didn't really appeal to me and then the open Bazaar this idea of page appeared decentralized marketplace with like a fascinating vision and I wanted to help out by building infrastructure on top of it to make it easy for people to use it with bizarre so when you started working on open Bazaar hearing was already around so why

didn't you decide at that time to say okay I want to build something on it here and why did it were you you know did you feel more committed to Bitcoin or maybe more in line with bitcoins vision as opposed to theorems so if it was almost nothing back then it was it was an idea it was a team but it was extremely ambitious and I have some doubts as to whether or not the developers would actually pull it off but for sure it's an idea that appealed to me and I followed it very closely the more after and developed the more I realized you know this is the right answer and within the open design community I you know lobbied in a way for you know more than just a Bitcoin

support you know in particular I wanted to have a firm support but it was it was difficult I'd say that you know they were almost Bitcoin maximalist and they you know they've gradually been been softened in their stance you know they've added more corn day and and now you know that at a point where they're looking to integrate a theorem but yeah but I guess that's part of the reason why I left open Bazaar but I think that the main reason why I left open bazaar is because it I felt it was a bit too early so in order to build a decentralized bit in marketplace you need all this infrastructure right you need a scalable blockchain to start with we also you need identity reputation

dispute resolution stable coins all these things that are basically going to take years to build and open those are is about mashing together all these components and making a nice user experience but we don't really have the foundations absolutely because that's that's one of the interesting thing that like stands out to me here is your first you go and you work on a company that's trying to build like you know slick and user application tries to be you know make all of the you know abstract all of this complex technology make it an easy and user-friendly and then you go to like the absolute polar opposite and work on like your theorem research and like s

far we move from like user experience and interface as possible so that's that's quite a true it's kind of quite a shift you made yeah I mean in fact in 2013 and 2014 I was drinking the kool-aid I was you know and had these grand visions of of you know how society would be reshaped and you know part of it you know was that there was this this belief that you know Bitcoin would actually scale and would be the platform for for all these things but you know as as we learned more and more you know Bitcoin took a very conservative stance and didn't change and I think that led to the frustrating of people like myself who

were you know almost Bitcoin maximalist in the sense that I believe the point was was the answer to basically of flip-flopping and leaving Bitcoin in terms of you know going to the polar extreme at the consensus layer I guess you know I learned a hard lesson that we are still very early and you know fundamental problems like scalability need to be addressed and so maybe we should address these first before thinking of the application name but you feel tempted that you know once maybe in two years or three years when there's lots of progress being made you want to go back to building like

end-user applications I think that there might be an option it will take a few years for the full if you're 2.0 vision to be fully rolled out but wanted mature I expect if M 2.0 to you know not require so much maintenance and so much change and it might make sense to for me to build something at the application layer or the service layer because I was effectively on top of the application layer the service layer I was building front end and you know a search engine and we implemented the open Bazaar client in JavaScript as a decentralized note that would run in the browser so

this is kind of infrastructure that is not really the small contract layer but one layer so now let's switch to e cerium and and the theory is interesting because you know what Bendis here white paper came out back in 2014 there was already you know talk about switching the proof of stake and there were some of these long-term ideas for sharding and scaling but I think at the time because they were maybe very abstract people could still have at least the at least this subjective sense that they have some idea about where things are going and and what things look like but then over time what we've seen in the last year is this explosion in

complexity and now they're so just a list some of the things that are being worked on right so this Casper and then there's this Casper FFG where this past finality gotchas there's Casper CBC then there's plasma now there seems to be a lot of different plasma implementation including plasma cash there so the tremendous variety of activity there then there's the whole shouting and I guess you mentioned that Vlad is working on some sort of charting correct by construction so it may be the stiffen charting directions then this is something we're gonna speak later cry debate this is beacon Chane work then there's work on using maybe pls and threshold signatures there

is work on verifiable delay functions and maybe having like a six with your specific ASIC which is very different from the proof of work a six then the work on e was him so I think ed you know it has to come to the point where it's I think really really hard for people to have a sense of where are things going where are they at and what's he theory I'm gonna look like in the future so what's your take on it it is great because there's so much activity is it that maybe it's too scattered and maybe not focused enough or like how would you describe at this moment kind of there to

work on a theorem 2.0 right so I mean you talk about complexity in general and the whole space and I'd say that a lot of the research was driven by the need for scalability and scalability really is a non-trivial thing so you know you mentioned plasma and all the variants of plasma that's a layer of complexity which is a delay layer - and then there's a research happening at layer one with things like like Casper and shouting I'd say a lot of the complexity is you know finding the right way towards and you know the optimal way forward but a lot of the the research and the new ideas that have come out

have settled down towards a really really nice vision which actually is simple and can be explained and image mented with with relative ease but I'd say a lot of the complexity has been modulized in you know word lexical gadgets so for example the finality Casper Fiji you know you can think of that as just one module you know you can go into the details if you're interested but you can also think of it abstractly as just like a finance gadget and you know we have all these various finality get all these various gadgets and they all fit in quite nicely in the Ihram 2.0 operation in terms of road map we've segmented things into three layers and it's not

just in terms of road map but also in terms of modularity so the lay of zero is basically just a beacon chain which is this piece of system infrastructure which manages the rest of the system and it provides services for example such as randomness the management of the validators it provides finality and very several things and it's where most of the complexity lies and then we have phase 1 or layer 1 which is the data layer so if you think of a blockchain you have two things going on one you have a consensus game people agreeing as to what data is being fed into the

blockchain and that would be a layer one for us and then we have layer two which is the execution of the transactions it's been giving a meaning to that data running it through an EVM and have any notion of State and so we have this progressive roadmap where we're focusing on only a zero and then layer one and layer two maybe one thing that would help people wrap their head a little bit around you know around what you're talking about in these different components and roadmap is if we let's look at the sort of little bit towards the end state let's assume that all of these things actually get built out and

they work and we now have this upgraded hiriam that's kind of capable of delivering all the promises made or the expectation set what does that look like in terms of you know what are the main components how do they interact but also what does it look like from a user experience perspective right so in terms of the the main goals of the theorem 2.0 number one is to move away from proof of work onto proof of stake and that's partly you know to reduce the cost of proof of work but also to enable new things for example we're enabling finality and we're labeling Chardon by having proof of stake and then the second aspect is

scalability with shouting and the idea here is that instead of having one single block chain you have 1,024 block chains so you have roughly on the order of magnitude of 1,000 X increase in state ability so from the point of view of the application developer you can choose a child and have your app your dap live in that shot and they will have a virtual machine somewhat similar to the virtual machine and if you're one who no except that the virtual machine will be based on on web assembly in terms of the good news is that you'll have this upgraded virtual machine and

you'll also have more scalability and hence lower fees the bad news is that you'll have to complexity in terms of the cross shard communication and another thing we want to introduce is the notion of sustainable storage or storage ramp or storage maintenance fees and the idea here is to set things up from an incentive standpoint so that the state doesn't keep growing eternally and so as a application developer you all have to take that into account which might make your life a bit more difficult you mentioned there's gonna be all of these different shards as an application

developer I mean is this gonna be a kind of similar thing to maybe a Cosmo zone or polka dot wheeler chain in that you know they may be different and on not a real a chain a pair of chain that there may be different block chains that may be for there's a bunch of game related shards and other shards or does it is that all abstract Li the way and I don't care and this just provides scalability right so I'd say if M 2.0 is very similar to polka dot so we have this notion of a central chain which we call a beacon chain they pull the relay chain and we have a shot when they have para chains the main difference is that we are going towards a homogeneous shot so

every block chain and the consensus layer is exactly the same and that from an implementation standpoint just makes a whole load of simplifications so even though from a a theoretical standpoint it might be slightly less powerful it means that you have a simpler and potentially more robust system and then my other question was will I as an application developer will I choose particular shards because they differ in some way maybe on the type of applications out also on that shard or in some other way so or is it something that I don't care about right so you would probably choose your shot based on um gas costs so every shot will have its

own a gas market which is another complexity and so you know you want to choose the shot with the lowest fees but at the same time you want to choose a shot based on a proximity to other applications so within each shot things should happen quite fast and quite cheaply you want to try and avoid the cross shot of communications there is the proof of work chain as well right where today the ether lives and the application live and now in the future of course we expect that the DC centrist applications will run on the chart so what is going to happen with the domain day today's aetherium proof of work chain right so we use the affirm

1.0 chain the proof of work chain basically for bootstrapping for economic bootstrapping so we already have this this you know billions of dollars in tokens and we use that to bootstrap the f-m 2.0 system and you know one of the main questions that it asks is is the if every point is going to be the same as the one point of ethan yes it's the same and we're using the same precisely to have this bootstrapping mechanism and so down the line the proof of work chain with then at some point be shut down right so we don't really know exactly what we're going to do with the proof of work chain most likely in my opinion is that is going to stay alive in some way or another for many years to come

one option is to integrate it as a contract within one of the shards but that's quite an ambitious vision it's possible that it will just live there for some time another option is to have some sort of a bomb that you know gradually will will mean that applications will have to move away so you can imagine for example a a gas price bomb or gas limit born you know over time the gas limit goes to zero or over time the gas price goes to infinity and think that the tokens will it be possible to movie from their proof-of-work chained to the shards and and also back let's say you need a

rational thing so you take the if in the 1.0 for example 32 if you deposit that into the beacon chain and that makes you a validator and once they're in the beacon chain you can withdraw them in the shot and then between the shards and the beacon chain you can do whatever you want oh that's interesting so you basically burn your like old eath and you receive then new 'if on the on the beacon chain exactly and so when the beacon chain I guess that's maybe a time to speak a bit more about the beacon chain in detail livings understand right is one is that it keeps track of the

validators rights at the validators both on the beacon chain but also in all the shards and it has this process of you know selecting the validators for the different charts and kind of the set of violators and I think that's what we're going to speak a lot more about later because I think that's that you know that's a key part of your work and is there also does it also keep track for example on of balances of ether or will those be in in the different shards right so it keeps track of balances of ether for the validators the validators being the key consensus participants in FM 2.0 and you know it does grunt work for example handling the deposits and

the rewards and the penalties and the withdrawals and all these things as I mentioned it also basically provides infrastructure for the shards and for the system so it provides randomness randomness is important because we will be sampling validators to perform various tasks so we'll say okay this validator will have two proposed blocks on shots you know X Y Z and in this set of validators as a committee will have to do at a station or notarization on this specific shot so the way that we achieve scaling is basically by giving different validators different tasks spread out

across all the shots is very much is very different from the current model where everyone's working on the same shot and there's massively replicated fashion and so we were making these smaller groups of validators be large enough that they are statistically representative of the wider polar validators but they're still quite small and then you say also a kind of location of the validator set so that you know a particular shard will have some valid for some time but then as as a validator I continually will work on different shards yes so in general you want to have as much rotation as possible and that's to prevent what I call adaptive attacks so once you know who is assigned

to which shot you can try and write them or you can try and ddos them or trying to do bad things so the more you shuffle them the greater the security and we have different types of committees so we have one type of committee which is for notarization that's basically to solve the data availability problem and basically you're asking validators is this a piece of data available to download and oh is it not and if enough people say that it is available to download then given your honesty assumption then the data is indeed available to download but there are things which are more difficult and you

can't do the shuffling so fast and that for example is the application the state layer the execution there so when you want to execute a transaction you need to have access to the relevant state and downloading that states will take time you need to think up and so you can only shuffle so fast we are looking into a very interesting approach called stateless clients so in the stateís clients basically users come with their own state they include the state in the action directly and they include witnesses which are basically proofs that the state corresponds to the state route which is the the master checkpoint

and that would mean that the the executors those who are executing the transactions do not have the do not need to have the state and so they can be rotated maximally fast okay great that's know this is helping a lot I think in wrapping my head around a little bit if you've listened to previous episodes with Merlin Grey and Matt Turner you know that Microsoft is committed to providing enterprise-grade tools and infrastructure for blockchain developers well the azure blockchain workbench is perfect for organizations building consortium networks take the etherium proof of authority template for example it's ideal for permission networks for consensus participants are known and

reputable if the area manager has on chain network governance that leverages parodies extensible proof Authority client each consortium member has the power to govern the network or delegate their consensus participants to a trusted operator and parodies webassembly support allows developers to write smart contracts in familiar languages like C C++ and rust Azure blockchain workbench was created on the same principles that drive all production services in Azure so you know you're relying on secure redundant infrastructure that can scale and with built-in services like authenticating api's off chain databases and secure key management services you can scaffold your infrastructure in just a few hours to learn more about Azure blockchain workbench and how Microsoft is advancing blockchain usability and enterprise

check out AKA ems slash epicenter and start building today we'd like to thank Microsoft Azure for their support of epicenter you mentioned that this is unidirectional right so we move to ether from the main chain and I can now deposit it in a contract and I get this right to validate does that mean is their token transfer on the on the beacon chain door because in the initial phase right there is just a beacon chain of charts don't exist yet so does that mean if I'm moving my ether now to to stake on the shard I'm essentially locking it up until the shards live and only at that point I'm starting

to be able to transfer them oh can you yeah that is correct so in the initial phases when we don't have the shots you need to kind of be a believer and want to be a validator for for reasonably long amount of time you cannot transfer the the tokens to other people when the shot is not a application-layer thing it's a user thing it's purely a system thing and we only have system infrastructure and in particular there's no small contracts it's all extremely simple where you would use your even and do all the transactions and contracts would be in the shot and so you have to wait for for that to happen and that will only happen in Phase two when you

actually have the shells have a notion of state in phase one we would have the shot so we would have blocks and and each shard would be growing over time and there would be consensus as to what what the data is but you wouldn't be able to use your eat okay interesting so that will require kind of like a big leap and I guess potentially will mean that a lot of ether would get locked up for you know I guess it sounds like could be a long time exactly yes I mean we are hoping for hundreds of thousands of validators eventually so each validator needs to come in with 32 if but I think the the minimum number of

validators that we will require to start the process will be on the order of 10,000 validators I mean maybe a detail question but I guess will there be some sort of like higher reward if there's fewer validator so that there is an incentive is a Shinto move early exactly yes so the more people there are the smoother rewards and so if there's only in 10,000 validators there will be a huge incentive to to to be a validator you can check that the specific curve is basically a quadratic curve so it's not it's not you know exactly in there there's a there's a different kind of that was chosen so you mentioned the the polka dot relay chain before and of

course one of the functions of the relay chain besides at least the way I understand it besides looking out for the security is that it also has this interoperability function or you know in the cosmos as well if he even though the security and violation layer works very differently there but you have to cosmos hop right that you can set basically used to you know keep track of like token bounces and stuff like that so how does the disc Ross chart come cross shard communication work here is there does their beacon chain have a function in terms of supporting interoperability between shards yes absolutely so one of the key things of the beacon chain is to

allow the various charts to communicate with each other and one of the processes that we have here is the notion of a cross link so periodically within every shot there will be cat points which will be included in the beacon chain and then these check points which we call cross links will will be used for other shots to be able to read the state on every other shot so basically you can think of the beacon chain as being a light client for every single shot in terms of additional infrastructure that we have for crosswalk communication number one is we have finality so once you have a

cross link which is finalized that's like a super strong cross link and it should never revert and so you can really rely upon that at the at the application layer when you want to communicate with our shots we also have some sort of notion of pre finality so within each shot we have so-called attestations which are votes from other validators on the block so every time a block is created you have a bunch of validators who invited to vote as to whether or not that block is building on top of the tip so basically building on the top of the parent which was kind of on the canonical chain and if a block gets sufficiently many of the

other stations then with very high probability that block is going to eventually be finalized even though the cross link right now hasn't been included in the beacon chain and the beacon chain has not been finalized so basically we have this spectrum of finality where it starts with a a beacon proposal building a block and then you have these data stations coming in and then you have the the notary's coming in creating a cross link which gets included in the beacon chain and then the beacon chain gets finalized through the Casper FFG process at the so recently there was the wave 3 summit in in Berlin and Gavin gave a talk and a demo about about substrate and and

polka-dot and I thought Dan is from a 16 C he has this really good question which bit was basically about the you know the composability of Polka Dot versus aetherium and you make this point that you know today on a theorem it's it's really nice and that you can you can write this application and users you know maybe maker as a stable coin and uses like Dharma and prediction markets and you know lots of different things it's very easy to write this application and you know base gasps Gavin okay how is that gonna work in in the polkadot model and you know polka dot they initially talked about having cross chains while contract calls but Gavin basically made the point and I hope I'm

you know not misquoting him here but you know even though that's you know that's in the words but it's gonna take a long time to make this even semi feasible and that you know in the meantime it will actually be much better to build things like that only cerium you know where you have a lot of you're basically on a single chain so I'm curious about this point of composability and you know the ability to write applications that you know that use lots of different contracts do you have a sense of how that will differ in terms of the difficulty between you know maybe the future Hyrum and something like polka dot so right right now in FM one we know everything isn't horrible so

if you have two to small contracts they basically on the same chain and when you make a call it's a synchronous calls of it so that's relatively easy to reason about in the in the 2.0 we want to you know maximize the network effects so we want all the shards to be part of this one organism which is coherent but there are boundaries between the shots and so the question is how do we make these boundaries as as small as possible and reduce the friction and part of the story here is at the consensus layer the protocol layer adding infrastructure to make it easy for the various shots you

communicate so I mentioned these cross-links the post links allow for a synchronous communication between the shots which is different from the synchronous communication that you're used to with you know within the if in one corner context but we're also adding you know this this notion of attestation this pre finality and you can use that at the layer two and layer basically you can have optimistic cross shot communication protocols so with high probability in the default case things will happen as you'd expect even if you haven't gone through this whole process of finality and so you can use that to your

advantage you have very short cross flow of communication protocols one of the things that I expect will happen is a standardization in they crossed out communication protocols something very similar to what has happened with the standardization of tokens for example with Yosi 20 FL 2.0 application layer will be stick layer will be you know very Universal and very generic so you can build whatever type of communication you want and you know that makes it a bit more complicated because you have to make a choice but I think the the best designs will be

experimented upon and they will be standardized okay okay I guess that maybe reminds me a little bit of you know that let's say the work that intelligence on you know if the intellectual protocol which also kind of like you know a higher level chain agnostic and you know recently we did a podcast with Stefan Tomas and we also talked a little bit about their assumption that actually the intellect your protocol it will mostly function between layer two solutions right so like a lightning and Raiden and stuff like that and in between there will be the inter letter so do you I I guess it goes a little bit in this direction to

know that like many people could come up with some sort of like standard interface between the different charts and then there will be kind of like a competition and maybe a standardization effort and at some point maybe people will converge on some some standard right I think there will be lots of experimentation and some standardization at the application layer I also think you know we can make upgrades and add infrastructure as required so one of the pieces of infrastructure that I'd like to see for example is you know synchronous maybe cross shot transactions just a pure Eve so we're taking a very specific use case just the

transactions of Eve and you know kind of adding native infrastructure for that you know we might take the best designs at the layer two and the most popular ones and and find them so basically include them at the protocol layer maybe to simplify them in some way or to give them a special feature so the way that I think you know of a fem 2.0 is as this this base layer which is actually very simple and then you have all these gadgets which add functionality so you know finality is is just a gadget you don't really require it it's nice you have because it makes the communication cross-chain simpler and

also you have you have more confidence in the chain that you know when it progresses and I think we will add more and more things going forward so we will make sure that the EVM is aware of components that are added at the protocol layer let's us say in this future I'm going to eat a scan and I have an address and I wanted to see how many ether are in in this address then what does ether scan do on the back end like it does my e to live in a particular chart and now there has to be some sense of which shard to an it query to see the balance or like how would

that work yeah so I think most likely the address will contain the shard number in addition to what we know as the address right now just because the concatenation of these two fields and you just paste that into if a scan and you'll be the same user experience that you used to okay okay great well we've alluded to it before but let's dive into this now so the the question about randomness like what is what's the reason for needing randomness in a theorem 2.0 right so at the consensus layer you need randomness to sample the validator so you have this massive pool

of validators potentially you know close to million validators and you want to assign them different tests and it's important from a security perspective that it be random because you know otherwise as an attacker you can try and you know assign yourself to one specific shot and take over that shot for example and so the two types of sampling that we do is one which is kind of monopolistic sampling where you just sample one single person and you give them a task and they have multiple in power with that single task and we use that for example for block proposals so as every single so-called slot there's a one single proposer per shot he was invited to extend the that specific shot but you

also have these committees so committees are you know on the order of hundreds of validators and they're meant to be large enough to be statistically representative of the of the wider pool and because you have this honesty assumption so for example you're assuming that the two thirds of the validators are honest when you do the sampling process the committee you know with extremely high probability that at least half of them are honest and so you can ask them to do a task and and vote and if at least half of them vote for something then you know that there's at least one honest person who's voted and so whatever they're voting on is indeed a reflecting of the truth

I would say let's come back to the role of canoe how specifically randomness is used in in the validator sampling and how you spare father will delay functions but I would love to also hear your take a bit on you know what is the value of having randomness as a you know as something you can make an API call to write like I'm building an application and I can now say hey give me some randomness and I use that to you know make some decision or you know split some fork or maybe distribute some money or you know to a lottery so I think the lottery example is something that you is kind of

obvious to anybody right so I we could we could make a smart contract we all put some money in and then you know randomly chooses maybe one out of everyone who put the money in according to you know how much you put in right so you could make this trust let's see centralized lottery which you know it sounds pretty great but what are some what are some other exciting applications that you think will be possible with having this randomness source right so let me just go back to to to the randomness because in a way we already have randomness with proof of work right proof of work is about randomly sampling a miner and you have a random number which is going to be your

your block hash and you know that is something that we already exposed in the film Lampoon Oh layer as an opcode that you can use one of the things that you need to be very careful of is that the this block hash is is possible meaning that an attacker if they want to can have some amount of influence over what that random number will be and the way that they do that as a miner is that they will withhold their block and not broadcast it if the block that they've mined has a random number that they don't like they basically discarded and a lot of the decentralized randomness schemes suffer from this bias problem

and so you know we've put a lot of effort in trying to build something that is unbiased able similar to what Definity is doing where they have a unbiased for random number scheme using using BLS signatures now why is unbelie-- important let me take the example of the lottery let's say that an attacker has one single bit of bias meaning that they can choose between two random numbers at any given point in time for example when the lottery winner is selected now if you have a lottery with a hundred million dollars and you as an attacker and you come in with another hundred million dollars so there's 200

million dollars in the pot if you have no bias you would be you know your probability of winning would be 1/2 and so your expected return would be 100 million but now that you have one bit of bias you can reward line once and so you can choose between two two numbers and so your probability of winning now is 3/4 and so you've basically stolen 50 million from the community just be by being able to buy the randomness and so just in general gambling casinos and all these things are on these applications so in terms of applications beyond lottery you have all the various gambling applications like casinos and poker rooms but you also have games you

know such as crypto kitties and there's also applications in the proof system so if you have a zero knowledge proof for example a stock you can decompose it into into smaller chunks where you have this interactive protocol you have a you know approver who's challenging some is being challenged and here you need to have a strong randomness for the security to work you can also think of systems which again have a pool of validator than you sample them and so you can use that to build you know proof of state systems on top of it here and so with somebody I pls but you mentioned affinity and you know for

listener interesting that we did a podcast with Tom and Dominic before we also talked about you know BLS and and and they were all there does that qualify as unbiased ball yes so the way that their scheme works I mean BLS a chance at economic technicality is then you have various participants who have a share of a secret and if sufficiently many people come together specifically you need to reach a certain threshold then you can generate the next the next number and you need at least this amount of people to generate the next number and the next number is totally unique

and deterministic and it's impossible for someone to predict the next random number if they don't have the share and it's impossible to bias because it's just a single correct answer as to what the next random number will be right so so in Definity right specifically let's say we have 500 kind of nodes in this set and then if more than 50% I mean you're 250 I guess right come together they can create the next key but which of those 250 come together is irrelevant right like any anyone will you get the same result but you need to get those 250 in order to get that result right I

mean you do want to have a well-defined committee because if you have say two different committees that are each invited to create the next random number then you can grind between the two you know one will come first or something like that so you do want to have on ambiguity on on who will be doing the other tasks the main problem with the definitive scheme is what happens if you don't reach the threshold of active participants people who are online and honest and one this is a problem because people could be dishonest and you know actively decide to not participate and affinity is already making an assumption that one-third of the people are going to be

dishonest but the other problem is that in the honest people you know they could just be offline for all sorts of reasons and one of the design goals that we have in the theorem is to survive world war 3 so if you know 80% of all the validators suddenly go offline and they stay on flying permanently you know we still want the system to go ahead in the case of Definity it takes just 10 or 15 percent of the honest players to go offline for the liveness of the system to be threatened so it's 10 or 15 percent but wouldn't they need just around hat and 50 percent of the of the participant 4 to produce the next signature so divinity requires 2/3 to be

honest and online so there's two assumptions here honest and online that already you've lost one-third that are dishonest by assumption and so you only left with 56% of these 66 percent if you have even a small fraction that are offline let's say 10% then you will eventually get a committee where you don't have this threshold of half on honesty online and with 10% I think you will hit that you know within a day or two ah yeah yeah okay he's around because there will be different committees chosen and and then you could get unlucky in some way I guess if the committee isn't if it's not a big enough

number and and then halt yeah I mean I guess we'll see if these assumptions are so problematic or if you couldn't then also do something like a hard fork in a kind of extreme scenario like that and you could still recover yeah so you could try and do a hot fork but you need to know who's online and who's offline because if you just you know restart and most people are still offline then you know you'll just store in a pen lads later so that's not useful in terms of whether the assumption is that you know two thirds are honest and online is like a good one to make in the long term that's very difficult to to know it's a bit like a like a seatbelt

right the seatbelt is only useful in the one instance where you have an accident and that you know Randy happens in but when it does happen you really want the seatbelt yeah I mean no of course nobody will argue that things being equal it's much preferable if the thing goes wrong and doesn't have this assumption so that that's there's no question here so let's speak about the I guess the verifiable delay function into role that this delay function has in you know and how randomness is created on this beacon chain right so um you have these two classical families of randomness schemes one is based on commit reveal and one is

based on facial cryptography so commit reveal that includes the proof of work because in a way you've you've committed yourself to random number just by burning electricity and then you have the option to either reveal it or not reveal it and then there's schemes which are you know based on proof of stake which is a cold Randall so with Randall you just pick a secret on your computer you commit to it by hashing it and publishing the hatch and then at some point in time you invited to reveal the secret and that will contribute towards the entropy pool of the system and then you have this other scheme which is based on unofficial cryptography data before what upon which Definity is based and in each of these two classes you

have two of three properties that you want the three parties properties that you want is one unpredictability - you want a lightness you want the skin to continue even if people go offline and three you want unbias ability the commit reveal doesn't have unbias ability and the federal scheme doesn't have fun this and so the approach that we're taking is to take Randall which is not unbearable but has the strong lightness property and somehow upgrade it so that you have unbiased more random numbers and this upgrade process involves introducing the notion of time so you want to try and introduce lower bounds

on the amount of time before and that hacker knows how he is manipulating the randomness so that he's basically manipulating things in the dark and he will be unable to actually have a meaningful bias on the randomness so let me try because I think I you sort of wrap my head around how this works now after you know we spoke briefly before and I watched your you know your theorem talk so let me try to explain it maybe it can correct me so let's say now this what we're doing right is like me and you you know the two of us right we together create a random number you know we make up this one period and you know

you create this random number and you submit it and I create one and I submit it and then the two together create this you know random number and now the issue is if and and this is it there's a timeout here right so let's say you go first I go second if I don't do it then it's just yours that will be taken as the input for that but now if you just have that right then I'm second I could I could check you know what number when I'm random number results and then I could decide or not decide to add my bit and then you know bias the result and now with this verifiable delay function basically what we're doing is let's say I have five seconds

to add my bit to this which will then generate the round number for a particular period but the to calculate actually what's the output the random number resulting from our inputs it takes longer than I have to submit to my number right so I can I can take yours and I could put in possible answers for my random bit but to know I will bias it it will take me let's say a minute but I only have five seconds to submit the random number so now I don't have to chance anymore Tobias Tobias the random number yeah that's exactly right so instead of having just two Possible's you want to have many more so that

there's at least one which is a unless an online the honest participant will not reveal to the world what their secret is and so that will create an element of unpredictability within the Randell epic the random epic let's say it's ten minutes and you have a hundred participants one of which is honest and then at the end of the epic what the random process does is basically it XOS all the revealed numbers from these 100 people and the XO is going to be again unpredictable because you have one person that is adding unpredictability to it but the problem is that the last revealer although those who are towards

the end could be the last of the last two or the last three etc they have influence once they know what everyone else has revealed because it's an old list and so to prevent this last regular attack you basically add exactly as you said you add a minimum guaranteed delay between when you make the action and when you know the result of your action and so even if you're gonna try and bias things you won't have enough time to know what the action the result of your action will be and hence you won't be able to buy it yeah and of course if I'm able for some reason if I have like it some super quantum computer or something and I can let's say I we have a thousand

people who revealing this random bit and I'm the last one and let's say a heart is like amazing supercomputer and I was able to do it within a split second then I could still calculate okay you know how would I influence this random number and then decide whether I I reveal it or not so there's this hardware component that comes in here exactly so if you have hardware which allows you to defeat the randomness so in the defeat the guaranteed delay which is enforced basically by doing computations it takes time to do computations and hence it takes time for you to compute the output of the VD f f stands for function is just a function

which returns an output if you have this Hardware basically you're falling back to R and L so if it happens that you are the last revealer then you will have one bit of attack surface now in order to create this guaranteed delay you basically need to have an assumption about the speed of hardware of the honest people and the speed of the hardware of the dishonest people with the attacker and specifically you want to place a a bound on how much faster that's like it can be so let's say that you bound is 10x or 100x so an attacker cannot be a hundred times faster than

the honest players and if you have this bound of let's say 100 X then you can make your computation time be a hundred times more than the guaranteed delay that you want and so an attacker can only compress things down to by a by a factor of a hundred and the way that we make sure that it's impossible for the attacker if you have hollow which is a hundred times faster than what the honest people have is basically to give the honest people the community-at-large access to really fast hardware to start with so different foundation is looking to build an ASIC a started state-of-the-art ASIC with state-of-the-art circuits for computing this this vdf and we're going to use an

advanced node and cannot make as many optimizations as we can and after that we're going to make the assumption that the attacker conde that much faster than what we were what we were capable of doing and of course the interesting thing here about doing this like ASIC is now let's say we have this ASIC and it performs at a certain at a certain performance now if you compare this in Bitcoin with Asics I as a miner I have it if I can improve my you know performance electricity consumption and how to put it by you know five percent that's great I'm gonna

do it right I'm gonna invest a lot of money in that because I can then earn more money and become more profitable and you know which is how bit man became like a massive company but here it's not really the same right so here my advantage only comes in if I'm able to like be orders of you know maybe an order of magnitude faster than the rest otherwise like kind of small improvements doesn't doesn't really get me anything exactly small improvements gives you nothing so long as they're below that this critical point and even after the critical point if even if you've somehow managed to to reach that you know your hundred times faster then there's a graceful decay of the security so let save you 101 times faster then

you actually have almost no influence you know maybe one in the million times you'll be able to influence one bit so you have this this perfect on bias ability if you're you know below the number and then that gracefully the case to to to render so also of course economically there's very unlikely that we will see you know an industry merging like we've seen in Bitcoin or like around proof-of-work to continually try to have better shapes and faster shapes like there's just no incentive to do that here really exactly right there's there's very very little incentive so in terms of the incentives required for proof of work

you know we're talking on the order of 1 billion dollars per year that I've burnt by the miners and used for the security of the network in in the context of EDF so you need almost almost no rewards you need on the order of a million you know it's nice to have a reward to incentivize the block proposals to include the VDS on chain but you don't need you don't need more than that and so if you have a faster vdf it doesn't really buy you that much one of the things that it does buy you is that it gives you a larger so-called look ahead meaning that you will be able to know what the random number will be slightly before everyone else but you know at the

application layer you need to be aware of this and make sure that you wait a sufficient amount of time and that the consensus layer we also doing that we're making sure that even if the attacker knows a little bit ahead of everyone else what the random number is that doesn't actually affect the the system in any way ok ok so it could be something like let's say now we have a lottery and I'm able to calculate like slightly more or you know let I mean I guess there could be some interesting use cases let's say you have some on chain event right that's resolved by by this random number and you know maybe you have some derivative market that's based on this and now if I'm able to

slightly you know calculate this 10 seconds earlier then maybe I get some benefit in being able to you know trade on this or do something like that but doesn't really undermine that the core so if you took the example will actually for example you're going to have a point where the ticket sales have ended so for example for the euro million in the UK you know ticket sales closes I don't know at nine o'clock or something and then at 10 o'clock is when they actually draw the number so there's this one hour gap between when the ticket sales closed and when the draw is made and you know applications will have to do a similar thing have to make sure that if someone is able to know the the the random number

earlier than everyone else by a little bit they can use that to the advantage okay and and so yeah so you guys are the Hume foundation together a file coin is now funding this effort to create this open-source ASIC can you speak a little bit with that like what are some of the unique challenges around this right so the number one challenge around the ASIC is just the cost of it so it's you know if you want to have a state-of-the-art ASIC is going to cost between 15 and 20 million and it would be nice if we could split that cost across multiple parties

and file coin is one of these parties that has the most interest in contributing because they would like to use a PDF in that protocol so it's a win-win if we do collaborate at this point in time we actually haven't made a go/no-go decision on spending you know 15 to 20 million right now we're still in the viability phase and we're sharing the cost 5050 in the various studies that were that we're doing before taking a decision one of the nice things is that more people are interested in the vdf so the Dominions spreading in that sense so we have Solana who is also potentially looking to join the the so called vdf Ally Alliance

because they are using a vdf in that protocol way in discussions with tezo's so we have a call with offer and they're potentially going to they might join the alliance you know we're looking to submit a grant to the proposal to the Taser Foundation and then you have a TIA that is also using a vdf in that protocol and they might also join the alliance she is right now taking it slightly technically different approach now they're using so-called class groups where you were using RSA groups you know is the minor technicality and I really hope that we do converge towards the same solution because it'd be nice if we could have the kind of cross

blockchain standard for the video and then you mentioned that this would be given away for free so how are you going to give away these devices right so we have two Hardware functions the first Hardware assumption is that an attacker can't be much faster than the commodity hardware and the second assumption is that there's at least one piece of hardware which is controlled by an honest player which is online so the strategy we're taking is to build thousands of these video tricks distribute them as as widely as possible in the most decentralized fashion possible and hope that at least one of

them is going to be online at any point in time so you know anyone from the vdf Alliance is more than welcome to to have a vdf rig you know will give them to enthusiasts will give them to exchanges to a fee remember if your foundation members will give them to you know Edward Snowden or the Electronic Frontier Foundation Tom PFF you know will give them to to as many people as possible also there's a projects that are looking to use vdf at the application layer so for example there's a decentralized exchange that is looking to use VD FS to prevent the

front-running and so will will make sure to give them a rig as well okay okay but there's it's not like it is something where there's maybe like a marginal reward to like incentivize people to keep it on and keep it running but there's no it's not really comparable you know in like if something like a sig like that you'd want to have I don't know you know a big Center where you have like many of these running or like that's you know that doesn't seem like something that will happen here so one thing which may happen is that people who are simultaneously validators in a fem 2.0 and vdf evaluators so

people running the hardware they might have an incentive to try and slightly overclock the vdf so that they're the first one to have it and they're the first one to include the vdf output on chain and get the tiny reward that is that is assigned to the first but proposer he recruited on chain maybe last thing here and i know this is a difficult question like what is the timeline on these things you know when it is I guess I guess some of their main milestones seem to be you know the launch of the beacon chain maybe the launch of the shards and and then having actual I guess you said the state

transfer where you can have like moving over there and on what time on you expect that to happen right so I've said publicly in several instances that I believe the beacon chain will be available in 2019 that's been zero phase one which is the data layer will come in 2020 and then the virtual machine will come in 2021 now just a bit give a little bit more color on this a lot of the complexity has been put in the in the beacon chain so just reaching this this initial milestone will be will be pretty huge and I'm expecting it to happen towards

the end of 2019 the data layer is very nice because there's almost nothing that is just you know blobs of data that are recorded in a hash chain there's blocks and headers every block is you know fixed size there's there's very very little complexity going on and the focus rule and the the mechanisms of attestation that I talked about is going to be the same as in the beacon chain so I expect the data layer to come early 2020 one of the nice things is that with only the data layer and not the application like this thick layer you can still do

useful things so this is the what I call alternative execution engines so if you one of the easiest examples is this true bit so we've proved it you allow people to to make transactions and these transactions are recorded in the blockchain and with each transaction they make basically making a claim as to what the effect of that transaction is so for example the transaction is compute dysfunction and instead of having the EVM actually compute the function the result is is given and then the collateral and then someone a challenger can come in and say hey hold

on this is not the correct answer the correct answer is 302 and and then they they engage in this game where they figure out who correct and he's wrong and the nice thing about this game is that it happens in logarithmic time so it happens very fast and a little cost for the for the for the virtual machine and so what you can do is that you can stuff the shot with you know all these transactions and execute them somewhat somewhere else for example in 1.0 and this is one of the main challenges that true bet has true bid is there is a wonderful system but even just putting the data on the blockchain is extremely expensive and so

now they have this this this nice option of putting the data on the shards and running the execution on on a film one photo and then the the last phase will be the EVM tupuna which is based on on all the water on webassembly the nice thing is and webassembly is becoming a standard across many many different block chains so it will be well tested and it should be relatively straightforward to add webassembly so that might you know we might also see phase 2 relatively soon one of the things that we haven't completely figured out for example is the sustainable storage model how do we make sure that we align incentives in

such a way that the state doesn't load and grow uncontrollably cool well thanks so much for coming on Justin that was super helpful I feel much more clear about the you know what's coming for 4 theorem so yeah great job and thanks so much thank you for having me thank you for joining us on this week's episode we release new episodes every week you can find and subscribe to the show on iTunes Spotify YouTube SoundCloud or wherever your listen to podcasts and if you have a Google home or Alexa device you can tell it to listen to the latest episode of the epicenter podcast go to epicenter TV slash subscribe for a full list of places where you can watch and listen while you're there be sure to sign up

for the newsletter so you get new episodes in your inbox as they're released if you want to interact with us the guests or other podcast listeners you can follow us on Twitter and please leave us a review on I killed it helps me behind the show and we're always happy to read them so thanks so much and we look forward to being back next week [Music] [Music]