Consensus Based on Proofs of Space and Time with Bram Cohen | a16z crypto research talks

Transcript

I'm the founder at Chia uh it's a proof of space and time based blockchain so it's as you'll see it's rather similar to proof of work where other people are going towards proof of space this is more of a true Nakamoto other people going to prove a stake where this is much more true Nakamoto consensus but rather improved over proof of work as I will um uh get to uh here uh and I believe some of these techniques uh particularly around how vdfs are integrated uh are likely also applicable to proof of stake as well so uh that seems to be a message that's worth getting out there

um so first of all you have in physics you have this basic formula work equals force times distance uh proof of space and time winds up being kind of analogous to this that proof of work is roughly comparable to proof of space times proof of time that you're mixing together proofs of space and time where space is kind of like force and time is kind of like distance and that acts like proof of work only the benefit is that you do these are two linear steps that can be done where you you know just mathematically multiply them together without actually doing them in tandem which causes a lot less electricity to get burnt than if you're just doing uh

proof of work so uh key to this whole thing is proofs of time which uh in the literature go by the much less poetic name verifiable delay functions and these uh and people talk about verifiable delay functions for security but they're often these like add-on things that they have some consensus algorithm where they cram in uh vdfs in various places for security and this is really presenting a very different vision of them where they are integral to the consensus algorithm itself like very deeply embedded into the entire thing uh I believe this makes it so that you can avoid having to do a lot of the uh slashing uh that people are talking

about these days that it's not entirely clear what exactly the slashing is supposed to accomplish if you're trying to make you know clear definitions of things but kind of hand Waverly uh slashing is meant to punish people for bad behavior where if you throw in vdfs you can generally make it so they just kind of can't do the bad behavior you just put up these like impassable walls and you don't have these uh problems uh so first off for definitions on our Primitives uh a proof of space is something where you have a plot file just this stuff that's stored which is not proof of replication it's important to note it's simply proving that you

have this space and because you have this thing you can respond to challenges very rapidly where with something where you can show the quality of your response um and then you will be able to sign things using this response it's important that the signatures you have produce unique outputs for the constructions coming up as well we're using uh BLS signatures for that uh it kind of hand wavely you can Implement something like this by filling your disk full of bingo cards and sorted order because you pre-sorted them you can respond to challenges very quickly and

see how high quality of a response you came up with um that specific type of construction is is subject to time space trade-offs which are called helmet attacks in this context in other places they're considered good here they're considered bad um there's a fix for those that's Way Beyond the scope of what I'm going to be talking about right now it's in the Beyond helmet paper I'm very proud of that when I came up with the trick myself uh but the the final result kind of winds up acting as if it's just doing lookups on uh pre-computed public keys so you can just intuitively pretend it's

doing that and your intuitions will be right uh so then you have proofs of time a proof of time has uh an input to it and a number of iterations it has to run and it is not parallelizable across those iterations it is extremely sequential across all of them and another important property of it is as it is generating this output it uh it's possible to generate a proof that the output is correct and that proof is quickly verifiable by anybody and it does not slow down the process of generating uh the vdf output in order to generate that proof uh these

constructions didn't really exist when I started Chia I always tell people don't have invent new math here anywhere in your product roadmap I'm a total hypocrite on that one uh but I whined about needing verifiable delay functions until our advisors invented them uh we are specifically using uh 1024-bit uh binary quadratic forms with uh weslowsky proofs um this is the first ever deployed in the wild actual usage in cryptography of class groups as far as I'm aware um so that's kind of neat uh all right so

so intuitively you can say well we can alternate between these and so the the our first green paper described a very simple approach where you simply alternate between these where you have a proof of space and the quality of the proof of space determines the number of vdf iterations necessary to finish it um and a higher quality uh proof results in less iterations um that had a number of problems so we're using this much more complicated construction that I will now explain um so what's going on here is time is going to the right arrows pointing to the left are secure hash pointings um

uh these dotted lines are vdfs running the arrows are just secure Ash pointings um these are the next slide to explain uh the the this whole construction is accomplishing a bunch of things so uh and I'm going to walk through these in this presentation so on the left here we have things that are being used on the right we have in the final thing we have chia security yay um so first thing we have is splitting the chain uh so here uh in our chain we have there are

actually four things going on here and four different kind of rows so here we have the challenge what's called The Challenge chain uh and then here we have the infused challenge chain and here here we have the rewards chain and up here we have the foliage chain a very important component of what's going on here is that not very much is happening in the in the trunk right here up here in the foliage is where all the actual transactions go that's important because transactions are extremely malleable users can trivially

change what's in transactions and when you're going for a construction like this you get a lot of these same grinding problems as you get in proof of stake that someone who has some fraction of the space uh can because it doesn't cost any power to try different things people can just do that people can try a million different versions of the history for the next minute or two and just pick out the one that works best for them uh this is sometimes referred to as the nothing at stake protocol I I hate that term because it's kind of proof of stake propaganda because steak is a solution not a problem the problem is grinding is what

you have that's the form of the attack is grinding um and so almost everything in this construction this kind of complicated looking construction is all about dealing with grinding problems so your very most basic thing is that your proofs of space your vdfs and your signature algorithms all produce unique outputs that you can't just twiddle them and make a kind of valid looking output that might be not quite right but looks okay uh you can't do that at all with any of The Primitives being used here uh if you don't have that none of these techniques work so the next thing up is to try and make it so that the amount of stuff getting factored into all of your challenges is as small as possible so number one it's

absolutely critical that the actual transactions are not factored into this so you have this reward chain down here which is telling you who made the blocks and every time someone makes a block in the reward chain they sign a block in the foliage chain there's a public key in the plot that was used to make the Block in the reward chain and that can sign well sometimes sign I'll explain that in a bit but those sign blocks and the foliage chain that contain actual transactions so the foliage changes kind of hanging off of all of it and the uh the whole thing doesn't work at all if you don't make that distinction

um but uh yeah obviously there's more distinctions here because there's three things in the bottom not one but I will get to that okay next you have Ram quick question sure so is it is like a one-to-one correspondence between blocks on the foliage and reward or is one a subset or the other um the the full only some of the blocks on the reward chain uh make foliage box but that's because they can kind of happen in parallel well I'm going to get to why that is in a little bit um blocks in the reward chain happen um about every 20 seconds blocks in the foliage chain happen about once a minute

basically you can't a block in the reward chain can't make a foliage block if it happens too soon after a different uh after something that made a foliage block uh just because you have a dependency relationship between the uh blocks there and the thing is designed to make it so you don't need Super unbelievably low latency to actually function great so I should think about kind of you know the first thing that happens is transactions gets posted to the foliage chain now I think of those as fixed and now validators are trying to kind of you know validate and earn rewards subsequently on the reward chain well well there's uh hold on there's validators are like Bitcoin validators here they don't they're they're full

nodes um so they're they're they're very much like Bitcoin things they actually have a a complete copy of the entire history of everything they're validating every single block that's made um we have a lot of them it's this presentation doesn't explain there's over a hundred thousand of these running because often when people are running Farmers they're running a full node and it just doesn't cost that much to run a full node just due to good engineering basically the utx outside is a good idea um but um a full node is not contributing to the weight of the chain so so the we sometimes call those validators more often full nodes but they're like Bitcoin full nodes and

there are farmers which are like Bitcoin miners which are moving things forward and there are a lot more of them than Bitcoin they're a lot more distributed but they're performing an analogous thing uh so this is this is very unlike proof of stake which kind of mushes together those those two concepts make sense thanks yeah um all right so the the next thing is we have uh correlated Randomness so uh you see here uh there's this infusion that happens at the beginning of a slot slots are like 10 minutes and then you see as this goes forward nothing new is getting pulled into the challenge chain all the challenges that come up during that time

are vdf outputs that happen uh along this one line of things and only at the end of the slot is another infusion done from the infused challenge chain um if any of you know about uh the the work of David sees group they call these epochs but we as I twiddled the numbers what they call Epoch wound up being 10 minutes so we don't call them he talks um but the idea here is the challenges for this entire grouping of things here are all based off the same value so if someone's trying to manipulate things the very first thing you can do is reduce the amount of stuff that everything is derived from so that's why

you have this separate challenge chain uh happening here that that turned out to be like an important insight into how the whole thing works um uh then you need another thing you need is um uh delayed gratification you want it to be that when someone's making a decision and they have a decision because and decisions need to be available because if nothing else someone can make of a block and go you know what I'm just not going to do this because uh I represent like some significant fraction of all the farmers and just happen stance in this particular time if I don't present

this then it's going to change future challenges in a way which happenstance is good for me uh and so it's worth it to me to withhold this particular block uh even though I'm losing out on the value of that block I'm gaining more than that in the future this is an unavoidable potential uh attack on the system so what you want to do is make it so people don't actually know what the effects of that withholding is going to be so it's never worth it to them to do that because they they won't be able to check and see if it's worth it to them and then you try and make it so that by the time they might go oh wait it would have been better for me to to withhold this it's too late they've already uh published it or gotten orphaned off so

that's um kind of what this shows right here so you have this infused chain and the rule is that the very first uh block made on my pointers acting weird the very first uh block made gets infused into the infused challenge chain the infused challenge chain then does nothing it's just sitting here vdfing until the end of the slot uh at which point it gets infused into the challenge chain and then it goes forward and makes like a challenge so this block here is made off of this challenge but you had to just but this happened because of this right here and so you

didn't know whoever was going to make this block didn't know that that was going to happen until this time occurred and they needed to make the decision about whether to publish this way back here um and further the reason why there's a separate reward chain going on here is this thing is getting buried see all the blocks that are pointing to the reward chain um past this point where this block got infused are now burying this this block uh and so if this was not published then this building on top simply wouldn't have happened and this block would have gotten orphaned into non-existence uh

and if this was published uh then this will now be at the appropriate time then this will now be very widely published and everything is built on top of it and can't be taken back anymore at the time when at this time over here when you actually find out about what's happening with the rewards uh based off of it so that's why there is this whole separate reward chain is to make this burying uh happen uh okay uh another thing that's quite important is that there's only one time alert it's like one tends to kind of naively make it so that you assume that everyone has

to do their own vdf thing which is not a great idea it's pretty hard to have the very best vdf and it's pretty expensive to do it all the time so this whole system is set up so people can simply publish their blocks and as long as there's one honest time alert out there in the world it will be infusing their stuff into it uh and they don't have to worry about it and part of what's makes this possible is that the time Lords outputs don't do much of anything the only decision the time Lord makes is whether to include stuff or not and by definition an honest time word is just trying to include everything uh and then on top of that there's also

these delays there's all these times between when a challenge happened that enabled a block and when the block actually got infused to over here so so every one of these back pointers is there to introduce this delay which is meant to make it so that you can publish something publish a block to the network and then it will have time to get to the time Lords that are out there that are fast and get infused as they move things forward and if you didn't have these delays there would be substantial advantage to whoever it was that had like the smallest latency to everything and this is a problem in uh Bitcoin as well uh that that there are places where if you get to jump on someone by just

ever so small an amount you will win more blocks and that's a bad thing can you elaborate a little bit like time Lords um like which parts of this figure do they contribute to or organized oh uh all the vdfs are made by time alerts okay all these dotted lines are made by time words um so there are a number of time alerts out there running so the in the Chia ecosystem there are farmers who are making blocks there are full nodes which are doing validation and um and uh sending out transactions that are in the mempool and distributing

finished blocks and providing services for wallets who want to know what's going on right now and then there are time Lords who kind of finish blocks that are going out um and publish new challenges and proofs that they're valid uh as they occur and then there are these things called blue boxes that compactify the the proofs of the vdf outputs after the fact the the proofs that you get fast are bigger than necessary so you can have these other things that generate smaller ones later and those can be slow because they can do it at their Leisure you can compact defy things in parallel uh because you know all of them

after the fact and have different machines compact to find different ones uh that's the general ecosystem it's very much a ripoff of Bitcoin um but yeah the time Lords are doing all the vdf thing there's a bunch of them running out there uh we had a funny experience where some mystery time alert appeared that was running quite a bit faster than ours and we have no idea what it was we think it was like some next gen Intel processor that someone some Intel engineer just decided to try running a timeline or something and and left it running for a week and then took it down we have no idea uh what we definitely know is very fast

like if there's anything in the universe that you can remotely prove it's that you have a fast timelord um how much faster was it just curious was it like uh I think it was like I think we were running like 250 000 iterations per second and it was running like 320 something like that it's like it's maybe it could have been overclocked not not entirely sure what was going on there so we couldn't ask them um okay and then there's a bunch of empirical things uh leading to uh better security here the client the thesis of this whole thing is that disk space is out there there's lots and lots

of storage capacity that's out there in the world that's underutilized or getting thrown out and that that it can be leveraged to with very little additional power costs uh make a very high security parameter and this has been out for a while now so we've tested the security thesis and turns out it works so Chia is now at over 20 x bib bites so that's more than that in x sub bytes this is powers of two versus power of 10 thing and uh this has dropped over time but the the price of chia drops by like a factor of 50 from the peak here while the security

parameter didn't really drop all that much where an equivalent change and a proof of work based system would have just been a disaster that those sorts of price drops have happened and caused the whole system to stop working we're here chugs along just fine uh uh we're also uh coordinating uh the circular Drive initiative uh which a bunch of the hard drive manufacturers are joining in as well we're changing industry standards that currently call for old drives that are no longer reliable to be shredded to allow them to be wiped which is generally pretty easy because they're generally encrypted just on the drive these days and you can just throw out the keys um but the industry standards haven't

kept up with that fact over time uh old drives are not reliable enough for archival storage uh but still plenty reliable enough to have plots sitting on them because you know if you're doing archival storage if any of it starts getting corrupted that's a big problem and if it gets calamitously I'll gone that's a huge problem uh where if you're just farming no big whoop whatever it's a little bit of it gets corrupted maybe once in a great while you should have gotten a reward but it failed and if it dies then oh well it died at that moment but nothing worse happens other than you no longer get the benefits of farming off of it so this is going to continue to unlock

a lot more storage I always warn people about investing in farming that people who started farming at the beginning of at the beginning of this cycle here people who had pre-plotted beforehand and were farming here they made bank they made crazy amounts of money um but uh the markets don't like it when there's a legitimate way of doubling your money in a month and so it turned into this crazy high net space and this is likely to be a highly competitive commodity thing going forward because these are not like special purpose Asics like you get in proof of work mining this is just normal drives which are already commodity thing and then people are tapping into the absolute cheapest

versions of all these they possibly can uh it's it's a tough Market some people are making money farming but the expectation is people who are good at it are going to be able to do it uh people who aren't are going to have a lot of trouble and also there's a lot of people who just have these like old dead drives that someone's throwing about out a bunch of drives and someone's like hey how about you just give those to me and they're like here have them whatever and then they start farming off of them so there's a lot of that going on which results in uh it being very widely distributed uh so in proof of work you get these economies of scale about power and other things not not really much at all with proof of space so this is the

um chart of the biggest pools you can see the very largest pool is is only like a fifth of all the space thereabouts um and then on top of that the uh the things that say op here that stands for official protocol the things using that protocol um which is more than not now um the in that protocol the pools don't make the blocks the actual Farmers uh are making the blocks with the pools just kind of helping smooth out rewards that everybody's getting which is all they really should be doing so that's contributing to the level of distribution of the thing as a whole

also a really silly but important point is the number of reward events we have per day is much larger than you have in like Bitcoin we have 5 000 reward events per day which makes it so that the viability of farming on your own and the viability of running a small pool is much much greater than it is when you have a much smaller number of reward events per day because things are already much more smoothed out just at the chain level in terms of the statistical fuzz uh and then finally we have vdfs you need your time words to actually be the fastest they can be you need nobody to have like a faster time word than anyone else so we are using uh

squaring in 1024-bit cost groups that's actually by its nature pretty good for Speed it turns out uh it's spending most of its time in extended gcd which is pretty easy ought to optimize and pretty uh sequential by its nature we did a couple of competitions with hundred thousand dollar prizes for improvements in this got things quite optimized turns out also Intel ifma architecture is good for it uh and on top of that we have put money into getting actual Asics made so we're getting 12 Nano a run of 12 nanometer chips a small run probably around 100 of them uh which uh we're gonna have in our hands around the end of this year and

we're going to be selling most of them uh we're gonna they're gonna be selling for like a thousand bucks if you're not selling these out of profit at all but we're going to have an application process for people who want to buy them because we kind of want to get them into the hands of people who want to help out with the ecosystem and study them and provide value that way uh that's it for the notes I put together for a presentation so I can just do q a now uh I I should probably also note that that first uh you know the well just just this basic um this basic construction here probably can just be applied fairly verbatim to proof of stake uh the main nuances these

uh block making then has to be made by stake right so you take your stake that you have and hash that together with a challenge to find out the quality of it and and multiply by its size uh as well um and that has additional potential grinding because restaking is a grinding Vector so you just need to make it so that it takes a while to restake so it takes like on the order of like a day maybe for that to happen in order to prevent uh grinding a text there um does anyone have any questions this is all very highly technical set of things this is great I don't know so I don't know if you can see the chat

but Sam just posted I believe a couple uh okay how much faster does a malevolent time load need to be uh from the honest ones for things to break and since plots are keyed to the farmer uh does this mean that a malevolent farmer would be forked uh out of consensus pull by users um uh so the in answer to the first one I'm not really sure being like 10 faster doesn't make that much big of a difference um the earlier construction that I had that simply alternated

um vdfs and proofs of space that one uh suffered a lot from having faster time Lords being a problem because there it was just straightforward if you had twice as fast of a Time Lord you would uh you you would get Block you would get double the rewards of anyone else so there was this very straightforward business model of running a faster time lord and charging for it and that that was potentially problematic uh this new construction it's a little hard to say it has this property that when you're time learning you can't really just move your own stuff forward because you kind of wind up moving everyone else's stuff forward while you're at it so you need actually quite a big chunk of all farming capacity to

be colluding along with this faster time Lord in order to get any benefit out of it um it's a little hard to make particularly coherent metrics about exactly what that means we don't have a super great analysis of it but being a little hand wavy it definitely has this property that you're mostly just kind of helping everyone if you have a faster timeline so so like if someone had a 10 times as fast Time Lord pretty high probability they could mess with things and cause issues uh but if someone's like 10 faster it's really not a big deal um oh the next question has to do with uh things being uh keyed to the farmer um I assume that this is asking if

someone behaved really really badly uh would there be a potential for there to be a soft Fork that just bans somebody um a short answer is no on that one uh we have we haven't seen anything vaguely resembling that kind of uh bad behavior happening in the network this is not proof of stake it's just much harder for people to mess with the thing at all um but there's actually a fair amount of privacy inherently for Farmers that if all else failed you could always just redo all your plots you have all your space and you could rerun all your plotting that would have some cost with it although we've gotten the cost of plotting down a lot as well that's been really interesting working on that

um uh and then you know because just anyone can join this is true Nakamoto consensus right the big distinction with like proof of stake is when you have um uh something like this people can just join and leave at any time there's no requiring permissioning from someone who's already there to to join the club you just do it there's no there's no stopping anybody at any moment from just joining and leaving uh because of that you can sort of virtually leave and join you wipe your stuff you you make new pots you're good to go um and also if you were to anticipate that people were doing this you could build things in a way where people couldn't tell that you were all the same entity uh across your whole thing that uh right now the main way you tell that

a whole bunch of things were all done by the same farmer has to do with the pooling protocol that the farmer is intentionally kind of mushing their stuff together uh tying it together with this kind of interesting bit of smart coin programming to allow them to jump between pools your rewards are tied to going to being collectible by a particular um uh Singleton that's sitting on chain and you can set that Singleton to be currently uh controlled by a particular pool where you have the you can pull the plug and recap reclaim control of it yourself um as a farmer and this is uh a good use of smart coin functionality with a very

minimal hook at the consensus layer to enable this um and it has the very nice property that when you have a pool it's the uh the farmers who are making the blocks not the pool uh and yet people can leave the pool if they want to where the pool can't stop them from leaving uh however it also does make it uh inherent to how it works it makes it so that your stuff is all tied together on chain that people can kind of see oh it's this particular Singleton doing things which is a little bit of loss of privacy for a particular farmer although you don't have to use just a single single tin you could split it among multiple ones or in the extreme just not do it at all just

completely go it alone as a farmer yourself with no pool usage whatsoever and then in the extremely unlikely scenario of the exact same plot making two different blocks people could see that but that like almost never happens anymore because the net spaces so gigantic and you could always just you know delete individual plots that did that so at the expense of not getting the benefits of pulling you can get all the Privacy you want as a farmer uh we have a good question about your Association of the vdf so the assumption is somewhat not started I guess the

technology is kind of new with this class groups I was wondering if you could share how was the how was the process of kind of setting the parameters up and oh um yeah so so class groups are not actually that obscure in number Theory they're kind of you know comparable to like elliptic curves or something like that um there it is a different security assumption it's not a particularly obscure or scary one or anything it's something kind of normal um and there's different security assumptions with the proofs that we're using although you could always just change the proof format if there was a problem in those so that that's not uh

not even really a concern at all um there is interesting questions of how you set the parameters to the whole thing like what are the security assumptions to it um the big attack is someone being able to find the order of the group so um so what happened so the reason it's very very important that these are groups of unknown order and they don't really have to remain unknown forever they just have to remain unknown until people are building other stuff on top of the whole thing so if you just found the order of one of the historical groups that would get you nothing whatsoever in terms of the blockchain here

um and uh people did a bunch of work on trying to do rsa-based groups of unknown order and having a setup ceremony for those that did not go well uh but the advantage of this is all you need to have a new group of unknown order is a new Prime so we have so we take our Challenge and we hash it to a 1024-bit prime just by making a bunch of random digits of the appropriate length and checking for primality and modifying it until it's Prime basically um the um

uh from there you have to pick an initial point uh which is another interesting subtlety and we're actually making a new class group every single time we start a new vdf we're not reusing uh groups at all and the initial point that we use each time is setting we make sure that our primes are 7 mod 8 and then we set uh a to two and beta 1 and just calculate what C should be in order to satisfy that and that's our initial point that we use and then it's repeated squaring of that thing and then we throw it out when we're done with that that's that's the Fairly technical details of what we're doing there

I have a question about the rewards uh can you first like comment on how the different players in the ecosystem are rewarded and in particular the time boards and like how much security relies on the design of those incentives uh yeah so the time alerts are not directly rewarded running a Time alert is a public service so it's kind of like running a um full note right and that that full node is not running a full node is costing you something not directly benefiting you so the idea is you try to design it so that the costs are as low as possible uh to make it happen um uh uh yeah so so but by Design there's

no uh rewards for running a Time word it would actually introduce grinding attacks if there were um so but you only need like one good time word on the network and we're going to Great expense to make sure that there's plenty of good Hardware out there to make it not crazy to run a Time word so we're running a few time words now other people are running a few time Lords uh when we come out with our hardware for it which is going to be around three times as fast we're going to distribute that to a whole bunch of people there there will be a fair number of time alerts running out there uh in terms of incentives uh uh on other things uh like I was saying again

there's no direct incentive for running a full node although we have over a hundred thousand of them running because people often run them when they're running a farmer and we have a lot of farmers and it's not it's not terribly expensive to run a full note um the uh the real rewards are for farming and there it's very um Bitcoin like uh there's a ro you get your rewards are a combination of fixed block rewards and transaction fees uh that happen and there's a transaction fee market for just space in blocks and uh the there's a schedule on how this is going to go there's going to be

a couple of um havingings that are going to happen there's gonna be like three of them uh after that there are going to be no more happenings because having a blockchain that's entirely secured by transaction fees is a very very scary thing to have happen so we don't want that um My Hope Is we tried to run the numbers in such a way that even in the terminal case where we're running like the whole global economy uh you still have the bulk of uh you still have the bulk of rewards to Farmers coming from uh coming from the fixed block rewards with a nice bonus a

meaningful bonus but not the bulk of it coming from uh transaction fees when there's a high transaction fee pressure out of curiosity but you mentioned in passing um the workout of David Stage Group which I assume is like their era of time idea which I think was sort of vdf soon as the proof is thick context is there how similar is what are the can you compare and contrast a little bit with their work um I'm not sure where the latest of their stuff is like it definitely got something very directly off of their stuff because um so at the beginning of 2020 I'd been uh I had actually been trying to come up with something better than what we had and

it just wasn't working very well and then his group claimed to have a proof that this correlated Randomness thing worked very well and uh it turned out there was a subtlety I'm not remembering off the top of my head my old thinking there was a subtlety about exactly what was mixed in it turned out you had to um not merely delay how long it took for things to get mixed in but really dramatically reduce the amount of of data that was mixed into challenges in order to make everything work and I wound up then spending most of 2020 on this rather complicated construction that I was just explaining which is much

much better than the old one but requires this like whole series of things to happen on it to be really effective at uh stopping grinding attacks um so I think this is the most what I have here is the most sophisticated like really fleshing out of the whole thing uh that that anyone's done uh to date uh but yeah that that that group is also like thinking in terms of like really leaning pretty heavily on vdfs and do you want to know why we called it vdf and not proof of time in the in the orange end

uh sure we we thought about proof of time it was it was one of the original ideas I think we wanted to to go with delay instead of time to try and avoid people thinking that there was some specific guarantee about time yeah as in wall clock time and more that just there's a proof that some delay happened but you can't reason precisely about the yeah it yeah verifiable delay function is definitely a more descriptive term it's just not as cool sounding yeah I I was definitely uh so I believe that's Joe talking uh Joe is whining about needing these I was also whining

about them and I spoke to danbone about it who actually seemed a bit skeptical that I had an actual use for such beasts in the wild because they had not become important up until then it's kind of interesting because the question of existence of vdfs wasn't exactly a new one because there had been time lock puzzles uh time-lot cryptography for a long time which was kind of just on the edge of useful but not quite and that um and then there were these ancillary questions of like could you do basically could you make vdfs is a question that

had occurred to me and I had worked on it and I had gotten uh absolutely nowhere uh but the funny thing is that the vdf constructions are actually uh the you know newer more elegant ones are based off the same thing as uh the old time lock puzzles were that they um uh that they're repeated squaring in a group of unknown order and it's just the time lock puzzles require a trap door uh where now people have these clever tricks for being able to make the proof even if the the person doing the squaring doesn't actually know anything they just know that they did the squaring um and so uh yeah so the story is

there's two different proof techniques actually using the same repeated squaring in a group of unknown order thing there's a piachak and weslowski and so uh Kristoff sent me a preprint that he did of how to do this with his proof technique which is actually being used for a validation of very large uh primes now it's kind of neat um and and so I sent it along to Dan and Dan was like oh yeah and you could uh remove the trusted setup using class groups and I was like okay we can do that uh what's a class group so that's how we wound up where we are now um the ethereum people really want to do well they had they had a bit of a disaster with um our sacreds

but they really really want to do um post Quantum uh vdfs now uh there are some benefits to that because you can uh make it so the actual Hardware to generate the outputs is much smaller although the necess you wind up having to do this crazy zero knowledge stuff for the actual proofs and so that winds up being a much beefier rig with other assumptions that it's based off of um they have Hardware coming out for that as well but they don't actually have the proof system set up for it yet so I don't know exactly what they're I don't know exactly what their plans are for what they want to do with vdfs I I do know they're not actually ready to do it yet uh so I I needed something

expedient and functional and workable and this is something that we've had deployed in the wild for a year and a half now so it was the the the obvious choice when we just needed something working I think the short answer brand is the Youth Foundation the plans are a little unclear on vdfs if they're ever going to be included as part of the beacon chain but they're I mean they're doing this BLS signature thing instead and the plan is like they could strengthen that with uh vdfs to prevent this like withholding attack that's possible to give you a bit of bias yeah um but it's not clear there's not like a Target launch date for that and they're waiting on hardware and

yeah so my I I would advocate for really going all in on the whole thing um yes that was obviously what I wanted to see it happen too with these but I think they're they're the vdf project kind of missed the deadline for the merge so now it's not really on the front burner yeah another interesting thing uh with uh time lock cryptography is the utility of that is still very much in the open the existence of decent vdfs raises the question of whether you could do um batch unlocks of um uh of time lock puzzles so the problem with time lock puzzles is you can build them

but the expense of unlocking them is massive um which wouldn't be a problem if you could batch unlock a whole bunch of things so no matter how many uh time lock encrypted messages you were trying to crack open at the same time you still only had just run some number of iterations of your repeated iteration thingy and the viability of that as a mathematical primitive is uh still very much an open question kind of interesting potential field of research thank you it's a question on a different topic

um one thing that was really interesting is how you when you mentioned in passing about farming pools you know which and I agree with you that like ideally their role should be in sort of reward smoothing over time so variance minimization yeah but you made this point that actually maybe you already get enough of that even at just sort of a very small percentage because of the higher frequency of reward events especially is that just because there's like a faster block time and there's like a related question yeah yeah so I so the story is I cranked the numbers as much as I dared so we have like around 5 000 reward events per day and I just didn't the numbers started to scare me if I cranked it more than that so um so so that's what we're doing and

um and For Better or For Worse we're sticking with it one nice thing about consensus algorithms is you deploy them and unless you do hard Forks all the time like the foundation is big on doing we do we don't do hard Forks ever um and if you don't do hard Forks ever you can just stop worrying about stuff because it's deployed it's not changing we can't do anything about it but um you know I cranked up the number of reward events as high as I dared and I thought I was pretty good because at that amount of rewards uh even very small farmers I thought would um uh it would have their rewards smoothed out pretty quickly even if they weren't part of a poll so we deployed without a pool protocol actually being written um

uh although there was a hook in the consensus algorithm for it the Hook's very simple all the hook says is you can have plots that's that instead of tying their rewards to a particular public key uh tie their rewards to a particular puzzle hash uh so so that's just where their rewards are gonna go um and it's the smart coin she also has a very very powerful on-chain programming environment that's utxo best that it's a whole other presentation to explain that um there's plenty enough functionality to enable pull protocol there but we hadn't started working on it yet because I did the math and we had around um uh 100 petabytes of space at launch which I thought was a huge a crazy huge

amount at the time but it still looked fine for smoothing uh and then oh boy um and then we launched and our initial coin price was just crazy just insane um which caused like a ridiculous amount of resources to be put into building up farming capacity which is great from a security standpoint but it meant that small farmers weren't getting smoothing uh they were just not getting any things at all they're even if they had pretty great uh positive expected value because coin price was so High um their chances of actually getting it were very small uh so people rolled out like really janky completely insecure

horrible pool protocols uh which people blamed me for and then I said okay well we're working as quickly as we can on a real pull protocol because obviously we need it a lot faster than we thought um and then I had no end of hate rains down on me because it wasn't done yet it took us like like 10 weeks to get it out and people claimed I was a mass murderer for taking so long on this um uh yeah uh but that's that's how we wound up where we are today with the pull protocol and that's why there's still significant amounts of um space that were plotted before the uh real protag pulling protocol came out that uh are using polls that don't work

that way there's been hardly any new stuff plotted since the real pooling protocol came out uh using the completely insecure older way of doing things just um uh people and everyone agreed that the better way was better thankfully um but yeah you do get you know you get these like constant factors that matter right so so you don't always hit asymptotics right like sometimes uh you get you have these real world empirical numbers you know Visa handles I don't know what the number is but some somewhere around 100 transactions per

second I think actually a lot less than that but in that neighborhood and so when you're dealing with scaling you probably don't need to deal with scaling more than that right like you know you have uh you have like real users have internet connections that have some capacity so you have some scale that you can assume that your full nodes can handle and given the very very large number of full nodes we have pretty clearly uh the scale that we're running at is entirely reasonable for a real practical full node uh to handle most likely an order of magnitude more than that and most definitely two would be seriously problematic and result us in a in us having very very few full notes uh so

we've kind of hit a bit of a trade-off where the amount of bandwidth necessary to run one is pretty tiny um and the amount of CPU is something that like a Raspberry Pi can handle just fine that's kind of our a target for that and that's with it having basically the same capacity as uh an ethereum like full validator um and it gets the better scaling mostly just from better engineering Graham thanks so much [Applause]