New Perspectives in Consensus Protocols - Ivan Homoliak

Transcript

[Music] Well, can you hear me? Okay, perfect. So, uh to introduce myself, let's go here. Actually I'm from Berno University of Technology and uh I'm associate professor uh also part-time I started to work at Bratislava uh SEU and before I was supposed to at Singapore SUTD and my research topics are mostly related to the consensus protocol uh like this talk uh e voting with blockchains with the focus on privacy scalability and also wallets cryptocurrency wallets like

smart OTPs is the scheme that is the first onetime passport scheme uh for their smart contract wallets that was proposed by me and my team in Singapore and it was later adopted in harmony one wallet. Uh also I focus on optimization of L1 uh EVM uh America 3 and also CBDC from the view how it can be useful for uh for the for the people who are using it not from the for the governments or central banks. uh we utilize the blockchains and trusted computing in combination to make it better. So if you are interested in this topic just drop me a message we can talk more but uh for today I will speak about the social capital. Uh we have a master student Uri

who is also sitting here uh who is mostly working on this stuff. Then we have a pro useful work based on mining snarks. Uh other student is Samo who is dealing with this. is also sitting here and the last one is as for the ZK snark in contrast to the previous one which is above snark and this is our current master student who is not here uh but he made a great deal of work so I just want to introduce him so I start with social capital and uh the the idea is to replace the stake for social capital as a next generation step in the evolution of consent protocols and we start by the problem of the proof of work and proof of which relies on the computational

resources that you need to have like buying the mining rig which might be expensive or even owning of 32 ethers might be expensive for you because you don't have 32s. Uh so it limits the participation and and the furnace. Uh it is uh resource intensive and there are some uh some privacy concerns. Uh so the motivation is to leverage the social capital instead of stake uh which you can imagine as a trust or influence uh and use it uh for privacy preserving consensus protocols.

I will tell you later what I what I mean by privacy preserving. Uh so our goal is to democratize participation enhance the privacy and ensure security applications are various across the defy space including advertising influence or communitydriven trust system. So uh as for the existing approaches as I mentioned there are some limitations of proof of work and proof of stake and uh social capital can be built on a trust and reputation of web two uh in the web 3 world and we already seen a couple of projects in this area but mostly at the application layer like a steam parker or friends tech uh but it was not fully integrated into the

consensus layer. So this is the focus of our work work which uh has the idea to use a social capital as non-transferable staking mechanism and with the key features of privacy and user uniqueness ensured by the CK snarks and verifiable credentials uh incentive scheme should prevent to civil attacks as because as you can imagine uh if somebody would like to have many entities in the system and claim uh social capital and use the social capital uh for endorsing the content creators uh this wouldn't be fair. So that's why we need this kind of cryptography and proof of uniqueness to ensure that there are no multiple symbols or no multiple users. Uh we have a proposed to whisk inspire leader

election. So these problems are the same as in Ethereum since that moment. So we have the same kind of uh election uh leader election uh so properties we want to ensure is fairness, decentralization and and privacy and we have a two roles. First is the content creators who are the content know that create the blocks and then we have a followers that are clients who endorse the content creators to have enough social capital to stake it and produce the block and earn their rewards. On the other hand, followers may consume the content and can be get paid for consuming the content. So this incentive model is like double-sided.

Uh here is some demonstration of a bootstrapping where uh user submit transaction that contains the identity proof uh which probably could be time obtained by centralized identity provider and it can be extracted from the credentials of the users. Let's say we may uh talk about the ID national ID or passport and uh there are some fields that needs to be unique. We just made the hash over them. uh they are deterministic and uh thanks to them we can produce a zk snack proof that can be verified on blockchain and uh it can be stored uh in in the form that you can preserve the uniqueness of the each user each and every user. Uh so uh it can be

even optionally affiliated with some other ZK snacks proofs about the web to world that you that you bootstrap this from the your followers on other social networks but it's not necessary what would be better if we bring the users to the platform uh and let the user endorse uh the consensus note. So this is just for a bootstrapping as one option. Uh so we have a different kind of social capital. One is passive which is actually granted to the followers and followers can use them for endorsements and there is active which is earned by an endorsement by the consensus note and used for staking. Uh and there is effective because you may imagine that that some nodes may earn just too high

social capital. So it needs to be a normalization of social capital by some function like square root or logarithm to provide monopolization. uh this function can be even evolved across the time and parameterized by various uh uh various parameters to make it uh more fair. Uh and as I mentioned distribution of social capital is made by the clients uh who shouldn't pay for it because uh they actually making the service to content creators. That's why we use a concept of meta transaction that are refunded by the receivers or content creators. So it's just kind of wrapping of transaction. Here is the process of the operation. You can see that uh when the new blog is created, you have some kind of rand randomness

which is same as in Ethereum and uh selection is based on the social capital. Here is the active social capital which is uh translated by the scaling function and out of the effective social capital you select the candidate based on the randomness. This candidate is entitled to create the blog. He creates a blog includes all the stuff of the content of the blog. And uh this is how how it works. And uh here is the table table of endorsers uh who endorsed a particular particular consensus note. Uh also as for the content uh here is the picture with three entities

where follower exclusive content is distributed to to the users from the consensus node and consensus not can get rewarded. Uh so this is the stuff I mentioned. So let's go further. Uh we have identity verification which is necessary through the zk snack proof and variable credentials. As I mentioned there can be potentially used mechanism from the world coin or currently world or social graphs like bride ID. This is uh just to mention the options and no sensitive data are stored on chain only zk snark and hash of verif credentials which actually preserve the uniqueness and leader election is made by rando

social with using the social capital. This is what I mentioned. So this was third work but I now I go to the proof of useful work which is a bit different concept. Uh so far it was quite virtual now we go to to do some work that needs to be done like a mining of a snark proofs and uh the problem is that traditional proof of works waste computational resources on useless puzzle which are just thrown away. Uh so we might need a consensus that contributes to the society with doing something useful while securing the blockchain. uh so far we've seen a couple of proposals in the history and we've seen that the biggest problem of this proposal was actually that they missed the authentication of the

solutions if I for example mind or find the cunning chain of some prime numbers meeting the properties I didn't embed my authorship into this sequence so it means that anybody who is many little attacker can steal it and say it's mine so this didn't work but now we are in situation where we have a snark and zk snark and we can actually uh exploit them to employ them into the protocol that that a consious protocol that's enabled to embed this information. In the same way we can embed the integrity information which is referring to the processor of the block. Yeah, this was also not possible. Uh so uh so we can provide the useful work and do uh

securing the consensus protocol. That's why uh this protocol come into mind because many clients tend to outsource the computation of snarks and ck snarks even though we said today or had a couple of talks or discussion that it could be done on the end device of the users. Well, for some easy starks yes but they might be more difficult ones which involves the big pictures or or videos. So I'm sure that uh this might have a potential in the future uh especially with real world zk snack proofs. Uh yeah so in this protocol first we have two kind of transaction coin transaction and proof transaction uh coin are just standard that you know from the standard blockchains uh proof

transactions is a request of the client to uh to generate the proof by the consensus protocol for a certain fee that clients has to pay. uh so miners just verify the transaction and compute the proof of the transaction and this process is of course expensive it can be somehow paralyzed on the graphics but the scaling factor is not very high with the graphics card you can have like five times uh improvement not not much more and it's more dependent on the memory than than the computing power and here is the overview of the protocol it starts from the left uh you can see the state tree here like a meatricia tree which is updated uh by adding the transaction. So first of all you you are uh putting the transaction that meet the

difficulty and if you meet have the difficulty met then you start to mine I mean produce the proofs. So after you produce the proofs sorry before you produce the proof the transaction set that you include need to be fixed because every snack proofs here contains the reference uh to the reference to to the current uh block hash. uh so you cannot add the transaction on top of it only uh it need to be fixed before that. So after you compute all the snack proofs you produce the white block this white block references the previous block and contains information about the authorship. Well we are done. So uh we can produce the block. Uh so uh this marketplace is based on the consensus

liar. It secured the consensus and uh clients have to pay the fees to to request the snack proof generation. Wnodes actually compute the snark proofs and include them in a block and earn rewards from fees and newly minted currencies which is standard for the proof of work protocols. Nothing surprising, right? Uh then the block contains uh these two types of transactions like a con transaction and snark proofs. And uh we have a difficulty which is similar in bitcoin to uh to adjust uh adjust difficulty according to the mining power in the network to meet certain time of block creation rate. As for the authentication and integrity, I already touched this

before. Uh but the fact is that snark can embed all the integrity information it into itself before is it computed. So it's authenticated and it prevents uh prevents the inter middle attacker and ensures that the rewards go to the right minor. So here is a bit deeper visualization even though it's just uh just zoom of what I already said before. So uh clients can request a coin transaction to be mined or computation of the snark proofs. So in meool you are actually accumulating the pending snack proofs beside the transactions. Uh then uh then you create uh then you create the block from the transaction and you take this hash of

the block embed it into the snark proofs compute the snark proofs and produce the current block and is published on the blockchain. That's all is the higher view overview. Maybe it's not very readable, but I can tell you that there is a circuit table where you store the circuits. So some circuits uh probably could be even reused and uh actually there are some details of the protocol which are more or less similar or same to existing proof of work protocols. uh we made a proof of concept implementation which is available at the GitHub made by Samo and we evaluated some functionality and security. Our future work is to improve on this and

make a full implementation uh not only proof of concept but we have even something else which builds on top of this work because what was the problem of the previous version? Do you know not my students that others if you compute the snarks snarks are cool but we want to zk snarks and the reason why we couldn't compute the zk snark is that when you outsource the computation of zk snarks you have to no no witness witness so you have to share the witness and witness needs to be kept private to preserve the privacy

property of the ZK snark right or zero knowledge property of the ZK snark. Uh so there was a motivation for the next work how to do it how to do it while preserving ZK snark proofs. So uh we actually managed to do it and uh in this work with Ricard uh uh and it combines the centralization and computation utility and privacy which we didn't have before and uh we can actually hide the private inputs. So now we have a private input supported if we can do it. Uh so we do the outsource proof generation to untrusted workers without revealing witness. So key features are that it's privacy preserving proof generation via

witness obuscation techniques which I tell you a bit more. It secures the consensus produce useful work and we have instantdriven uh instant driven consensus which we want and it scales so private witness okay but in public environment well I could how to do it uh how to do it while it's utilized for zkar computation. So there are potential direction of homorphic encryption or TE or multi-party computation. Uh there are exit couple of techniques that are dealing with them and most of them have some disadvantages. It just take too much or you need a dedicated group of validators to do some interaction and we

don't like interaction. Uh so we were most of these works we found are really in very early stage. they don't have a proper implementation not even proof of concept implementation. uh so finally we decided to go for a witness obuscation outsourcing which is techniques that was proposed in the paper 2022 uh in a journal I mentioned in the poster session so I don't have it here you have motivation to check the posters uh so uh in the system architecture you have a couple types of the nodes one is the the clients who submit the transactions and create the blockchain state then you have the provers who are different kind of clients who want to do

the ZK star computation who outsource and then you have a workers who compute the proofs here are the constants not who creates the blocks uh sorry in this in this way they are even split to two so actually you have two uh two kind of works so it's like a PBS in Ethereum right there are workers who compute the proofs and miners who assemble such proofs into valid snark uh proofs zknack proofs uh we need a trusted setup uh which can be which can be mitigated by by the multi-party computation. If we are using growth 16 system proving system which we actually did to uh to avoid some some cases of uh not

deleting the toxic waste. Uh and for the communication we are using the peer-to-peer gossip network for transaction and block propagation. Uh we broadcast and request response modes. We have a broadcast and request response mode for efficient synchronization. So only uh as much as necessary messages are transferred through the network. And now I go to the techniques we selected. So it's witness opuscation outsourcing. It's inspired by the design of Nakamura and others. And pro actually sends the opuscated witness as a public parameter of the circuit via kind of masking to the worker. And this masking is known only to to the to the

prover or the client and to the circuit. So workers generate the proof using the proving key without without accessing the witness. So uh circuit structure is kept secret to ensure confidentiality and uh in the workflow it's a standard prover just compile the circuit applies random mask generate the witness and then a proof request is broadcast with encrypted witness and circuit hash. encrypted meaning obuscated then then process start with uh continues with the worker who computes the growth system proof and it's verified on chain. So for a mathematical structure uh we have a secret input S1 and a secret output S2 uh and uh public inputs P1 and public go

to P2 actually one mean output and two mean output uh sorry one mean input and two means output we didn't uh do the refactoring here sorry about it so and then we have a a function to be proven and proer samples random value R1 and R2 from fields And it defines encryption and decryption functions uh with with the input as one plus the obuscation value uh and for the outputs it can do the same uh if it's necessary but it might not be necessary for the witness we care only as an input parameter. So the other step is optional. Uh so then we define a transformation function uh of the

circuit. So this is the original circuit of the client who requested it. Uh here is the identity embedded including including the integrity information of the chain and here is the encryption function of the witness and decryption function of the output. Uh and actually if you look on the scheme so uh witness is first encrypted by the client is decrypted only in the circuit. So only circuits know how to decrypt or deopuscate the witness. So in this way you can have a witness which is obuscated as a public parameter. So this is the whole idea. We made a proof code and implementation and we measured some some time of how how long time it takes to to evaluate the different compute

different kind of proofs based on number of the constraints in the circuit and we found out it takes some time of course and here are just some preliminary results. Uh later I believe we will have soon some better paper which will demonstrate this in more detail. So this is just to present the idea and the potential direction where the development of conscious protocols may go. So thank you for the attention and if you have any question please don't hesitate to ask. We still [Applause] have more questions. So if anyone has question yeah I'll give you a

microphone. Yeah. Hello. My name is Ivan. I'm from Symbiotic Protocol. Can you speak a bit louder? Yeah. Yeah, sure. My name is Ivan. I'm from Symbiotic Protocol. We are big fans of proof of stake though. Uh but yeah, the talk is interesting. I wonder if if it's possible for like delegation use cases in that protocol. Do you envision that? Uh the the reason why I'm asking is because like imagine a uh a party that has like reputation and like he's backed by like story and and stuff and he has reputation but he don't know how to

actually run node and use that reputation. So uh is it possible to to delegate the all all all the reputation that he has to the operator? Uh well so we designed this cons protocol based on the social capital as a as a proof of concept. uh we didn't intend to resolve all the details just the important details for the security which we believe we already managed to resolve but uh such details as outsourcing sorry outsourcing delegation it's something that is the matter to be discussed I cannot tell you which one is good on which one not but I understand there are motivation for for the people with the social capital uh to do this outsourcing but on the other

hand they should realize what risk may impose this on them that's why it's better to design this platform when when it's integrated in in some practical application as uh secure by default. So it will not enable uh enable to cause some attacks on the on delegation delegated party delegated. So this is really just just a detail but this can be fit to any other use case that that might work. Uh yeah cool. Uh the second question I have is regarding the bootstrap phase for running such a protocol because like at bootstrap phase uh you have like empty database of of reputation etc. So how do you envision

that? Yes, that's that's true and that's why I briefly touched uh the picture with Zik snack proofs from from the other web two platforms like a Twitter or now X sorry and uh Facebook and others where you can deliver this information which is already signed by SSL protocol probably by SLN which is an improvement for non repudiation and bring it by oracle to the blockchain. So this is the way how how it could be done for the bootstrapping. But of course I agree I agree that it was like that uh or it is like that when you bootstrap you cannot have all the followers there immediately. So yeah. All right. And uh

yeah the last one I have sorry for that is uh like I'm interested in in possible like idea exploration of like how to combine it with proof of stake and make proof of stake more decentralized. Uh so yeah maybe you have some some take on that. Yeah uh actually we were even thinking about making some hybrid combination with proof of stake where somebody may have a stake and not the social capital on the other hand there can be somebody else who might have a social capital and not a stake or you can combine them together. Yeah, we were already talking about thinking about it and if you remember at the times one two three years after Bitcoin was released there were some protocols that enable to reflect the coin age the older coin you

have the easier was the proof of work you have to do right so it's also a kind of combination uh so yeah definitely we were thinking about it but anyway thank you for bringing this out yeah all right uh one more question anyone I guess no. So I want to thank Ian. I really like the proof of useful work because it implies that the other work is wasteful. So please give one more round of applause to Ivan and thank you very much.

[Music]