Tal Moran: Spacemesh – The Space-Time Consensus Blockchain (#291)

Transcript

[Music] this episode of epicenter is brought to you by vulturo the gold hedging platform for the crypto community trade gold - bitcoin instantly and securely starting at just one milligram go to volt or gold slash epicenter to get early access to the v2 platform and to start trading and buy cosmos cosmos is building the intent of of blockchains an ecosystem where thousands of block chains can interoperate creating the foundation for a new token economy if you have an idea for a DAP visit cosmos

network / epicenter to learn more and to get in touch with the cosmos team hi welcome to epicenter my name is Sebastian Cujo and my name is foo Devika and today we're speaking with Salman Tao is the chief scientist at space mesh and he's also a professor of computer science at the interdisciplinary Center in Herzliya in Israel and you know space masters a project that's been on the mind for a while because I met one of the co-founders at Def Con last year and he was so excited because he's a big fan of the podcast and you know just like obviously wanted to be on the show and

everything wanted space best to be on the show and you know it was really early at that time they were just kind of starting to you know put the ideas together but since then it has you know transformed into a project that suit will be on test net and it's actually really interesting because it proposes a new way to do consensus that addresses a lot of the issues that people see in proof-of-work and also improve sake so we talked to Tao about a lot of the technical intricacies of their proof of space-time protocol and yeah what did you think FeliCa I thought it was really interesting how he brings together this proof of

space-time which in and office itself is not completely new with this directed acyclic graph topology and I thought it makes for a super interesting project and I am not surprised at all that they attracted massive investments by the top tier venture capital funds in this space earlier this year yeah also they just have a really impressive team of like super smart academic cryptographers that are making this happen I think that a good complementary to the show is a talk that Tao gave at San Francisco blockchain week in November that talk will be in the show notes because if

you're like me and you're more of a visual person you might want to look at the slides that he uses to sort of describe the protocol and how it works other thing to mention is this week we are in Berlin and we are at the cosmos interchange conversations event so that is happening on the 13th and 14th and we've been mentioning this for a couple weeks now let me just give you links for that so if you want to sign up because there's still time as this is being released to sign up to the interchange conversations event happening at full node you can go to epicentral rocks slash interchain berlin and if you use the code epicenter you'll get 65 dollars

off the tickets if there are still places left on that discount code because I believe we had some limited access codes there and then there's a hackathon happening on the weekend so on the 15th and 16th again Asheville node cosmos hackathon so if you want to work on a project and you have an idea and you want to come build it the hackathon at the sign up go to epicenter about rocks slash cosmos hackathon Berlin all those links and details will be in the show notes so without further delay here's our interview with talent on high so we're here with Don Juan Todd is the chief scientist at space mesh he is also a professor of computer science at the interpret interdisciplinary Center of

hit Cydia in Israel and he joins us today from Israel to talk about space mesh a new form of consensus mechanism that will learn all about in this episode thanks for joining us stop thank you I'm glad to be here so tell us a bit about your background and so you come from academia how did you come into the blockchain space I am an academic cryptographer by training and I was always interested in two protocols that have like new ideas and and potentially practical uses and basically I started working a few years ago I heard about no Bitcoin and I have

to say in the beginning it didn't sound you know it didn't understand what the excitement was about but once I started looking at the protocol then you know there's some really nice interesting theoretical questions there and this is how I got started no no how do solve that the problems the theory that come out of Bitcoin so you did a PhD with a mone Gnawa who also worked on ecash with David chump and so what was your PhD on so my PhD was no it was fairly wide-ranging but I think some of the more interesting parts and definitely to a lay audience are protocols that people can do and I think my thesis was called

cryptography by the people for the people and so things like voting protocols where you want to you know make sure that your vote was counted but still keep the votes secret and on the other hand you don't trust computers so what can you do so these are also actually things that are based on some really really nice ideas by david chung and that we you know extended we have several papers on that in that area and also things like how you can use of everyday objects to do a cryptographic protocols like you know we had two cryptographic protocols with scratch-off cards and things like that you studied in your PhD exists in sort of the real world or like it yes detective obligations the voting protocols are

people aren't actually trying to put these into practice and there several different ones there was actually a project that they did at the IDC called wombat voting that had a cryptographic verification there are bigger projects David chan was involved in one in Maryland and I think Takoma Park you don't remember the exact name where they actually did like a citywide election using verifiable voting so so people are working on these things and I think now that you know voting fraud and and you know tax on the voting system have become more you know talked about then these things might have a resurgence and

what about your postdoc at Harvard you tell us a bit about that yeah so I worked with Celine for the Han there and actually some of the things that we did there with the say we we had the first protocol for a proof of sequential work when it was still wasn't fashionable so we came up with a protocol this is together with Mohamed Mahmoud II and it was a very complicated protocol I have to say it was not really practical but last year Bram Cohen in a shoot-off fit Chuck actually have a much much simpler version of this protocol but one the best paper awarded your Crypt and this

is what a protocol were actually using in space mesh has super interesting and Bram Cohen he's also involved with them she a coin right so maybe there's also stuff maybe we talked about this maybe we talked about this for a bit later so but you've been for a couple of years you've been a professor a professor in hysteria and you've started working on space mesh there yes that's correct so I actually started an earlier cryptocurrency first called the mesh cache which had many of the same ideas that it was based on proofs of work and you know the the original motivation was

always to try to replace proofs of work with something else but you know there's just a lot of details there and proofs of work have this one giant advantage is cryptographically they're very easy to work with and they have like they're self-contained they really are very nice in terms of improving their security and so the first version said let's you know do things one step at a time the first version just took the first step of solving you know the scalability problems and some of the incentive compatibility problems that these blockchain protocols have by going from a chain to a mesh and then the second

step was taking the ideas from mesh cache and replacing the proofs of work with proof of space-time which is basically replacing the resource that I'm using instead of CPU I'm going to use disk space and this adds a lot of challenges in terms of how we get things to stay secure and guarantee consensus and that's what we solved basically when we wrote space mesh really interesting and so maybe let's talk about the proof of work and proof of stake and proof of space-time part first and then we can move on to the to the mesh part is that okay with you yeah sure yes fantastic so I mean that there are different issues with proof of work one being that

it's extremely energy intensive but you also feel that there are that proof of stake doesn't isn't a worthy successor isn't a good successor for many causes well white why do you think that is yeah so I wouldn't say that I mean like categorically against proof of stake I think there's some very nice protocols at use proof of stake but proof of stake does have some major disadvantages compared to proof of work so one of them is this sort of circularity right when proof of work is totally self-contained I have a resource I prove to you that I use the resource in proof of stake I'm proving that I used that I spent money

that's in the system but first of all there's the circularity because this is actually a resource only if the money's worth something but the money's only worth something if the system is secure so we have something that seems a little bit fishy and it doesn't mean that it's you know it can't work in practice but it already it's like the foundations are a little bit shaky the second thing is because you have the the whole system sort of you know certifies itself then you have these problems with how you prove security or basically what your security assumptions are so again here I'm talking about things that actually prove security which maybe we'll talk a

little bit later I think that's a critical thing to do when you're designing cryptocurrency protocols but in proof of stake if you want to prevent this sort of alternate history attack where suppose I wake up now after hundred years and I'm trying to find out what the current history is of the system right then if I have a proof of work then there's an easy solution I can see what how much work has been spent on sort of each branch of the the system and now I know what's the true history but in proof of stake if say somebody manages to steal old keys so some somebody manages to steal you know all of the keys at some very far back point

in time then they can now fork the system and create a new history that looks completely valid because the history only depends on you know who has which keys and so this they can sort of fast for this history to the current day and now I have two histories that age simply cannot distinguish between and so I have to trust somebody and this is a problem when what you want is sort of totally decentralized and you know the the trust should also be decentralized and the way they solve this in in the proofs of of proof of stake they either need to add these trust assumptions like checkpoints like okay you know we just know that you know at this point in time

this was the right branch and we just will never switch to another branch or stronger assumptions like the things like you can erase your your memory securely right so if I the honest users always completely delete their old keys and switch keys all the times and nobody can steal them after the fact and this can help you prove security of such a system but these security razor assumptions are arguably you know not so reasonable and because it's very hard to actually secure the erase data and honest users it's not clear that they have an incentive to erase data because you cannot prove that you erased it so you know we have security assumptions that are more iffy

and then there's the final thing which is this sort of permission lists property right so one nice thing about proof of work is I can start doing a proof of work without asking anybody for permission I just you know start my CPU and it works in a proof of stake system in order to join the system I have to get steak and I can only get steak if somebody gives me sticks so I need somebody's permission to give me steak so you can say ok this is just a technical you know definitional property but it's actually not completely technical because there's an attack that's related to this suppose the adversary somehow manages to get a majority of the steak at some point in time it has 51 percent of the total stake in the system it can now refused

to sell the steak to anyone and from now on till forever basically the adversary controls a majority of the steak and this is a problem especially when systems are starting up because systems you know say if the economy's worth a hundred trillion dollars getting 51% of the steak is a very expensive attack but if the economy starts now and it's just worth you know ten million dollars or fifty million dollars then getting fifty one percent of the steak might not be such an unreasonable attack especially if you're talking about things that might be of interest to sort of nation state level actors the the other problem is that this is undetectable so the fact that I have 51 percent of the steak it doesn't appear on the blockchain as you

know todd has 51 percent of the steak I can pretend to be many different people and they can still sell to each other so you don't see this like giant block of steak staying there it looks like the system is fine but at any point in the future now I can decide to crash the system all right so so this is something again is this an actual reasonable attack I'm not sure but I think it's enough of a worry that I wouldn't want say all of the world's economy to be based just on a proof of interesting I I sort of heard of these attack vectors before specifically this last one but the other two said that the trust assumptions that you have to make around checkpoints so you mentioned that in order for this to work one would have

to steal basically all the keys from a particular point in the past and then so this is like the relay base attack right right there no weaker attacks it don't steal all the keys and that their various this is like an example of something that you could do that in order to prevent this you'd need you know some stronger assumption okay but how likely do you think this attack is from I don't know it I don't know and you know it might not be that likely but part of the thing is that these are things are very hard to quantify and you know if you're basing your economy on it I'd like not to have all my eggs in one basket that's understandable I'm much more confident say about mathematical

assumptions such as no it's hard to find a collision in sha-256 then in this kind of assumption about how people behave when the system is starting because we have much less understanding of these types of things if you're holding a significant portion of your net worth in crypto you're probably waiting for your aportfolio to moon anytime but holding crypto doesn't mean you should be irresponsible in the face of volatility risk that's where Volterra comes in Volterra is the leading gold hedging solution for the crypto community and as a stable asset trusted for millennia gold is the perfect long-term hedging solution an epicenter we've been using volt row since 2014 to protect a portion of our company's assets against volatility now you might ask why not use

a stable coin sub which is a great point and don't get me wrong stable coins are great and a real benefit for crypto adoption but algorithmic stable coins are still very new and experimental asset type and some asset back stable coins have been scrutinized for being under reserved with volt Oro your gold is 100% insured and secure it in vaults deep in the Swiss mountains protected by Brinks every single gram of gold is audited and holdings are made transparently available on their website for anyone to verify and most importantly it's quite literally your gold you can choose to have it delivered to you at any time to learn more and to get access to Taro's brand new v2 platform which includes an interface overhaul and trading in - litecoin ether and silver go to volt or gold flash epicenter

that's v a ult oro gold / epicenter we'd like to thank vulturo for their support of the podcast so what you posit as a new mechanism is the proof of space-time can you explain what that is yes so a proof of space-time is basically a real physical resource and ideally what you're going to be using is disk space so I'm going to be sort of filling up my disk and then not using it for anything else for a period of time so and the time here is important because you think of say if I want to rent disk space right I pay by megabyte per month not just by megabyte so it's not enough to say that you know I have this much space

because if I can reuse the space again and again in short periods of time then in some sense my resource is not limited so I want it to store space over time unfortunately we can't quite prove that that's what you're doing so formally what we're actually proving is that either I'm storing space over time or in doing a lot of work of CPU work so why isn't this just a proof of work it's because in terms of incentives it's actually a lot cheaper to store than it is to do the CPU work and we ensure that's true by making the CP works CPU work sort of hard enough so that it always is cheaper and if somehow storage

becomes more expensive than we just make the CPU work more expensive and so honest parties will always just store the data because you know it costs you one cent to store things but it'll cost you two dollars to recreate it and the adversary your assumption about the resources is that this combination of you know CPU plus disk space is still a minority so in the white paper I believe it's the white paper or at least one of the places where you describe space mesh it it talks about the assumption that it is unprofitable for a participant so sort of mind blocks on like a cloud instance or on even a dedicated computer at home

and that one can only be profitable if they're using it on a computer that's being used for other things presumably why is that yeah and I'm not sure if the statement is it's not profitable that's a bit too strong I think the word is used unprofitable yeah okay so so maybe we should be more precise we can't guarantee that it's not profitable right because profitable or not will depend on you know what the price of the currency is and how fast it goes up in all sorts of things that we can't control and they depend on all these economic factors that like they're not part of the technical design or the parameters of the protocol what we hope right the way the protocol is designed is that it should still be profitable for you to do this if you

have a home computer and disk that you already own for a different reason right so if you were talking about marginal cost right buying a disk for a home user is maybe actually higher cost than buying a disk for somebody like Amazon or Google or like some large whale who can have economies of scale in buy discs more cheaply and and this is so the reason the standard thing so in any type of resource usually if you have economies of scale it gets cheaper as as you get more per resource however if you already have a disk for another reason and here we're using the fact that a lot of

people already have disks so for instance I have already for other reasons way before I started space mesh a fairly strong computer that's always connected to internet and it has four terabytes of disk and I probably use two terabytes right and there are two terabytes there because when I bought the disk you know I didn't know how much I need and I think a lot of people are in the same situation so my marginal cost for using these two terabytes is basically zero right i it doesn't cost me anything I'm not a new disc in order to use space mesh and the idea is that because the marginal cost is low for a lot of people then they'll be able to join the the mining system and what we'd like to see is not that there are no whales but that

there's a long tail so there may be a few whales but there are also a lot of people that are small and the the longtail means that if we take sort of that the sum of all their storage it actually comes out to be a large fraction of the total system and again this is nothing that we can guarantee but this is like how that we hope the the system will develop and you know we're doing our best in terms of the design to to help that happen so you're making the assumption here that people have computers with presumably a lot of unused disk space and that these computers are on and connected to the Internet

all the time this is I mean it's not an assumption but yeah if for for this long tail to work then you need a lot of people that have this or willing to have a or maybe you know they already have a computer connected to the Internet and a lot of unused disk space okay but so there's a sort of trend that you know most people now I guess like professionals I mean I don't know anybody who has a desktop computer like most people that I know and myself you know have had laptops for years that are on parts of the day but mostly like you know off or in a backpack or like you know shut down or even in sort of emerging economies most people don't even have a computer they're using a

mobile you know as this trend continues and less and less people are using desktop computers and there might be like a you know significant margin but still like margin of people who are using desktops as this trend continues would spaceman's continue to work then or yeah so i think you know in the worst case suppose there are only a thousand whales right space much still works it's not that you know the space mesh will crash our security assumption is that there's an honest majority right Bitcoin right now is like super centralized right and it looks like it's still working the the reason you want this highly distant we want it really for two reasons one is

sort of this general fairness where we do want you know the everyday people to be able to join the system but the second one sort of the the I think the most critical one for any cryptocurrency even if you don't care about fairness is you want your security depends on having honest majority and the the more centralized you are the less reasonable this assumption becomes so if we have you know eight hundred thousand miners of which you know four hundred thousand are or maybe you know seven hundred thousand have a majority then making like colluding between 700,000 people is going to be really really hard so this honest majority assumption becomes a lot

more reasonable if you have ten miners and they help hold you know the whole system then it's a lot more iffy and but there are lots of video medium spaces if you have a thousand miners they're all very big then maybe it's already fine in terms of like your trust in the system it's not something like technically there's no reason space mesh can't work with two miners right the same reason Bitcoin can work with two miners it's just do you trust that you know if there are only two miners the system actually has an honest majority okay I see so um what me through the process so I actually have two terabytes of unused disk space on a computer that is permanently connected to the Internet

but what do I do now so again you you will be doing this and once our test net launches right or may not depending you know how adventurous you are so you download the the space mesh client and the first part is going to be filling your disk so this part actually requires a proof-of-work I think the exact parameters aren't set yet but think of something like now two days of your computer working and using your GPU and actually solving proofs of work to fill your disk and then once these two days are up the your the space mesh minor goes into the background and

it just listens to the gossip network and trades you know sort of like a full node on Bitcoin and once every two weeks your node is going to create proof of space-time or actually the version of it that we call a nips the non-interactive proof of space-time and it's going to do this by basically reading your whole disk so once every two weeks you have to read two terabytes so that could take you I don't know half an hour once every two weeks and then it publishes something that we call an activation transaction which contains this proof this is everybody receives this becomes part of the block mesh and at the time you publish this activation transaction

it makes you active for the two weeks after so we divided time into periods of two weeks that we call epochs and so you publish something today it means you're active in the next epoch and the the sort of one of the interesting things here is that when you publish your activation transaction you basically already know when you're going to be eligible to generate blocks in the next step book so it's deterministic it's not it's not a lottery at all right if you published an activation transaction and it's not it's not like you know you have to you might get lucky and solve it if you stored something for two weeks then you can generate an

activation transaction if you generated one and published it then you will generate at least one block in the next step book interesting so that that is completely unlike say the Bitcoin IV theorem Network where people actually we're miners band together to to to into mining ports in order for people to actually generate some reward every now and then right right so I think this is a very interesting property and actually also really helps with this decentralization because it it's no longer in a rational to join a mining pool basically right because mining pools usually join because you want to get rewards more often and no more with lower variants so you know it's a

steadier schedule but now you're basically guaranteed you get rewards once every two weeks and you know the there's no probability about it that the probability comes in sort of when within these two weeks you're going to be generating a block so so there is some randomization but the fact that you're going to be generating a block and it will be accepted is guaranteed so so am I going to be allowed to generate one block regardless of how much just space I commit or is it a linear okay so so there's sort of two answers this question it is linear so basically the moment that the way we think of it is every unit of disk space which I think

we're setting at least initially to be something like 250 gigabytes but you know this these are various system parameters or you know tweakable and part of the the reason we're doing a test net is so we can you know play around with them and see what works best in various situations but let's think of it right now is say 250 gigabytes so so if you have two terabytes we have you know four units and each unit is basically behaves like a virtual minor so you get you know four times four blocks in every epoch but we do have optimizations so that you know if you're generating so instead of generating for different activation

transactions with four different proofs you only need one if you generate multiple blocks in the same time period then you can serve in terms of the communication in terms of the computational complexity you can just use one and just say that this is actually represents four right so there are various optimizations to make this more reasonable but in terms of the rewards you get if you have four times at this space you had four times the reward okay I see so let's let's go into so basically as it's becoming already apparent and there be a lot of blocks generated which kind of does not go together well with them the notion of a standard blockchain and we'll get to that in a bit but let me ask you first so um how does how does the protocol make sure that

I've actually saved the data on my disk for this amount of time so ha if I say I've saved this for two weeks um how does it know I've actually saved it for two weeks and I didn't just put it there yesterday okay that's that's a great question so there are actually two parts this the first part is what we call the proof of space-time which proves that I'm still storing the data so basically a proof of space-time has there are two phases the first phase which we call initialization is this is what we said about working the proofs of work so you fill your disk with proofs of work right this is the first phase this is something you only do once right so even though you there is a proof of work

involved if you keep running the same system for many years you only do the proof of work once and the rest of the time is just storage now the second part of the proof of space-time is what we call the execution phase so every two weeks you're going to get a challenge will speak in a second about how this challenge is computed and but it's supposed to be something you couldn't predict so you don't know in advance what this challenge is going to be and in order to answer this challenge you either have to have the proofs of work on your disk or you have to work again to recreate them but the thing is even though you could do everything with proof of work it's going to be a lot cheaper to store things right so honest users will basically just store

things and prove that they still happen and how do you make sure that I can't generate this data ex ante so how do you make sure that this exit is collapsed right so this is an excellent question this brings us to the second part so how do i I know that I didn't just you know get challenges ahead of time or who generates the challenge right so if I know that this challenge I couldn't have predicted it two weeks ago and you know two weeks have passed and now I have it then it proves that I've you know store this data for two weeks or recreated it but again this is going to cost more than storing it for two weeks so the way we do we generate the challenges we use a proof of sequential work and basically a proof of sequential work is our proxy

for elapsed time so we also call it a proof of elapsed time the reason is that it's you know even though with a lot of hardware you can speed up parallel work if you have to do sequential work then the cost of speeding it up is much much higher and there's some things we just don't know how to speed up that way that well so what you do is you you do enough sequential work that it should take you about two weeks and the idea is that you use the previous proof of space-time as your challenge to this proof of sequential work and then you have to work two weeks and then the output of this sequential work is the challenge to

the execution phase and because it takes me two weeks then I couldn't have predicted it two weeks ago I had to have stored the data for two weeks so there's proof of sequential work takes me two weeks to produce and but it runs at a fairly low intensity or how is it I wanted to say is this also seems to bring us back to proof of work right so why if everybody is running a proof of sequential work everybody's running a proof of work so the nice thing here is that we don't care who generates this proof of sequential work because you're not proving that you did work you're just proving that time elapsed and so it's enough that somebody in the whole network does a proof of sequential work one person can do it for everyone so instead of

having everybody run their own proof of sequential work what we're planning is to have servers on the network provide this as a service for and because it scales right so it costs you you know one CPU for you know two weeks not that big a deal if you know a hundred thousand people are all paying they can pay like less than a cent and you recover your cost so the the more people sort of join this server that the cheaper it is basically this means you don't have to trust the server because the proof is yourself certifying but there don't have to be many servers so we don't think that people will run their own servers though there will be

very few people who run this server they have like a fast computer and your maybe you'll use two of them just in case but but the idea is that you're just going to get this proof of sequential work there will be one proof for or maybe you know a small number of proofs for the entire network okay so I have this proof of sequential work now together with my proof of space-time and that I can submit to to be allowed to mine a block is that correct yes so this you submit in order to create your activation transaction and now once you have an activation transaction we know that you are active right in the next step book

and there are also some there's a nexus thing there you have sort of this public key that you publish as part of this activation transaction and I have part of this public key lets you it's a public key for a vrf a verifiable random function and this together with your the the sort of the epic number and some other details tells use of when in the next epoch you're going to be eligible to create a block I'd like to come back to the this idea that most honest users will store the data on their hard drive rather than do the work now if if the coin itself the

asset becomes incredibly valuable and and so economically if it starts making sense for people to do the work rather than do the you know store the store of the data on their hard drive you know is that possible and is there okay way to fix that there's a good otherwise we just get back to proof of work you're right that's a great question so first of all in you know in terms of CPU versus storage right if it's the cost of the coin doesn't really come into it right because if the storage is cheaper right it's not like I get more coins by doing CPU versus storage right so I always I wanted to have the the lowest

costs to get the same reward all right so the reward is you know every activation transaction gets X reward and now if CPU cost me ten dollars and storage costs me $1 I'd rather use storage and the fact that the coin if the reward goes up ten times I'd still rather use storage I just get more reward but it could be that the cost of CPU goes down right or the cost of storage goes up or like there's so many people are mining spy smash that no there's a shortage of storage in the whole world and everything becomes more expensive it could also be that there's like a competing coin that also uses a similar protocol and that you know you would want to be able to sort of mine

both coins and so one you would do the actual extorting the data on your hard drive and the other you would do the proof of work okay but again this is right the proof of work is more expensive so it's always you know it's going to be cheaper if we build things correctly for to do to your storage rather than work if you want to do two things just get more storage it's still cheaper than doing more work but the way we handle the cases where the storage actually gets more expensive than the CPU remember we're talking about like a two-week period and there's also something that I haven't said so he said there's a two-week period every miner gets a block so what if they're

you know seven million miners suddenly there are so many mines the communication had cost a balloon so once we get I think above around 800,000 miners then either we have to let the communication costs go up or we can increase the epic size right so we can say instead of a two-week epoch we'll have a one month epoch right now we can handle twice as many miners with the same communication costs but now the storage costs twice as much because you need to store something for a month instead of for two weeks and so if before the storage maybe was less expensive storing something for two weeks than doing the work now you know the storage is twice as expensive you're

storing it for twice as long so maybe suddenly it's not less expensive so there's a space/time version of difficulty exactly so in this proof of space-time there is a difficulty what I said is we fill your disk actually with proofs of work so we have a very easy knob to turn we can make these proofs of work just more difficult and this says how hard it is to recreate the table and one nice property that we have so there there are these sort of competing older versions called proofs of space which now they're the difference between proofs of space and proofs of space times like this technical definitional thing which you know if you want to know why I think the proofs of space-time is correct we read

the paper that's on ePrint but in terms of the constructions their constructions actually are also groups of space-time in some sense but they don't have this difficulty adjustment so they have some some other advantages but they have this big disadvantage where if I want to make the initialisation harder so it makes it basically make sure it still is rational to store rather than to use CPU then in their case you have to make the verification hardware you have to store more you have to do something to make it that doesn't work quite well and in our case we can actually just you know go over the proofs of work and make them harder this episode of epicenter is brought to you

by cosmos the Internet of blockchains cosmos is live and we couldn't be more excited to see so many projects already building on it blockchain technologies are evolving fast and development shouldn't be one size fits all that's adapt developer you need the tools that will allow your dad to scale grow and evolve over time the cosmos SDK is a user-friendly modular framework which allows you to customize or adapt to best suits your needs it's powered by tenorman core an advanced implementation of the BFT proof of state protocol cosmos takes care of networking and consensus and allows you to focus on building your application in your language of choice if um smart contracts will be supported soon and the SDK makes it simple for you to connect to other block chains in the cosmos

network if you have an idea for a DAP and would like to learn more about the cosmos SDK or if you'd like to connect your existing adapter cosmos visit cosmos Network slash epicenter for represent our listeners the cosmos team will reach out to answer your questions and help you get started we'd like to thank cosmos for those supportive epicenter another question here with regards to possibly attacking the network and of course this kind of maps on to the idea of 51% attack but I don't know if it makes sense here so maybe enlighten me on this so in terms of in terms of Bitcoin at some point it doesn't make any economic sense to use old hardware so that's why people are constantly upgrading their hardware

because the old hardware is not energy-efficient and the newer hardware also produces more hash hashes but with storage you know it's just storage so someone could literally just buy up you know old hard drives that are being you know discarded from say like institutions or like school systems right like there's like an abundance of old cheap like near-zero costs hard drives out there that one could amass and build like a massive raid with all these hard drives and just keep adding hard drives and hard drives at basically no cost without having to buy new storage space how would one prevent like like a sort of 51% attack there first of

all that's right it's there's not it's not no cost right there are two costs one is the initialization cost actually requires proof of work so adding this space does cost you an initial work which means that it's going to be pretty hard to add you know a huge amount of space very quickly although again it could be doable the second thing is that you know when you say zero costs all drives there actually is a cost I think we did some like back-of-the-envelope calculations and in terms of like actually getting things in production and doing something that works it's not clear that it's actually cheaper to use old drives because they keep failing because there are a lot of operational

costs around using old drives that might not make it again I'm not saying that it doesn't work but it is a big cost it's definitely not zero and the second thing is could it work is somebody with a large enough budget can always attack any of these systems right if you have a large enough CPU budget or just no cash you can buy enough a 6 you can attack Bitcoin right so right now for Bitcoin his budget needs to be enormous because Bitcoin has a lot of budget already and more operational if you're talking about a smaller cryptocurrency right no matter what kind of cryptocurrency it is because you can trade resources money for resources

right if it's proof of stake if it's proof of work if you have a large enough budget you can buy 51% so is it reasonable that you can buy 51% of the you know space time in the system I don't know it depends on how big it is but I'm sure in the beginning it's not so hard right so if we just start mainly I know it's 20 million dollars yeah if you have 20 million dollars you can you know take over the system one of the properties of proof of space-time versus proof of stake is that even if you did capture the system over time as the storage grows right so suppose you captured it now you have twenty million

dollars and you captured you know 90% of the storage but in ten years we'll be you know one trillion dollars if you didn't continue investing and you didn't invest you know five hundred billion dollars in those ten years you no longer have 51% right you've been diluted and there's nothing you can do to prevent that except you know continually buy more resources and write that in that case you know there's nothing we can do if nothing that I know of that any cryptocurrency can do when if you have enough resources to always have 51% then right this is the basic assumption of security for all of these systems okay I have I have one last question about the

security of this proof of space-time before we move on to the mesh just in very practical terms so basically you say I have those two terabytes on my hard drive and I fill them with with your proofs of work and and then basically this proof of elapsed time happens and depending on that I get asked questions of what's in position 1713 and what's in position five and what's in position five million eight hundred thousand right so and basically which positions I'm being asked about depends on this proof of proof of elapsed time or the proof of consecutive work and it has an element of randomness

right and and actually making randomness on a digital system is incredibly hard so how do you go about that problem this randomness is not so hard to generate because here we don't need like true uniform randomness we just need unpredictability and the proof of sequential work basically guarantees us unpredictability because if you could predict what the result of this proof of sequential work was you could solve it faster than two weeks right so just by the fact that it is a proof of sequential work it means that you cannot you know guess the result before two weeks are up and we use this together with hash function so

in our case a shot 256 which in terms of our theoretical analysis we pretend this hash function behaves like a completely random function so obviously it doesn't behave like a random function right it's it has these very structural properties but this is a very common assumption in practical cryptographic protocols and even though in theory like you can build these toy protocols that will work with a random function but it will not work with any actual hash function in practice we don't know how to break any of the protocols that are secure in what we call the random Oracle model when you take the random Oracle and replace it with sha-256 right so so this again you know it's not

a total proof of security because maybe somebody will find some break in shot 256 but if they do that they will break so many other protocols that you know this will be the least of our worries okay thank you that makes that makes complete sense so let's move on to the the mesh so as you alluded to earlier and you actually end up with a lot more blocks than you would on a typical blockchain how is this handed by this Facemash particle yeah so we're aiming for it we divide time into layers so we have a layer say every 5 minutes again the exact parameters might be tweaked but this is like the current starting set and we'll have

something like 200 blocks per layer again this is randomized so there might not be exactly 200 it depends who actually know it's online in Korean maybe some some parties will not be online they won't create a block and there's also this randomization of when within the two-week period you generate block so it could be just randomly that some layers are a little bit larger some a little bit smaller but this is sort of on average this 200 block per layer gives us some very big advantages and there are some disadvantages too so the big advantages are in terms of throughput right now we can handle much higher throughput because I guess this comes from two things one is

that because you're guaranteed that your block will get in you don't have this huge disincentive to make your block larger right in Bitcoin for example if your block gets larger takes longer for the block to be transmitted which means that if somebody else you know solve the proof-of-work at the same time their block will get in first and so if you're in a race then you want your block to be as small as possible and this creates this perverse incentive where you don't want to put transactions in blocks and because you want them to be first in the race and there's also these sort of limitations of the system where if you make the blocks too large it will just take them too long to be transmitted which means it will increase the chance of having multiple people solve the

proof-of-work at the same time or around the same time which means that the security of the system actually breaks so if you if you the time between blocks is too short it's it's very short compared to the time it takes blocks to be transmitted over the network then you're no longer guaranteed that you know the longest chain rule will guarantee consensus okay so basically large blocks and long propagation times that they foster a high ankle rate exactly but if you actually mine many blocks at the same time how do you actually how do you deal with conflicting transactions that will invariably be incorporated into all of these blocks right so so this is where

we come to the disadvantages so there are several disadvantages one of them is it's actually much harder to prove that you can get consensus because now we have to agree about sort of which blocks are the right blocks that the blocks in consensus and which blocks are say say I published the block I pretended it happened you know 200 the layers ago right so like it happened last week or something and maybe even looks valid right because I said I'm guaranteed to generate a block in say layer 10 right and now several weeks have passed I generated

the block I didn't publish it to anyone and now I publish it you know two weeks later so it looks valid in terms of you know it was valid at the time had I published it then it would be okay so now we need to everybody to agree this is not part of our history right because otherwise I could change history so so the main sort of challenges and designing space mesh were exactly getting everybody to agree on exactly which blocks are considered part of the history so those are blocks that we call contextually valid right a block is contextual valid if it's sort of part of the real history the the transactions in this block are actually part of the history and blocks that might be what we call syntactically valid so they're you

know they were generated in some sense correctly but they weren't sent at the right time okay so basically it's the it's the distinction between proof of existence and proof of availability right I'm not sure I understood that actually okay so basically in the theory of space that's also a very common a common problem basically they're two different slightly slightly different problems so one one is I have something and I want to be able to prove later that I had it at that point in time so basically what I can do is I can have a hash and I can post it to the blockchain and then I can I can show you later that because I had the hash of this at this point of tie a point in time this is actually an incredibly strong proof that I actually had yes so that's proof of

existence and basically proof of availability is that not only did I have the thing but I also gave others access to this yes yes so so exactly this is the sort of questions we need to answer and you can think of it like in Bitcoin which is simpler right you have a block that you know solve the proof of work it's syntactically valid but only if it's on the longest chain it's contextually valid right so right by looking at the block itself you can't tell if it's part of history unless you also see which other blocks point to it so we have to do something similar in the mesh but once we let's let's put that aside for a second how we decide whether blocks are let's let's pretend for it exactly for a second that we actually know we have for each block everybody agrees whether it's

valid or not we still have this case where people are publishing blocks at the same time right like you said and they might you know each see different transactions and the transactions might conflict so in in a blockchain we can sort of guarantee that if I'm publishing a block all my transactions will never conflict the trash in my block will never conflict with something in a previous block or within themselves but in a mess you cannot guarantee that and so basically we need to sort of say that we allow conflicts at least of some types right if there's a conflict that happens because two blocks are in the same layer and they couldn't have known about each other that's fine they can both be still contextually valid blocks but we have this sort of state evaluator

that decides what transactions are valid or in the case of smart contracts you know what is the current state of the system after running the the programs that are part of the these transactions it runs over all these transactions if there are two conflicting transactions say the first one will be valid and the second one won't this is I think maybe even easier to see in the in a smart contract type system right so suppose you have a transaction that takes a hundred coins out of an account and another one that takes a hundred coins out of an account and the count only has a hundred coins in it so you can execute both of them right the first one will take a hundred coins out of the account the second one everybody will agree that it didn't manage to take the coins out of the account because the account was

already up so how do you agree on the order of these of these blocks once we agree which blocks are valid then actually agreeing on the order is very easy you just need to have you know a hard-coded mechanism and so when like our initial mechanism is will just sort the blocks by their ID all right so that everybody that sees the block knows it's ID there's the hash of the block and so now we all agree on the order of blocks within a layer and we can then take say the transactions within each block and the the order of the books but you know you this does sometimes like their various like subtle issues there with no

lotteries and things like that where you might not want people to be able to so make sure that their transaction is first and so this mechanism how you decide order we can switch it right we can just as long as everybody agrees on it and you know this will be hard-coded in the system but as part of test net we might you know play around with different mechanisms and once we get to main it there will be no fixed mechanism it could be the the order of the blocks it could be something that's a little bit more randomized no that depends on exactly which transactions are there and you know then we do some random ordering based on that but know this is sort of an easy problem to solve when everybody agrees what's there okay and do you get the block reward regardless of whether

you but your block is actually included in the final block chain or not no so what what is guaranteed is that if you're behaving honestly then your block will always be included right it will always be contextually valid and so you will you will get a block reward for every contextually valid block but the only way that your blocks will not get in is if you're behaving dishonestly so so you know you're guaranteed a block reward so tell me where does this hare and tortoise protocol these consensus protocols that you describe in the paper how did they fit into this and you know

when at which point of using the hare protocol and at which point of using the tortoise protocol yeah so maybe the high level the tortoise protocol basically gives us consensus and irreversibility so basically it makes sure that eventually everybody will agree on which blocks are valid and also that if we agree you know and we have high confidence that you know some block in the past is valid then it will stay that way right history can't be changed and we call the tortoise protocol because it's slow but steady right it will guarantee eventually consensus for everyone it requires very few assumption to work and but it it takes a while so consensus might take many layers and the

hair protocol comes in basically what the tortoise protocol guarantees I'll get into maybe in a minute how it does this but it guarantees it if all the honest parties start out agreeing then very quickly they come to a confident consensus and very quickly means within you know one layer if there's no attacks and on average two layers if if there are attacks so we come to a confident consensus very quickly but only if all the honest parties start out agreeing so why wouldn't they start out agreeing because the adversary might publish blocks that are sort of on the threshold between being on time and not being on

time so honest parties will always you know publish their blocks at the beginning of the layer they know ahead of time exactly which layer is supposed to be the layer which they publish they can create them ahead of time they can publish so it's always easy for them to work right and the layers are far enough apart that you know all the honest parties will receive all the honest blocks for sure from one layer to the next but if I'm trying to make consensus hard then I can generate a block and then I'll publish it just you know half a minute before the end of the layer and now some of the honest parties will get it in some won't and maybe I can sort of fine-tune the exact timing so that like whatever fraction I want so half of the honest parties will think it's valid and

half will think it's wrong it's not you know one third will think it's valid one third will think the two thirds will think it's not so when this occurs then the tortoise will eventually guarantee that we reach consensus but it will take longer so we'll reach consensus quickly on honest blocks but much slower on dishonest blocks and what the hare protocol does is it's basically a protocol that we run off chain so we run it on the gossip network but it's not part of the the sort of final history and it helps the honest parties agree right away about which protocol about which blocks are valid so they're guaranteed that all the honest blocks will be considered valid

and these blocks that are in the middle then they might be valid they might not but they will all agree on them and so now the tortoise protocol will guarantee consensus very so you have instant finality on the clear-cut cases whereas the where's finality on not so clear-cut cases just takes longer yes except it because we want to have programmable system with smart contracts it's not enough to just say you know this transaction is good it actually what it does depends on whether another transaction came in or not before it right so we actually need to have finality on an entire layer in order to say that we can now compute what the current state should be and what the hare protocol does is guarantee very fast finality on the entire layer even

if there are some blocks that are sort of maliciously generated and and they're trying to prevent consensus okay but so that was going to be my next question so basically what kind of transactions - does space mesh allow and you're a said that you're aiming for smart contracts and but does it mean that basically the the reaction time of the network is five minutes or whatever one layers yeah so the latency of the network is not fixed it's probabilistic because it depends on how it's being attacked you know if it's not being attacked which is probably going to be or being attacked like with a you know very small percentage of the resources then the

finality is going to be around five minutes so will be again it depends on the parameters so you know don't take me to five minutes we'll play around with this but yeah I can be pretty confident in the results and I think again we have this thing that's sort of like Bitcoin in the sense that you know there's no final finality right there's just levels of confidence so you know if if you see something with one confirmation then you know what the probability is that an adversary with this much resources can reverse that if you see six then the probability goes down but there's never a zero so we have the same type of guarantee right but it goes down very very quickly and because we have 200 blocks every time and we have the same

type of analysis as Bitcoin right the blocks are sort of voting for the the previous layers then we get it faster than Bitcoin much faster what are the useful applications do you anticipate here or you know are you targeting a specific type of user or a specific type of applications for space mesh no so we actually are a very general purpose infrastructure obviously you know the the initial use was probably going to be payments because this is sort of what the current use of the main use of cryptocurrencies is in general but our infrastructure is planned to support basically anything you know adapts registries you know whatever we can

think of and especially whatever we cannot think of yet but people will come up with okay I mean I think the main use for cryptocurrency at the moment speculation not okay well I mean the main use that people talk about that you know what it can do that right now we don't have good ways of doing without it speculation yeah are you are you incorporating at least at the beginning or at some point are you thinking of having some sort of governance mechanism like Unchained governance or is this so I know in the paper or there's mentioning that this foundation nothing governance is it's it's a great question and it's something that you know we're actively working on we know

that it's something that we should have in place at least an initial version of this when we launch main net but no this is something that we're looking at the options and what people are doing we're talking about it now if people have opinions about this then you know we're very happy to hear it because things are not fixed yet at this point okay and so I realize this is not necessarily so your role but can you talk a little bit about you know the team and you know the funding that you were raised and also you know if there's a business model here you know maybe not at the moment but sometime in the future how do you anticipate to make money as a company okay so in terms of the team so

we're an open source project we have about 20 people working full-time of which I think the the vast majority are developers they're writing code and we also have a research team which consists of the the the research team is basically all people in academia so we're all with several hats and so there's me there's a dopant ah've there's a black shiny who did PhD in new zealand worked on elliptic curves there's Julianne loss who's finishing his ph.d now and boham and there's a pal Malkin who's a professor at Columbia so you know all people in academia and

we're also know this is completely open project we're happy to work with anybody in terms of research like instead I mentioned you know the key stuff in Blom's work were in academia we're not competitors right we're all trying to you know get the best technology out there and we're building on you know whatever we find it's it's the best that we can use in terms of the developers they're an amazing development team I think one of the critical things in terms of actually you know constructing King protocol is having a development team that can can do this and I think it's quite rare to find people who can

understand the theory deeply and or you know amazing coders and you know just as an example they started working I think less than a year ago and we already have working protocol the test net is starting in like I think July so you know this is a very very short time period for this kind of work and it's definitely not a simple protocol so I'm like very impressed by the development team you know I've worked with developers before and they really impressed me in terms of investments so we raised initial seed round I think you don't remember exactly when a year and

something ago and about six months ago we had another fifteen million dollar investment from sort of the top tier blockchain and crypto funds like poly chain metastable slow Ventures collaborative fund and another seven additional you know top tier funds in terms of the business model the idea is that the the vast majority of the coins are going to go to miners but there will be at least in the initial period a small amount of pre-mining less than 10% and tax again a limited time period attacks on the block rewards that will go to sort of compensate development and

investors this pre mining so I suppose you will have some of those coins and you're sort of betting on the future value of the exact coin and these transaction fees or Soria this transaction tax that you mentioned reward tax not it and not on transactions but on the block rewards on the block rewards yeah so once this runs out you know what what do you think is the future of the company I mean the investors that invested you know almost 20 million dollars in company I guess are betting not only on the future value of the token but also on the company itself what what's the plan there so again this is not like my area I'm you know chief

scientist in charge of the technical part the research so I'm not a hundred percent sure as far as I know the the main you know return for the investors is going to be the value of the coin so we're not planning on doing anything you know more complicating also we are ensuring that there isn't like a large block of coins that somebody holds ahead of time that can you be used to manipulate markets and things like that we're sort of dripping the coins off over time so that to help it stay decentralized now just before you wrap up please tell us a bit about the roadmap so I know you mentioned there's a test coming up soon and also where

people can find space mesh where they can read about it and learn more and maybe even get involved yes so actually we're happy for people to get involved our website space mesh IO and you will find links very cool website by the way thank you yes I also liked it since no chief marketing officer is also amazing the the website has links also to the test net so we're going to be launching test net in July the if you want to get involved there then definitely follow the links there various interesting things you can help with if you're you know an amazing coder we're actually hiring people in New York we want to build our current client is built and go we want to build an actual

completely separate implementation in rust so that we'll have you know something that can validate the spec and not rely on you know the the code is the spec in terms of roadmap you know test net is going to run for at least I think six months and may net we hope to get out by the end of the year but you know the whole point of test net is testing and finding bugs finding problems we want the security to be obviously we're writing security proofs for everything we do we want to make sure the protocols are sound but that's not enough to guarantee security so

we're also going to have bounties for finding bugs we're going to run an extensive testing we're going to have code reviews we're like we want to make sure the software is also secure and you know depending on what we find obviously this could cause main net to be delayed but ideally it's going to be by the end of the year we'll start no running active currency great sounds very exciting and yeah it's a it's a it's a fascinating idea for consensus protocol give my regards to a vvl who is also on your team and I know he's a big fan of the show and whom I've met before is huh I will thank you good we look forward to the test net thank you we

release new episodes of epicenter every week click here to subscribe for hundreds of insightful interviews with some of the leading minds in blockchain and crypto you can also listen to the audio version of the podcast on iTunes Spotify stitcher and other podcast apps click here for a full list of places where you can listen thanks for watching at the center and we hope you'll join us for our next episode