Reviewing and reflecting on last year’s Crypto-Economics Security Conference
If you haven’t yet heard, the Cryptoeconomics Security Conference is happening again from October 10–11, 2018 as part of SF Blockchain Week!
Last year, Blockchain at Berkeley began CESC as part of an effort to bring a more academic presence to the space. We were tired of all these business conferences shilling us with poor projects and low-quality presentations. To address this, we envisioned an event that brought the best academic talent in the space together to discuss actual technical content. In this article, we’ll review four presentations that were presented during CESC 17 (there are twenty-six in total; I just chose four at random). If you want to watch the presentations, you can view them here.
Jae Kwon — “Crypto-Economics”
CESC 2017 kicked off with Jae Kwon’s keynote, outlining his vision for how cryptoeconomics can change the world. In this vision, he had two separate messages for computer scientists and economists and a lot of open-ended questions.
For the computer scientists, he stressed the need for good layers/protocols and primitives. At the time (and arguably still) the blockchain space did not have good, working layers and consensus engines. Although scalability, security, and privacy solutions have come a long way since then, there is still a lot of work to be done. Rather than trying to create the entire stack, industry leaders should focus on their own components and allow others to focus on theirs. Those that try to succeed alone will inevitably fail due to the massive task they are taking on. However, if computer scientists embrace modularity and good interfaces, they will win together as a whole.
Meanwhile, for the economists, Jae had even bolder claims: monetarism is dead, fiat currency will be out-competed, and identification politics will be replaced with wallet preferences. Some of this might be pure crypto-idealism. But idealism is what brought about the Bitcoin experiment in the first place. Ultimately, these claims rest on the idea of cryptocurrencies outcompeting traditional financial and societal infrastructure. Although radical transformation of these traditional institutions will likely not take place in the near future, I am hopeful that blockchain technology will play a role in positively impacting these institutions and making the world a better place.
Jae then brought up several open-ended problems which continue to be themes in the blockchain ecosystem:
- Proof of Stake. Many people continue to be skeptical of PoS, despite the progress made. Will PoW advocates ever see PoS as a viable alternative?
- Scalability and Interoperability. There have been many developments in this area but more need to be made. Jae’s company, Tendermint/Cosmos, is one of the main players in this area (and happens to include some B@B alumni).
- Token Proliferation. There is a hard fork/hard spoon overload in the space, driving an increasing number of (often useless) tokens. Of course, we’re now in crypto winter, and some of this has naturally changed due to markets.
- Reputation. There is a huge need for a reputation machine, something that allows you to put primary data on the public chain and have off-chain computation based on your initial seed data of who you trust.
- Resource allocation. PoW consumes a massive amount of energy.
At the end of the presentation, Jae gave us his 2 Cents on creating change.
- Don’t spend much time convincing people who are convinced that you are wrong; go to other folks who are interested in your idea.
- Create encapsulated modules that work together.
- We hold a lot of responsibility. Most of the world is full of pessimists; we’re the only ones who still have hope in the future.
Vlad Zamfir — “Cryptoeconomics in Casper”
In his presentation, Vlad Zamfir discusses the cryptoeconomics of Casper, the new proof of stake consensus mechanism of Ethereum.
He begins by discussing the fundamentals of consensus. In the literature about consensus, there are three primary areas of concern: safety, liveness, and non-triviality. Safety means that nodes decide on the same state (i.e. security). Liveness means that nodes eventually decide on a value. Finally, non-triviality means that there exist initial protocol states that can lead to distinct decision values. Vlad notes that although safety is possible in an asynchronous network, liveness with safety is not.
Both Nakamoto consensus and Casper consensus are safe and live in a partially synchronous network. However, Casper’s consensus differs from Nakamoto consensus in that decisions in Casper are asynchronously safe, while those in Nakamoto consensus are not. This is because Nakamoto consensus models never hinge on probabilistic finality and hidden forks may emerge at any point; meanwhile, Casper’s nodes can have their blocks fork until they decide.
Vlad follows this by discussing incentives in Casper. One of the issues in PoS is the “nothing at stake” problem, in which the validator signs on multiple blocks. This is mitigated by security deposits and the slasher protocol, in which the block reward is removed for any validator caught “being Byzantine” (in this case, validating on competing forks). Another problem that PoS faces is the “long range attack,” in which the attacker forks from genesis block, mines on it, and creates a longer chain. To address this, the authentication model must be changed such that instead of beginning with the genesis block, the validator only trusts messages from nodes who currently have blocks. This means that the validator may have to come online every couple of months to update the list of nodes who currently have deposits. By incorporating the slasher protocol and a different authentication model, Casper is able to avoid both the nothing at stake and long range attack problems.
Casper also makes correctness a coalitional dominant strategy equilibrium; in other words, it makes following the protocol a dominant strategy. It does this through fault attribution, which is the determining of which nodes caused the fault. If they can penalize all observable faults, then then not producing observable faults is the dominant strategy. Stated generally, safety faults are perfectly attributable while liveness faults are imperfectly attributable. Safety faults include invalid protocol messages and equivocation, which is the feeding of different inputs into different versions of the same protocol to produce different outputs and thus a lack of consensus. Meanwhile, liveness faults include omission of received messages, failure to send messages, and message re-ordering. As they are indistinguishable from network latency, they cannot cause safety failure. When faults can be attributed, as Casper is designed to do, it is possible to make the protocol a coalitional dominant strategy equilibrium. This means that the validator does not care what others do, as he is penalized more if he exhibits faults than if he does not. According to Vlad, this is impossible with PoW consensus and was (at the time) impossible with “non-Casper” incentivized work models.
Subsequently, Vlad discusses maximizing the cost of attack. In order to achieve this, there must be a model of participation in the network. This model allows the protocol to parameterize the rewards and penalties that maximize the cost of attack. Assuming only perfectly attributable faults, the protocol can maximise the cost of an attack by slashing all the stake bonded by any nodes displaying faulty behaviour. However, as stated earlier, liveness faults are not perfectly attributable. As such, it’s possible for adversaries to discourage other players from participating and thereby reduce the loss associated with exhibiting faults. While modeling such participation is theoretically possible, in real life, there are significant behavioural effects that complicate such models.
Finally, he talks about removing in-protocol Byzantine fault tolerance thresholds in Casper. Although consensus protocols traditionally have in-protocol thresholds, in Casper, they are extra-protocol, and validator rotation occurs without consensus. Because they are extra-protocol, attackers cannot know the fault tolerance thresholds of the nodes they are attacking, cartelization around fault tolerance numbers is impossible or much more difficult, and every consensus node can marginally contribute to the safety of the network.
Vlad concludes his presentation by reiterating previous points: Casper is designed to be incentivized, achieves coalitional dominant strategy equilibrium, maximizes the cost of attack, removes fault-tolerance thresholds from the consensus protocol, and requires low overhead per block to obtain asynchronously safe consensus. Although more work needs to be done, Casper research has advanced to the point where there are concrete definitions, problem statements, and results.
Rafael Pass — “Thunderella: Blockchains with Optimistic Instant Confirmation”
In his presentation, Professor Rafael Pass details the Thunder consensus algorithm, Thunderella. He and Professor Elaine Shi are now rapidly growing the Thunder team (which also happens to include some B@B alumni).
Thunderella is a hybrid consensus mechanism, combining classical and Nakamoto consensus. To put it simply, classical consensus is fast while Nakamoto consensus is slow. Thunderella uses classical consensus as its “fast path” and Nakamoto consensus at its “slow path”.
In the fast path, the protocol simply holds a round of voting on a transaction proposed by a leader. It assumes that 2/3*n + 1 of the voters are honest and simply waits for 2/3*n + 1 acknowledgements. Assuming the leader is honest, consistency and liveness hold. However, if the leader is not honest, consistency holds but liveness does not. Usually, re-achieving liveness is very complicated. However, in Thunderella, the protocol just moves to the slow-mode, thus avoiding much of the complexities of recovery in classical consensus.
The blockchain underlies this classical consensus mechanism and during the fast-mode, collects evidence of a malicious leader. A simplification of this process is that miners tell the blockchain everything they know. Upon K blocks without notarization, it becomes likely that the leader or committee is cheating and the consensus enters the slow-mode. In the slow-mode, the leader is shut down and a new leader is elected.
Rafael ends his presentation summarizing the two paths that allow for high-speed in normal conditions and security from the blockchain when there is malicious behaviour.
As Zubin writes in his blog post, “what makes [Thunder] unique is that it is the first to feature its level of simplicity and liveness. Thunderella’s fast path functions as an extremely efficient BFT algorithm and uses a Nakamoto-style blockchain for robustness, and in doing so, operates at a high level of performance while maintaining decentralization, trustlessness, and strong safety guarantees.”
Alessandro Chiesa — “Zerocash: Addressing Bitcoin’s privacy problem”
Zerocash, which many readers will know as Zcash, is a protocol aiming to enable decentralized, privacy-preserving, and efficient transactions. In this presentation, Professor Chiesa provides a lower-level understanding of the protocol.
In Bitcoin, every transaction reveals the sender, receiver, and amount. Despite the continued misconception of Bitcoin as anonymous, in reality, Bitcoin is pseudonymous. In the Bitcoin protocol, public keys can be linked to identities, thus resulting in the lack of privacy. When payment history is transparent as such, it could reveal certain things about you that you would prefer to remain private, i.e. medical information, location, and merchant cash flow. The lack of privacy also results in the loss of fungibility, as certain coins are viewed as unusable due to their association with illegal activity.
While Bitcoin makes a compromise on privacy for the sake of accountability, Zerocash is a means of retaining the same accountability while maintaining privacy through the use of zk-SNARKs. Zk-Snark stands for zero-knowledge succinct non-interactive argument of knowledge. Translated into layman’s terms, this is a proof of knowledge that requires no information beyond the truth of the statement. In the zerocash protocol, the sender, receiver, and amount information are encrypted, and instead, a proof is sent to the blockchain. In his lecture, Professor Chiesa runs through the pros and cons of multiple iterations of blockchains, beginning with an insecure system and ending with a basic version of zerocash. Although I’ll let you watch the lecture to see them yourself (it’s quite complicated), the final version results in a protocol in which double spending is impossible; others cannot spend your coins; the mint and spend are unlinkable; there is variable denomination; and the sender, receiver, and amount are hidden.
Zk-snark (and now zk-stark) technology is an important innovation for increasing privacy in cryptocurrencies and blockchain technology. Although mathematically complicated, Chiesa notes that at both a high and low-level, zk-snarks are fairly intuitive. He concludes by noting that such privacy technology prompts the interesting question: which policies are desirable and feasible to balance privacy and fungibility with oversight and accountability? While technological advancements are important, especially within the realm of privacy, they put forward even greater questions of ethics and social responsibility.
Looking Forward to CESC 2018
CESC 2017 had much more content than just these four lectures, which you can watch right here. As Blockchain at Berkeley, we are proud to have brought together some of the leading experts in the new academic field of cryptoeconomics for this great conference. But more than this, CESC is close to our hearts, because it marked our transition from ordinary college student society to something bigger — a organisation that actually builds community and creates an impact in the space.
We’re extremely excited to see a new iteration of CESC bringing together some of the great technical minds in the space. In the next articles, which will be published by SF Blockchain Week, I’ll be summarizing literature written by speakers from CESC 2018 in preparation for their upcoming presentations. Stay tuned for next time’s article!
Thanks to Nick Zoghb, Jeremiah Andrews, and Alan Lai for their help with the article!
Looking Back at CESC 2017. Looking Forward to CESC 2018. was originally published in Blockchain at Berkeley on Medium, where people are continuing the conversation by highlighting and responding to this story.
From: Blockchain at Berkeley – Medium
Source Description:
