much more work to be done way beyond
what I can do and I want you to sort of
get you excited about what one could do
in this space and what there is to come
in the research pipeline up ahead for us
so let me do this beat a bit at a time
and what I why is this not starting hang
on Oh
so are we now projecting yes perfect so
where are we now
so starting out as we are so block
chains have become a one of these words
that requires no article we don't talk
about a block chain we don't talk about
the block chain we talk about block
chain if you walk around in downtown
Manhattan and you see two suits
discussing FinTech like the stuff in
tech stuff one of them will turn to the
other and say what's your strategy for
blockchain the only other word I know
that doesn't require an article like
this is God so crypto cryptocurrencies
have become a new asset class people
have coined the term crypto assets and
the sum total value of such assets is
more than 100 billion dollars the
theorem itself has emerged as a platform
for new projects so there's a lot of
money going into startups at at least
one point four billion the last time I
tallied this which was over a year ago
that was traditional VC money and a lot
of the sort of the on-ramps into new
projects has turned into IC OS and I cos
are projected to raise more than a few
billion dollars of value in the current
year
so with the theorem itself there's a
strong foundation the EVM works very
well there has never been any down time
since its launch solidity is a language
that we all have a bunch of wishes from
and it's evolving and it has been very
successful in getting people to think
about writing smart contracts and of
course there's a rich DAP system if you
go around walking in the alleys here in
the
always you'll hear everybody talking to
everybody else about what their favorite
applications are a new new projects are
and what what happened over there okay
how is that okay okay so so we have
multiple implementations of of the
etherium code or the etherion virtual
machine there is a and most importantly
I think this was the main point that I'm
super proud of that that makes me really
excited when I'm here is that there's a
supportive constructive science driven
community this is worth its weight in
any currency plus any other tangible
asset you might imagine that is though
is the actual value proposition of this
particular system so so let's see what
is the significance of all this what
does this mean so there are three things
that really get me excited the first one
is that we're witnessing the emergence
of a new class of systems these are
systems with high integrity that can
execute programs and give you strong
assures that they will execute according
to how you devise them they achieve
their trust worth trustworthiness
through an audit ability and
transparency based on this foundation we
are seeing the emergence of a new class
of financial instruments up until a few
years ago the most exciting instrument I
could ever get my hands on and believe
me I tried in upstate New York it was
very very hard
they made me talk to when I tried to buy
bonds Russian bonds they made me talk to
a very funny gentleman at my local bank
who told me that I was essentially
trying to buy junk bonds and it was
going to be very difficult and so forth
but the most exciting financial
instrument that I could possibly write
that I could get my hands on was the
debt was a cheque and if I was fancy I
could write a post-dated cheque and that
was it and now anybody in this room can
write all sorts of really fancy really
exciting instruments and that of course
means that we can it's now there's a
revolution and it's in the hands of
everyone and finally and this is
probably the sort of the most out there
claim there
new form of social organization of foot
so if I look back at the sort of the
history of humanity going back thousands
of years there are some highlights and
how people organize themselves so one of
them is perhaps the written laws prior
to written laws you you lived and died
at the behest of a ruler afterwards then
it's actually you've got some rules and
you have some predictability in how your
life is going to be managed then we have
to again another highlight is the
emergence of the corporation now that we
have corporations we don't have personal
responsibility for everything we do the
corporation is a virtual entity and with
smart contracts we now have the ability
to have contractual contractual programs
that manage assets that that can
transfer value so so now that's all nice
and fine and good but where do we end up
with challenges ahead so what what do we
all what we still have to deal with I
believe there are three fundamental
challenges in front of us the first one
as you all know is scale your cousin's
in Bitcoin land in fact many of you are
also good going holders I assume are
dealing with this day-in day-out and I
want to tell you a little bit about this
particular dilemma so that you're all
well versed in in the best known on
chain and off chain scaling solutions
okay so the Bitcoin folks they they have
an information dissemination problem and
they won't really tell you exactly the
full story and it comes with a funny
slant depending on which forum you're in
so I want to tell you what we know from
from academics second thing I want to
talk to you about and this is where I
get kind of blue blue yonder type and
talk about things that one could do
without a necessarily your solution its
correctness how do we ensure that smart
contracts do what they claim to do how
do we reason about them and finally I
want to talk to you about privacy and I
want to tell you a little bit about the
work that's going on at IC 3 on how to
marry to things that most people
consider to be incompatible private data
with public lock chains so let's start
with the scale issue and so everybody I
assume knows the operation of a typical
block
you have the notion of a over some kind
of a block let's say the Genesis block
on the left hand side you have
transactions that are issued you have
minors that collate these transactions
into into blocks then they solve some
kind of a proof-of-work puzzle and that
allows the system to attach the last
block to the previous one and once they
do that they announce their block and
the the miners start building the next
block and the next block and so forth
this is of course we have to incentivize
people to do this and to do that we give
them some kind of a block reward for
discovering these blocks this operation
makes it infeasible to modify the past
as the attacker as long as the attacker
does not have control of the majority
hash power so if we have blocks like
this and the blockchain is getting
extended in some some you know in some
reasonable form and you decide to break
from the majority you decide hey I'm
going to pretend that I did not make
that payment to that online merchant
well you can do that but but without the
majority hash power you will find
yourself falling behind and unable to
keep up and your portion of or your
version of the financial history of the
world will be pruned and you'll be cut
off so this is fine and dandy and at the
core of this operation this is the magic
that Nakamoto consensus gave us at the
core of this operation is this frenetic
activity any time a block is found so
every time somebody finds a block they
have to very quickly disseminate it so
as to get other people to adopt their
version of the reality and that's a
difficult thing to do writing protocols
where everybody gets access to the same
thing at about the same time without
giving some kind of an advantage to the
bigger miners is difficult and that of
course has led to the Bitcoin community
rift so there has been a civil war in
the Bitcoin world over the size of this
block size if you make it too big then
you have this problem that that big
miners have an advantage in fact that
small
we'll want to collate their resources
and combine to create a bigger mining
pool if you make it too small then you
limit your throughput and exactly where
to put that that knob where to adjust it
has been the subject of much debate as
you might might have heard from the
Bitcoin folks in in the theorems case
the blocks come every 14 seconds the
throughput comes out - realistically it
comes out to 7 transactions per second
if all of the transactions were just
value transfers simple transactions it
might be up to about 25 transactions per
second just so you can visualize what
that means
I believe the Bay Bridge in San
Francisco is about about five to seven
transactions a second on a busy busy
evening so that's about the rate we're
talking about like a an Ikea on a
Saturday might be a few transactions per
second and so it's a very hard
foundation it's a very limiting
foundation to build a worldwide global
transaction system on so and simply
simply increasing the block size is not
a long-term option so you could up it a
little bit in fact you could up it
certainly could up the Bitcoin block
size because they're in a very very low
range but you couldn't help it
indefinitely if the blocks were really
big then there would not be enough time
to build on one before the next one
arrives so what have we done
academics have looked at this for this
this issue and what you typically have
in bad communities is you have what we
call designed by gut a designer ideally
with a big beard holds his gut and says
well I feel like this particular block
size is the best one and that's that's
okay it depends on the sort of the
people swaying power of the beard in
some sense but but really that's no way
to build systems ok the science driven
way to build this is you come up with
metrics you decide what your Minimum
Viable platform is you then show that
the metrics you have chosen the
particular parameters you've chosen are
ideal for what you want to achieve and
to help with this process at IC 3 we
came up with some metrics for
characterizing nakamoto consensus
protocols these are things like mining
power utilization obviously you want all
of the power spent on mining
go into your blockchain and if that's
not happening there is something wrong
oh you want the mining process to be
fair even too small miners you want the
consensus delay to be low and we also
came up with two very interesting
metrics that I don't have time to go
into time to win and time to prune that
talk about the latency of the process of
the consensus process from the point of
view of a miner and to aid this we also
built a bunch of effort apparatus a
proton or whatever the word is for for
experimenting with with consensus
protocols one thing we built which is an
interesting artifact is miniature world
a replica of the cryptocurrency world
one for one in the basement of our
computer science department so for every
Bitcoin node out there we have a replica
of it in the department and work is on
their way that allows us that will allow
us to have a replica of every etherium
node as well these systems are not that
big that they could not be replicated
especially given the fact that we don't
have to do the mining when we do
simulations we also build relay
backbones for for Bitcoin to be able to
be able to collect data from inside the
network and we operate one of the two
backbones for Bitcoin and so there are
some interesting findings that I can
share with you one of them is the
etherium system actually the the current
protocol incurs many uncles who you end
up we end up actually wasting some
effort in Uncle blocks and it would be
nice to reduce that number also we found
that the network the network would
greatly benefit from a relay network the
ecosystem the etherium mining ecosystem
as it is is more centralized than
Bitcoin that's an interesting finding
and there are fewer number of actors
that control more of the hash power it
changes from from week to week month to
month but overall it's fewer and and
it's an interesting interesting outcome
but the real issue here is okay so this
is all fine and good these are just
findings from the current network how
would one make this better and the funny
thing of course here is the theorem is
going to switch to a proof of stake so
what I'm about to tell you might not
necessarily apply but I want people in
this community to know what the best
state of the art is okay so the state of
best state
the art is not let's tweak a parameter
you can only go so far with tweaking
parameters so I want to talk to you a
little bit about Bitcoin and G which is
a protocol for unchanged scaling and as
far as I know I'll also refer to its
cousin Bitcoin at the end as far as I
know this family is the best on chain
scaling protocol so so essentially this
starts with a very simple observation
the typical mining process as we know it
has blocks that serve two purposes one
is that the block acts as a leader
election mechanism and to the leader dun
says in the proceeding block interval
the following things happen so it's a
retrospective protocol you elect me by
chance and I say okay guys well this is
what happened in the last week so that's
fine except if we were to break these
two functions apart we can then end up
with much better protocols with much
stronger guarantees so the way we
propose to break this up is in turkey
blocks and micro blocks a key block is
the leader election portion of of a
block and essentially every now and then
what we do is we elect a leader and from
that point on that leader vets
transactions as they come in not
retrospectively not retroactive Lee over
the last block and interval but as they
happen on the fly and of course the key
block is related to the micro blocks by
a signature the signature in the the key
and the key block signs the the the
transactions and the micro blocks so the
thing to notice is of course that key
blocks are very small and rare and micro
blocks are small and frequent so and of
course the commonality is they're small
and the smaller they are the better it
is what we're going to do is we're going
to take the process of that frenetic
block generation and we'll smear it
across time we won't do it all at once
and go crazy and try to scramble we'll
do it slowly so the way this is going to
work is that when it's time to mine
something instead of mining a giant
block with everything that's happened in
the preceding block interval we simply
mine a simple block that says hey this
is my key and that elects the blue
leader as the leader from that point on
he can
transactions so whereas he would
normally normally be minting a giant
block with transactions in it now he
starts minting them one at a time
linked of course in blockchain formation
but without a proof-of-work
so his proof of work arrives first and
then the rest of the block the rest of
the block contents appear one at a time
so this process will lead us with a to a
chain and at some point it'll be
somebody else's story somebody else will
discover a a key block in this case the
yellow leader and the yellow leader will
then start issuing his own blocks his
own micro blocks so the critical part of
course is that I'm glossing over in this
talk is getting the incentive structure
just right you want the yellow guy to
attach and extend the longest chain and
you don't want the blue guy withholding
any data you want him to be to be
cooperative so if you set it up as a set
of constraints the math ISM it gets a
tiny bit more complicated but you can
come up with the actual actual incentive
structure that will get everybody to
behave cooperatively and and so in this
graph we're showing what happens to
Bitcoin and Bitcoin and G so aetherium
would actually have the same kind of a
graph so on the x axis is block size as
you go right it gets bigger on the y
axis is fairness to smaller miners and
as you can see as you make the blocks
bigger and bigger and bigger
Bitcoin starts starts deteriorating now
these block size have been scaled down
and the actual Bitcoin block size debate
is being waged in that zone over there
actually where it just is
indistinguishable well it doesn't matter
if they were to try to push their block
size beyond the particular threshold
they will find that the protocol
actually deteriorates and in contrast
Bitcoin energy does not do that and now
it's not surprising because of the way
it's structured so where does this get
take us well it takes us to this to this
location where we can achieve about 300
transactions per second about and one to
two orders of magnitude increase in
throughput and that happens without a
change to the trust
so it's the same same process as before
and that follow-on work called miss
Cohen generalizes this idea to a
coalition of leaders so is this good
I think it's okay it's 300 transactions
per second is not quite Google scale
it's not quite Lisa scale we'd like to
do much much much better and and I want
to tell you a little bit about how to do
better using help of special hardware so
you've probably heard of Ryden you've
probably heard of the Lightning Network
all of these systems are protocols to
take the load off of the the blockchain
into two pairs two parties that
communicate in private and then settle
back on the main chain and these
protocols are software only protocols
and as such they are subject to one big
problem if I'm a participant in any of
these networks and any of these
protocols I have access to all the
states right so I start out a
transaction with you and at the
beginning of time I have $100 you have
$100 I buy something from you now you
have hundred and eighty I have twenty I
could try to settle using the old state
as opposed to the current one 8020 state
and that's a problem so this requires an
D for your software this requires you to
constantly monitor the chain so that I
don't try to settle early and that
changes the ecosystem you suddenly start
either connected to the network and
watching it like a hawk or paying
someone to do that for you and who is
that someone
it begins to look more and more like a
bank which was the exact same thing that
I should try to get us out of this that
was one of the main reasons that I
actually got excited about these kinds
of systems the system is vulnerable to
transaction mail the ability and the
performance of these software
transactions the software option
transaction systems is limited so you
and I have to sign and re-sign and
re-sign news new transactions for every
payment so let me tell you a little bit
about an interesting development that's
happening that many people are not aware
of inside every shipping Intel chip
today is what we call a trusted
execution environment this is something
far better than the treasurer something
far better than
now tell me why there are two reasons
why it's better on both dimensions and
it's not just Intel it's also arm has
something called trust zones and AMD has
a similar functionality so these this T
this trusted execution environment
provides the notion of high integrity
secure execution so you can get some
code to execute inside the cheap chip
unmolested if a Russian hacker comes
into your system and changes your
program what will then happen is that
the encryption keys that this program
runs under is not accessible even to
that new modified program so it won't be
able to read its own data it won't be
able to touch what it touched before so
this is is one way of guaranteeing that
the code will only execute and only take
those steps that you programmed it to do
and the second feature that these
environments give you is remote
attestation not only is the chip
executing code with high integrity but
it's able to tell someone else
hey inside my Enclave inside my secure
inner sanctum I'm going to execute some
code with the following hash and if you
know what that code is then you know all
my future behaviors and of course you
have to trust that the the that Intel a
company with 56 billion dollars at stake
actually got the key implementation
correct so so let me tell you what one
can do we developed a protocol for for
value transfers called T Chen very very
quickly the way this works is as follows
Alice and Bob on the left and right have
in their enclaves inside their T's two
keys Alice has the green key that
commands her green contract and Bob has
the the orange key that commands his
contract in the initial establishment
phase Alice and Bob securely swap keys
with each other after verifying that
that both of them are operating on top
of T's so this seems like an anathema
it's like I just gave my key to someone
else but I can do so securely knowing
that she can't get my key out she can
only do those
that I authorized her to do the next
thing that the protocol does is make a
copy of the contract state into the t's
so now my contract and yours are locked
inside my t and your T and on on chain
on the actual chain we freeze the two
contracts so now they can't just more
get modified underneath us from this
point on I can actually life goes on I
don't have to monitor the chain at all
we could be in the middle of the Sahara
just the two of us and I can go back and
forth with you and and authorize changes
so in this case I made a transaction
from the green contract to the purple
one and and the only thing I need to do
is get you a message that says hey this
this transaction happened and that
changes your state as well and we can do
this all day back and forth back and
forth constantly updating our state
without having to hit the actual chain
and at some point we decide to settle at
which point one of us updates the chain
with the modified modified State and
this is going to be a two out of two
multi-sig so that ensures that indeed
this is an authorized new state that got
updated in private so this is a pretty
nice way of actually doing things off
chain and we then extended this work to
something called T chain T chain is a
generalized form of teach and accept
it's actually multi-hop so in this case
Alice and Bob are not directly
communicating with each other they might
have other parties in line shown here
with different colors and the payments
go across multiple parties and they're
guaranteed to be atomic that is a
transaction will not get stuck in the
middle of let's say of the country so I
want to pay from New York to San
Francisco my money will not be stuck in
some contract in Ohio
it's either happens or it doesn't happen
it's atomic so we implemented this fully
we actually got the keys from Intel to
sign it we have an actual you know
actual implementation that operates
directly on hardware counter to what you
know the Bitcoin trolls make noise
and we deployed it across the Atlantic
so the types of numbers that we are
seeing with this this setup is in excess
of a hundred thousand transactions per
second per channel so if you think about
that for a second that's actually a lot
of zeros that takes us into a different
domain and you can have as many channels
as you like of course then all sorts of
other issues begin to you might have to
worry about it if you are actually if
you're a bit Phenix or if you're if
you're in exchange you're going to have
to worry about actually terminating
these these channels on your end but but
the bottom line is this gives you an
enormous ability to leverage the power
of off chain transactions the latencies
are simply network latencies in this
case and we're currently working to port
it to chain to etherium to support
etherium transactions and protocols
contracts natively on top of T change
our implementation is is with Bitcoin
let me switch gears so this is as far as
I know from my perspective the best of
on chain and off chain scaling that's
Rita that has been realized to date
let's talk a little bit about
correctness as I'm sure this is a
critical issue for everybody here who
has ever written any line of code for
aetherium so what do we want to do we
want to be able to verify that smart
contracts what do what you think they
should do and this is typically done
with the aid of a specification we write
in some other language typically a very
mathematical language what this contract
ought to implement and then we use lots
of techniques from a very rich field
called program verification my
colleagues who work on it have been
spending decades on this is ever since
the 60s people have been paying
attention to how do we write bug-free
code it's very very difficult this
typically falls far short of target
software verification has focused on two
issues safety and liveness and I'm here
to tell you that there is much more to
this domain than safety aliveness and
I'd like to sensitize you to what action
needs to happen to the research that
needs to come so
yeah okay so let me let me expand on
this so um so so far the research has
focused on safety and - and and so I
think okay so what is safety safety
means that there is no path in a program
where a bad thing happens because I have
a predicate in mind things like I lose
so the number of tokens coming in is not
equal to the amount of money going out
that's a bad thing that's what happened
with the Dow right so that shouldn't
happen and if it were to happen I want I
just want the guarantee that that can
never happen in my code that is a safety
criteria and we understand quite well
actually the program verification
techniques required to check that kind
of criteria liveness means that always
eventually something good happens okay
so that's a precise statement so in
every path there is eventually a good
thing that you want to have happen the
user is able to withdraw her funds that
should be all possible at all times
so so this is a this is what this field
has really been focused on why because
they've been worried about things like
nuclear power reactors being correct and
their safety matters a lot
they're liveness matters a lot but what
they haven't paid attention to are game
theoretic properties which matters to
you and you need to learn to demand this
from the researchers so what's what's
the yeah okay so safety criteria are
things like sum total of tokens is less
than and token balances are conserved
the lightness criteria are things like
the smart contract does not get stuck in
academic parlance these are all
properties you can reason about them by
reasoning about the execution trail the
execution trace of a single smart
contract of a single trace so I have
some code it follows some path and on
that path nothing bad should happen and
we know how to check these things or it
follows some traces at the end of that
trace there is something good happening
again really we have techniques
lightness issues are not as well covered
as safety issues but we have some
techniques for them what we have nothing
for and what I'm here to sort of try to
get people excited about our game
theoretic properties what do they look
like
well these sound a little bit more
nebulous these are properties like this
contract is fair to all participants
okay so this contract is truthful it
elicits a truthful response the way you
actually you know bid for a truthful bid
when you are trying to buy an e NS name
this contract is incentive compatible
given these incentives you will do the
things that they want you to do or
things like late voters are not
disadvantaged in as was the case in the
Dow or this contract is regret free if
you have the following goals in mind no
matter what you do as long as you
rationally follow these these steps you
will end up at a good place where you'll
be happy or most important of all
contract maximizes social utility and
that that word typically doesn't mean
much for people but it really means
contract maximizes social outcomes it
makes the most number of people the most
happy if you were so these are really
interesting and we don't have techniques
for actually dealing with them and to be
able to even get at these problems I
think the very first step is to couple a
smart contract with with models of
utility and the reason about the
contract and the actors in that context
so this requires a set of new techniques
that I'm really happy that to announce
that myself re Jules and Andrew Myers at
Cornell just got a grant to actually
explore but but they're not well known
and not well appreciated so the reason
why these techniques are difficult is
because we're not reasoning about a
single trace of a program to actually
reason about these things these are meta
properties they are not related to a
simple prop they're related or surprised
they're not related to a single trace
we regret for example explores what
happens on
all paths so I'm on one particular path
do art doing art are there other paths
where if I were to have followed them I
would have been better off so that
explores a combinatorially more
exploration of paths and I'm very good
more much more complicated analysis so
we've begun to study this topic at IC 3
but much more work is needed but I
wanted to bring this up in the sense of
an economic trying to look at this this
this situation and trying to make sense
of what needs to still come so just in
case don't forget that we actually do
need regular good old program
verification ok so that still applies we
do need safety criteria we do need
lifeless criteria checked for our
solidity code we still need additional
mechanisms for solidity the language is
not enough we need the runtimes for
smart contracts to that and there exist
entities like virtual notary Town Crier
Oracle Oracle eyes or GERD and many
others that can import real world facts
into block chains and they're very much
needed
we still need escape hatches in fact we
need crowd-sourced escape hatches as we
proposed shortly in the aftermath of the
Dow where you can say things like well I
want a non-gay noble a way to stop the
stop to press the red button when
something terrible has happened how do
we build those things I don't want to
privilege the developers and yet I want
to be able to stop things when when bad
things happen and right and in fact many
of the problems we found with the dow of
which the dow hacker used one plus he
used another one many of them were game
theoretic bugs even if the dow had not
been hacked by that hacker it would have
been hacked by many other hackers in
this room okay I'm definitely certain of
that so so we need mechanisms to to keep
that from happening
so in the last few minutes I want to
talk to you about another topic privacy
and tell you a little bit about some
ongoing work so as you all know private
data and public blockchains
don't mix it's very very difficult to
put private information into block
chains because all
contract state is public I cannot the
contracts cannot hold or or exercise
secret keys I cannot put API keys inside
my contract I would love to be able to
have my contract interact with Google
services or interact with with exchanges
but I can't put those private keys
inside the contract that'd be madness it
would be revealed to anybody who dee
compiles my code so but and there's much
of much other private data that we'd
like to store them so what can we do
well we've been working on something
called cry baby it's a it used to be
called credible but we thought it was
just too hard to type so it's called
credi be for a credible database it's a
new database implemented on secure
hardware it's not on a chain but on the
network imagine the database that's
connected to the network connected to
the etherium block chain that gets its
commands and api from the blockchain
itself so it's tightly coupled to the
blockchain but keeps its data private
off chain it's an eidetic database that
is it remembers everything that ever
happened and you can query for past
states and as I said it's blockchain
driven everything that happens to it is
stored on a blockchain it is just like
before just like the teach antichain
implementations relying on some secure
hardware that advertises its presence on
the blockchain its attests to the fact
that it's running on a tee and it holds
some private data and once it's
announced this public key on the
blockchain it is now accessible by all
now you can send messages to it
encrypting those messages for that
destination so that only this code can
decode what it is that you want to read
you want to read some genetic data out
of a very private DNA database you can
actually do that only that guy will know
and he will access he will be able to
access this but I'm getting ahead of
myself
so the invocation you performed by
invoking methods on this item that are
encrypted that you put them as blobs on
to this blockchain send them into the
tea and the
he will compute on your behalf you use
the blockchain as a random view
mechanism and this entity is essentially
a nameless entity it's on the network
but you don't know where it is and
you're not tightly bound to it you
invoke them solely by key this would be
a great way to build decentralized
exchanges for example and and so when
this thing has computed the result it
can make the result known back on the
blockchain and optionally encrypted with
the key that you provide so that only
you can read it it's a very
self-contained very simple
straightforward application of t's and
block shapes and what's more is you
don't have to have just one of these you
can have as many of them as you like and
they would then form some kind of a an
overlay network on top so okay so you
can have as many many such databases and
contracts okay so where does that take
us well you all have built an amazing
planetary scale decentralized computer
that executes in tandem with high
integrity it's sound it's secure and
it's got lots of exciting new
applications there are lots of exciting
challenges ahead and I hope I manage to
point out some some that you knew about
and maybe a few directions that maybe
you have not thought about and most
importantly as I mentioned in the
beginning with a science driven
constructive community I look forward to
tackling all of them one by one
thank you
if there are questions like
[Music]