hi everyone it's a real honor to be here
and a real honor to have that
introduction for metallic thanks B so
this first Hall actually is going to be
on there we go um on the problem space
rather than the solution space this yeah
so I'm not going to talk about Casper
directly I'm just going to talk about
you know what is this problem that we're
trying to solve with wat scenes and with
these senses protocols and then in after
lunch I'm going to give a talk on Casper
so firstly let's start off a little bit
of background so what's a consensus
protocol just I'm going to not be too
formal just like pragmatically cuz it's
protocol it's something that computers
use to agree on the state of some
application that basically the important
thing is that since protocols are useful
for making really reliable systems out
of unreliable or even untrusted
components and so some nodes go offline
some knows they badly clients can still
have access to the application here's
like a nice you are the only drawing in
my top this kind of shows you this idea
that like there's like some nodes who
keep that some state as a result of like
applying some changes which are kept in
like some log and then there are clients
who kind of are able to interface with
this state and if one of these nodes are
go offline or behave badly the clients
wouldn't be deceptive so usually in
traditional cos protocols we have like a
network administrator and we try to
guarantee that the application is
available distance so long as not so
many knows who I fine
or as long as the network isn't
partitioned so let's go through these
little these concepts consistency means
that traditionally means that every node
has the same like an identical copy of
the state and availability means that
clients are actually able to interface
with it and cause changes to it and then
this is famous result one of the most
important results in consensus
literature is called the cap theorem
which that if there's a partition then
because the protocol has to choose
between being available or being
consistent and you kind of imagine why
that is because if there's a partition a
client and the client is able to effect
changes then different clients could
affect changes on either side of the
partition and we would lose consistency
because the application state would be
different on either side the partition
or we could not allow them to make
changes and remain and have the same
application state or neither side of the
partition and then the other concept
that brought up as a idea false we
usually like break down falls into kind
of crash faults and Byzantine phones
crash cross our windows go offline and
they may come back or they may not ever
so Consuela basically means that they
don't come back online crash or cover
faults eventually they don't resync &
byzantine faults are kind of just I know
that isn't offline but it behaves badly
generally we byzantine faults are kind
of defined to behave in an arbitrary
wing which can mean basically that which
you can think of us like they're running
the wrong code naive the one that the
network administrator didn't tell them
to run or that they somehow can be
observed to behave wrong behaving
correctly do to it like you know perhaps
not because the code they're running
late because another other
other things so basically usually with
what we talked about like the security
of consensus protocols in traditional
literature we think about you know how
can we keep this protocol guarantee
given some number of faulty nodes and we
basically say that it's secure up to
some given the number of faults and like
consistency availability or some
examples of properties that we want
that's protocol to have and I'm also
going to mention sensitive resistance
because that's you know especially
relevant in our in our context and one
more thing before we go on to public
consensus is the idea of eventual
consistency which is kind of a weakening
of the idea of consistency or instead of
requiring that every node has exactly
the same copy of state you require that
eventually with very high probability
they do have exactly but the same the
same state so bitcoin is eventually
consistent in that you don't really have
a strong guarantee that everyone has the
same populace safe now but you have a
really strong guarantee that they have
the same state you know four five six
blocks ago so public consensus is
basically consensus protocol without
network administrator's we're basically
anyone can go and become one of those
knows who is part of the consensus
process and who can handle client
requests and cause changes to the
consensus date basically because there's
no network administrator membership has
to be governed by something actually
inside the consensus itself basically it
we call it a mechanism kind of hardening
to like game theory it's like basically
like a game whose rules to find whether
or known is able to participate in
affecting the state of the consensus so
there's like a really big problem to
this kind of mechanism which is
basically that an adversary could try
game this mechanism to overwhelm the
network and to have mall or very large
majority of the nodes in the network and
that's like the first challenge the
public consensus
basically how do you prevent without
being without there being a network
administrator an adversary from bringing
off the water notes online and this is
kind of real the real important
innovations of bitcoins that they
figured out that you can have an
economic mechanism in the consensus
which made it expensive for civil to
bring on a lot of nodes into behave
badly so basically economic assets
protocols try to make it prohibitively
expensive for civil to conduct their
their attack and currently economic
consensus is the only known solution to
public consensus problems it's the only
way that we know to defending its
ability acts without having a concept of
trusted network administrators so it's
in bold because it's important
so just to take bitcoins and as an
example what we what bitcoin does is it
makes it computationally expensive to
produce changes to the network and so
for civil to propose a change they have
to incur this expense and for civil to
take a majority of the network they have
to incur a majority of the expense and
so this is like the simple way that
bitcoin uses economics in order to make
civil attacks difficult and inconvenient
and incidentally this is why block
chains are trusted because it's
expensive and inconvenient to views the
trust that the block chain is provided
so economic consensus basically has like
it has to have certain properties and
we're going to so I'm going to start to
give you an idea of how we reason about
these things so nodes have expenses in
revenues knows can't operate at a loss
forever nodes can change their software
for profit an adversary can has to be
defined not just that it's like a number
of knows but someone who has a certain
attack budget and nodes nodes can have
the profit their profitability affected
by an attacker so we come need to use
economic analysis rather than fault
tolerance analysis tell Annalise public
consensus protocols it's bold because
it's important I'll say this again and
again so because knows have expenses and
they can't operate a loss forever it's
not sufficient to just say whether or
note is correct or not because even a
correct mode can't stay around forever
if its operating at a loss so the idea
of using fault tolerance analysis where
in an adversary control some of the
nodes and all the rest of no they're
correct doesn't work because you need to
pay attention to whether or not those
other nodes are operating over loss or
not because if they're operating a loss
in there that pool of nodes
from so we need to use economic analysis
rather than fault tolerance analysis to
to analyze these networks so we kind of
owe it to do economic analysis the kind
of nice tractor way to do it is to use
kind of game theory and economics as
like you know the school of thought that
involves like rational action which
which is to say that knows will change
the behavior just to increase their
profitability now the true state of the
reality is that knows that behave in a
way that is more rational will end up
having higher turns and who knows a way
that's less rational ended up having
bigger losses and so over time the
profit of the rational it will dominate
but we can reason about it by thinking
about nodes changing their strategies to
increase the profitability and basically
so they'll it respond to all the
incentives they have including the ones
that find in the protocol and the ones
due to an adversaries the expenditure of
an adversary's budget so it's not and it
also not sufficient to regard rational
notice Byzantine because we can say a
lot more than just that they're behaving
badly we can say in a very particular
behaving badly in a very particular way
so in the worst case in the worst case
economic economic analysis all or maybe
almost film that was irrational and
coordination costs are zero which is to
say that you know an adversary doesn't
have to deal with a complicated process
to contact nodes and two bribed them
they can they can and nodes don't need
to incur costs in order to act together
to increase their profitability they
could all just upgrade operator the
software and access the coalition so
in the worst case economic analysis
attackers can easily bribe notes and
notes will form profit-maximizing
coalition's so it's bold because it's
important this is this this is the
context that we have the reason in when
we're reasoning about consents protocols
in a public setting at least if we want
to do a worst-case analysis which I'm
going to argue is what we should do
because if we make something that's
better in the worst case it's going to
be better in the better case and some
here are some additional kind of course
key assumptions that we also make
sometimes there may be a little less
important marginal return is equal to
marginal costs on a global basis and
nodes have access to basically like
derivative markets so that you can't
assume that oh they won't attack the
network because that'll make the price
of the node go down that's kind of like
a rosy or something right they could
they could they could have just had they
could just hedge their exposure to that
to those price fluctuations so basically
those two things together mean that in
those two things being that nars nosa
for form coalition's and attackers can
bribe knows I mean that in order to have
security we needed to make it
unprofitable for majority coalition's to
undermine protocol guarantees because
then because they're unprofitable when
they undermined the guarantee an
attacker would have to spend a large
budget in order to cause them to do that
without you know incurring a loss for an
extended period of time so we need to
make it unprofitable for majority
coalition's to revert transactions to
prevent consensus from occurring or to
censor transactions bowl because it's
important
so the fundamental challenge then in
public consensus is again to protect
protocol guarantees against
supermajority coalition's even in the
context of bribe attacks which means we
need to make sure that if a majority
coalition gets together try to undermine
the protocol then they will do so at
their own expense and they will need you
there for an adversary we need to
allocate and spend a large budget so in
Bitcoin like most public cassettes the
protocol is out there today its
rationale for majority any majority
coalition to censor transactions they
get an immediate raise so in adversary
we actually didn't need to spend any
money to convince them to do this in an
irrational model because they they just
get a raise in protocol you know after
the difficulty readjusts if two-thirds
of the Bitcoin miners sensor one-third
they get a fifty percent increase in
their block awards you know fifty
percent increase in returns for minor is
a huge deal you know there's like
selfish mining strategy so you give
another example of how bit like a
Bitcoin knowing node can be Byzantine
and I third either profit right rational
miners will engage the selfish mining I
basically have sufficient mining power
for it to be effective and another thing
because marginal cost is disabled
commercial return in kind of this
worst-case analysis you could bribe some
miners and in order to increase the
marginal cost of all other miners and
them only the miners that you're bribing
will be able to stay online because the
other ones will be operating at a loss
unless they're also being being bribed
by someone else but so these are like
examples of this kind of analysis is
worst-case analysis apply to to Bitcoin
churchland pro stick has very some very
similar problems but in addition they
have this nothing at stake problem where
is it an irrational node will move their
keys you will move their coins to a new
address and then sell their keys of that
held their coins if their old address to
an adversary is willing to pay a small
amount of money because but old address
doesn't hold any coins anymore and so it
needs nothing to them and so if all or
both know is irrational you can enter
sir if you'd like and they could all
coordinate with a low-cost liquor all at
the same time move their coins new
addresses and then so all of their old
keys to an attacker for like no money
and then the attacker would control
basically the block chain and so this is
kind of combination of the long-range
attack and the nothing is safe attack
which going to talk about more in my
Casper talk and then also we have this
property that majority coalition has an
incentive to censor minority because
they just get a raise right away in
terms of block awards and transaction
fees and we have the same property for
double spends or like you know majority
and get together and conduct double
spends and actually they just gain from
that so rather than making defending
against majority coalition's these
consensus protocols have the property
that it is rational for majority
coalition to undermine of their
properties so basically these protocols
are not secure under pure economic
analysis with these kind of worst-case
assumptions and it might hold philosophy
with Casper as you'll see later is to
try to have his best of a outlook and
under this kind of rational rational
model or under is that under economic
analysis so they're kind of two main
traces that people loving on me when I
tell them this it's not realistic it's
basically people who proved have some
consensus protocol they like in the
cryptocurrency space and they think that
you know under their assumptions though
under the realistic assumptions their
thing is secure
you know it's not going to be the case
that all of these my all the stake hairs
in from steak like you know like you
know peercoin or something or move their
points in a new address in order to sell
all their old points to an attacker and
there's like coordination costs it's all
social reasons why this might not be
realistic but and then but and then the
other the other the other criticisms
that are often here is it's just
impossible to be secure in this context
and that's and that's something that I
hear especially from people who have a
lot of familiarity with the traditional
consensus research because they have
like fault tolerance results that say Oh
more than this number of nose badly then
we lose our guarantees whereas here
we're assuming that actually most nodes
will behave badly if they just have an
incentive to you've given me these these
criticisms before you know who you are
so it responses it's not realistic
criticism basically there's a couple of
things one of them is this teaches us
about kind of you know edge cases
instead of it of like you know the
economic assumptions that we could be
making and that the end that is really
informative so even if it's not
realistic it teaches us about the
protocols that were analyzing and I
think it kind of is realistic in the
long run for basically a couple reasons
one of them is you know there might be a
real funded adversary who tries to talk
one of these systems I mean the kind of
a fundamental problem to an extent that
because we're relying on economics
someone with enough money you can come
in and have a large effect on the system
and so if we if we can be secure against
highly resource attackers then so if
there will be highly resource attackers
then this model becomes more realistic
and the other things that like
coordination costs are kind of falling
over time both because people kind of
get established industry in figure out
for each other are and have
conversations and because we're actually
working on technology that reduces
coordination cops
so I think you know you know even though
I may not be realistic today we're like
Bitcoin miners wouldn't dream of
colluding to attack Bitcoin because you
know they think bitcoin is good thing is
something that they want in the long run
I would say that it's this kind of
situation where everyone is just
governed by their ability to make profit
is becomes becomes kind of more more
reasonable and basically I also think
that if we make our announce a protocol
is better under worst-case analysis
they'll be better on gentle and so
that's another reason why you know even
though I may not be realistic this is
how we should do analysis and then
basically it's impossible to be secure
in this context they say partly partly
they say this because they have
resulting Byzantine fault tolerance
literature and but but Byzantine fault
is very different from an economic fault
right a Byzantine node and it's just
like I know that will do anything an
economic node will only do anything at a
price and it's important to say what
that price is rational knows kind of
only behaving correctly if it's in their
incentive to they'll behave badly well
if it's in their incentive to and
basically you know it's impossible to be
secure in this context I agree if the
adversary has an unbounded budget but
for any particular budget you can say
whether or not we are secure in that
context so if this analysis lets you
think about you know an adversary that
has like 100 thousand dollars or 10
million dollars or billion dollars and
and and we can't just say that oh
because all the nose we'll just
behave badly if they're incentivized to
that they that we won't be secure
because they're Byzantine it kind of
really depends on what their incentives
are so you know and another reason is is
that I like my other response i have to
discuss with them is that you know you
don't know this right you just think
this this is like an intuition you have
but this is all very new and we haven't
had much time to explore the space it
might be that you're just wrong and that
we can we can maybe secure in this
projects so public consensus protocols
based very different challenges than
traditional consensus protocols or the
non-public protocols they're kind of
hard to reason about because we can't
just assume that a certain portion of
knows behave badly we have to use
economics and game theory and this kind
of reasoning about the environment in
which knows operate as an economic agent
or as an economic entity with its with
expenses and revenues and there's no way
at all to read to weasel economic
analysis into byzantine analysis or into
around it by saying oh we do business in
fault tolerance analysis then we say oh
and then we prove that it's incentive
compatible you know which there are
separate things and there's there's no
way to put the economic analysis thing
into the business analysis bollocks this
and when you when you when you kind of
when you start to doubt that just
remember notes of expenses notes of
revenues correct node doesn't have an
infinite budget if its operating at a
loss it'll go offline and and therefore
you can't just rely on this business
analysis so my basically they take aways
for you if you are designing or
reasoning about these since protocols is
think about it in the worst case assume
that there's a super majority of
validators who will maximize their
profit e working in concert and assume
that
an adversary can affect their incentives
rather than assuming that the adversary
just controlled some fixed proportion of
their nodes so that's the end of my talk
hope you enjoyed it
you