okay I could have start there okay so
guys um my name is Patrick McCrory I'm
an assistant professor at King's College
London when I'm gonna present to you
today is some work that actually
originated from Devcon last year so last
year me enough terrorists for Havana
you know pina coladas and Cancun then he
was tell me but and ridin her there
trying to solve the monitor problem so
when I went back to England I got
talking to some people from you why you
see like Siri Bakshi and Andrew Miller
and then we sort of start to come up
with a little solution so first we did
it for payment channels and then I
thought well actually why don't we go a
step further and try to solve it first
ear channels as well so that's sort of
where we got to and I think I think it's
very that one slide that isn't going to
load but that's fine I'll do it at the
very end and I also want to thank
several people so I so I think there's
two people in the audience crisp Oakland
and Sarah Michael John they're both my
co-authors alongside Andrew Miller on
Syria Bakshi an e-2 bent off as well
sounds gonna move on so everyone in this
room pretty much as aware of what a
steer channels about you've had five
presentations of hostia channels work so
I just want to give you a very very
brief overview of how I think about them
so basically with a steer channel the
idea is our parties are coins into a
contract and then they can run an
application of Qi and locally amongst
themselves so it was poker for example
if Alice player hunt then everyone in
the state channel must agree that alice
is played her hand on but the blockchain
gives you is two properties so first
there's safety every party should always
get the coins they deserve it should
also guarantee liveness and we've had
several people talk about that already
so if one person doesn't cooperate then
you could simply redeploy the up on the
blockchain and finish it there so the
application should always progress so
what I'm gonna focus on is the bad case
you know what if one person doesn't
actually cooperate so you can imagine
Alice's plan poker see reveals is Royal
Flush she gets really lucky and she's
about to win the poker game Bob says
well I'm not gonna agree to this Alice
if I created this state update then you
know what you're gonna win the bat
you're gonna take all of my money and
then I've lost so how does Alice ensure
that she can actually self enforce the
correct execution of the poker game
we use the dispute process and several
talks already outlined how dispute
process works and I'm just gonna go over
briefly as well so what we have is
something called kitsune channels and
this would have came out recently and
some people already adopted it which is
awesome because it really helps appeaser
but it's really straightforward we have
a dedicated contract just for the
disappear for this deer channel i'm just
for the dispute process so all this
single channel cares about is signatures
from every party the hash of the state
so not the actual bytes or the state
itself does a commitment to it on a
state version and during the dispute
process would ever stay at house the
largest counter will be considered the
most recent and final of qi an agreed
state so how does this work in practice
so what Ollis will do is that ours will
create a transaction broadcasted to the
network and initiated dispute now the
smart contract will say okay there is
now a fixed time period for everyone to
respond with their latest of Chian state
that they are aware of so of course all
is its gonna broadcast the state of the
game where she's just about the win and
because this is the most recent state of
the game this should have the has
counter after the fixed time period
anyone can send a transaction to the
smart contract to settle the despair to
settle the dispute so what the smart
contract will do is basically say what
was the state I received with the
largest counter that is the final state
that people agreed off chiyan and that's
all our dispute process cares about in
this state channel so what's really nice
then is that Alice can deploy the poker
game so you can then deploy the food
game state as well and then the up we'll
look at the steer channel grab the harsh
compare them and say yep that was indeed
the game state that we agreed so that's
pretty much how consumer would work and
that's a really good way to think about
the speed processes so the promise tier
channels is that we now have this always
online assumption that several talks
have alluded to for this to work both
parties have the MIT roomie and online
I'm fully synchronized of the network
they have the wats out for disputes that
may occur so while kuttappan is that
alice wins the
poker game you knows he's really wealthy
now maybe she can go buy a Lambo and
then she just goes to sleep he knows
he's gonna sleep and maybe play more
poker tomorrow with Bob and the other
and the rest of the gang so while all
this is asleep Bob and the remaining
people in the state channel because
they're coupie and parties there could
be five people in this da Channel they
all collude they say well let's just be
there's a poker analysis taking MOOCs of
our money why don't we get that back why
don't we trigger a dispute broadcast an
earlier state of the game when in fact
the game hasn't even started yet resolve
the dispute and then get our coins out
so that's what they could do so Bob
could you know trigger the dispute sand
the older qiyam state and then over the
block just takes away and takes away and
of course if Bob is successful he could
then deploy the poker game and simply
withdraw his coins from the channel now
for all us to defend herself she has to
come online and go all know Bob's trying
to cheat me and then broadcast the
latest state of the game where she in
fact had you know won the poker game and
that's really important because the
problem here is that there could be an
execution fork so whatever the parties
agreed off chin while it's final if
they're online that execution could get
reversed if one party goes offline
because the blockchain you know trumps
everything so this isn't grid I mean we
have these payment network state channel
networks but now it relies in every one
be an online and fully synchronized with
the network and as most people actually
who was where was the last time anyone
here fully synchronized gifts who
money's a fully synchronized gift here I
got like one two three hands that's what
you're all up against if you're gonna
use tear channels
you can't even synchronize GAF to
protect yourself so really the question
is can we help alleviate this new
security requirement a bit I mean we
can't get rid of it but we can alleviate
it so this is where Pisa comes in and I
know the peas is like a leaning tower
and it's leaning the wrong direction but
it's going to go to the moon you know
that's the jerk I'm trying to make with
it anyway that's why as a leaning tower
but yeah the motivation behind Pisa is
that we want to hire on a countable
third party to watch the channel in our
behalf so has some different properties
so first we get Stier privacy so if I
hire this third party this third party
doesn't actually understand my stint all
they receive is a hush the second aspect
is fair exchange so what I really want
is publicly verifiable evidence that
I've hired the third party and at the
same time the third party always wants
to get paired when they agree to you
know the resolve disputes of my behalf
so it needs to be a fair exchange
protocol there the third part is
actually order one storage so what's
really beautiful about this protocol is
that as a customer if I hire this third
party and I give him 1,000 jobs they
only have the store the latest job they
received for me they don't need to store
all 1,000 jobs so relate 10,000
customers were actually looking at a
couple of megabytes for four stories for
the PISA tower and finally recourse as a
friend also deterrent so piece of those
cheat and this their party cheats and
colludes with the rest of the channel
you should hopefully be able to do
something about that and financial
financially penalized the tower for
cheating so that's the idea behind Pisa
let's go into a step by step so first we
have two components we have this dear
cello contract that as I mentioned
already it only cares about hashes
signatures on a state version or the
number and it's actually a bit like a
honey badger
it's a compatible with most applications
you can think about forced air channels
then the second contract is the PISA
contract itself and this really only
does two things conceptually one is
stores a large security deposit from the
third party other than two it simply
does wit's around for evidence that the
third party has cheated if someone could
present evidence it will effectively
freeze the deposit and punish the third
party that's the basis behind Pisa so
how do you set up Pisa
so we have this third party I mean as a
little smiley face cuz you know he's
gonna do this to make some money I was
only asked to do is leave a smaller
leave a deposit with the Pisa contract
so in my 1990 animation is fluent across
and now he's signed up he's left this
deposit and everybody can see that this
third party now wants to run a
a service so the next question is how do
we achieve steer privacy as I mentioned
before because of the way the steer
channel is designed all the customer has
the sand is signatures for every party
in the channel this is the blindest it
hash on the incremental counter and they
just send that to the tower and that's
basically what a job looks like so
actually all this job - all the piece
all this third party does is relay
messages on behalf of Arliss or the
customer they're just a relay er
effectively now the question is how do
we get the fair exchange of this signed
receipt um payment so obviously this is
layer 2 so we want to pay the tower or
the third party off chin so the third
party to be paired via ridin or
lightning and what you could also have
which is really nice actually is a
one-way payment channel with the third
party because one-way payment channels
off the property where the sender can go
offline and never lose their coins
they're protected against that fact but
that only works for one-way payment
channels other assumptions will make for
the presentation is that the tower the
third party they're already aware of the
steer channel address on the on the
blockchain they know were that you see a
channel exists on this the second
assumption will meuk is that the payment
information is pre agreed ie we know how
much were going to pay the tower on the
the second point is basically how long
is this third party gonna watch your
channel for have you hired them for one
hour three hours forever we'll assume
that's pre agreed for now so how does
this work first a customer will send the
appointment to the third party the third
party will do some sanity checking
they'll get the matches they've received
they'll look at the customers th a no
contract on the blockchain and they'll
say yep every was a dispute I could
actually relay this message on the
contract we would accept it then what
the third party does is that they create
a new signed receipt this contains the
appointment information but it also
includes this new hash that we call the
receipt hush so what the third party
will do is generate around a number
they'll hot and they'll include the
harsh as part of the same receipt
neither customer gets this the customer
does some sanity checking as well the
customer says yep the tower has agreed
to watch the job that I asked him to do
and now the customer will send a
conditional transfer to the tower to the
third party now what is a conditional
transfer and this kiss the transfer will
say the following third party if you
reveal the preimage of the receipt hush
before time T you can get this payment
and that's basically what the condition
of transfer will say so then the third
party can simply reveal the preemies ass
that if you know computer before he
reveals ask to the customer and neither
customer has a signed receipt and also
this preimage s so they can prove the
anyone that the third party agreed the
wats the channel on their behalf and the
preemies proves that this third party
was also paired so they've actually been
paid for doing this job as well so
that's why we call it a signed on
ratified receipt of course what if the
customer doesn't cooperate now what the
third party could do is get this
conditional transfer and simply
broadcast it to the network and then
redeem the payment via the blockchain so
the third party can always get the
payment as long as they're willing to
reveal the preimage ass so that's where
we get our fair exchange now the next
question is you know what happens if bob
apisa collude to cheat Alice she Mazda
again Alice goes off lines he's asleep
dreaming about being a Lambo bro and
then Bob triggers a dispute while alice
is offline he sends the state update
which is an older state that were given
more coins than he deserves
now Jesus huge step in I'm Pisa could
relay the message they know settle this
dispute but Pisa doesn't you know Pisa
is collude him a Bob oh my god is
happening it's losing boom Bob wins he
resolves the dispute he gets his coins
from the channel on Alice's lost
you know Alice we except and she's
really angry you knows he's AWOL Pisa
cheated me I thought it was accountable
I thought Pisa would never cheat me so
is it too late for Alice I mean is there
anything else can do about this well
there is I mean this is the
accountability part that's quite
important Alice has the signed receipt
from the tower or from the third party
that they agreed to watch the child on
her behalf Alice also has that preimage
s the proof the third party has been
paired to do this job as well and while
she also has it's a dispute record on
the blockchain so there's a record of
the dispute on the blockchain that you
know there was the tower could have
responded to resolve so what does Ollis
do Alice gets the signed and ratified
receipt and simply sends it to the Pisa
contract the Pisa contract can request
all of the disputes from the steer
channel contract and simply and then the
steer channel contract will return the
list of disputes the Pisa contract then
says okay that's too good the disputes
let's look at the receipt was our a
dispute that the third party could have
resolved yes there was then what happens
is that you know the third parties
crying because his deposit has been
frozen I know always gets a little bit
revenge
you know cease deny penalize that the
third party for cheating now there is an
alternative scheme where Alice could be
compensated as well so instead of simply
burning the deposit you could compensate
Alice but that comes with some caveats
as well so I can answer that during the
FAQ of anyone's interested but basically
the summary of peas in a nutshell yes
dear privacy there's this fair exchange
protocol there's order one storage and
we have recourse as a financial
deterrent I'm not sort of what you want
out of this third-party service now in
terms of really at work what I should
mention is that Pisa is in the very
first solution there was an initial
YouTube video by Taj it's killing
Bitcoin a few years ago for monitor and
then you have the watchtower protocol as
well that was presented at bps earlier
this
they was earlier this year maybe you
were in February time now they're both
for Bitcoin and what they mostly focus
on is dear privacy I'm a customer I get
some encrypted blob and then I give it
off to the tower
they never focus on accountability so if
I hire the tower or the monitor I have
no evidence that I've ever hired this
tower so they cheat I have no evidence
of hiring them and I have nowhere to
either dummies the reputation or
financially penalize them so what's
beautiful about Pease is out loud that's
what I guess that's our main
contribution that's what we mostly
focused on and because it's design for
aetherium is deployable today and
actually our protocol is somewhat
compatible watchtower
so we also improved the Bitcoin protocol
as well and actually think this is a
really good way for at least academic
researchers to design protocols if you
design it for aetherium
you most certainly have to focus on the
concept and actually when you design
it's a smart contract given the concert
given the Kent's concept it's really
easy to write as a trusted third party
that is a smart contract well normally
when you focus on Bitcoin you know you
sort of try to punch back when in the
submission they get it to do something
that really doesn't want to do so I
mostly focus on doing stuff for
aetherium now and then retrospectively
see if this will also work on Bitcoin a
lot of the time it's not really worth
the while either because they won't
update it but anyway that's my rant over
so two years later you know see a
channels have been an idea as I
mentioned from Jeff's bloke I was 2015
that's three years later I believe we're
on the verge of practical and deployable
stare channels as we've seen today we've
had lots of people building Stier
channels last night on at the I attended
an event and three out of eight
presentations said they want to use
their channels as part of their product
there's still quite a bit of research to
do but I believe see a channels are for
a big part of it mostly an engineering
challenge to go build it and see how
they how well they work while parameters
should be set etc etc so basically magic
unicorns need not apply we no longer
need magic unicorn fish dia channels to
work so that's pretty much the summary
of my talk what I went over today was
Pisa was it the one in the middle which
is an accountable third party in the
past with Andre Miller I
worked on sprites which was one of the
first dear cello constructions or
actually was mostly command focused
during that dispute process us you a
command a new self enforces da
transition that way so the ghoul there
was the ensure the steer channel never
closes you just submit commands and
that's how you do your steer transitions
and then more recently I did I did a
case study where a pretty must be built
this two player bottle ship game and we
really wanted to empirically evaluate
how well steer channels work and we got
some lessons from that as well but
welcome Otto that was kid soon which is
that application agnostic state channel
where the steer channel really doesn't
care what the application is basically
you designed the application as normal
for the blockchain you are this locking
and unlocking unlocking mechanism then
you can lock yourself into the state
channel and then unlock yourself and
what you really learn is that steer
channels are mostly an optimistic way to
scale if everyone cooperates we can
optimistically run off Qin if one person
doesn't cooperate then raises default to
the tour twice you know the lower layer
that's slow and expensive but we can
always default back to that so I'd like
to thank my co-authors of course I put
their photos up there and I also want to
thank the Athena foundation the theme
Community Fund and the Research
Institute from pin sponsor this research
because with our sponsorship it's very
difficult to get any research done so I
guess that's the end of my talk so thank
you guys for listening minutes
apparently
[Applause]
hi thank you for an interesting talk
first of all maybe a stupid question
here but okay so the party's in a
channel submit the latest version of the
state the state hash and signatures of
all the parties to Pisa yeah
but if one of the parties is trying to
act maliciously okay do they submit
their signatures for each updated
version of the state because well they
can't do so if you think about the
receipt the receipt will basically say I
will relay this message according to
this version number spoke with the peas
at about the third party must do first
is that given a job the third party must
follow the it itself that this actually
works so they look at the steer channel
and they could just simulate it and say
yep if there was a dispute this will
always be accepted by the steer channel
contract I think that's what you're
alluding to kind of wondering like if
somebody if a party in the channel
withheld their signature oh yes so for
example the poker gaming instance so
all's plans are haand
I'm Bob doesn't respond what always
would have to do is send the previous
state or about everyone agreed upon if
you're missing a signature then the I
won't be accepting it at the state
channel okay thank you awesome I think
I've got 19 seconds so I don't mind
ending it here
oh there's one question here there's
time yeah yeah I think I was wondering
if Alice has a lot of money at stake and
they collude to get it out don't you
require the the validator The Watcher to
have more money at stake you do yes so
there's different ways to think about
this so obviously for the the third
party if their collateral is less than
their gonna win then they're always
gonna cheat if there's a positive payoff
so that's why I normally say a large
security deposit they may have to have
$10,000 locked up and there's three ways
you could do it I mean you could do this
you know simple punishment and that way
there's always this constant financial
deterrent one issue with you could do
compensation so what the tower could
they could lock up collateral so left
$10,000 $1,000 could be directly
allocated for Alice sir vollis does I
mean if they do cheat Alice always gets
refunded to $1,000 the issue of that is
that they're actually strictly weakens
the fan also deterrent and this is like
a generic issue of any protocol that has
a central deposit and why did I say that
so if $1,000 is locked up for Alice the
tower could also lock up $9,000 for
Siebel and then Louise get those $9,000
back so that way it have to be fully
collateralized to make sure Alice can
never lose any money yeah actually have
to have the sum of what everybody has at
stake plus something that I'd lose it'll
be trustless it would have to be fully
collateralized but actually I think it
worked quite well and risk as well so on
the at the end the appendix of the paper
we actually consider the kiyose of risk
where what if it's over cauterized you
know it's actually somewhat a fractional
reserve it's actually still quite
difficult for the Tower of the wind
because you have to assume that
everyone's offline where I'm actually
maybe only two parties you're offline
and everyone else is online when you're
burning the the collateral you're
actually giving money to everybody who
has taken any so there's three Institute
there's burn was just a tricky burns it
and no one gets any coins or you could
do the compensation where you reward the
loser whoever lost their money so you
could do both yeah
I always find the fan also to make the
burning most easier to think about
because it's a constant at cost
okay thanks Patrick
[Applause]