[Music]
so I everyone we're gonna speak about
random numbers so first a small course
about lactose quantum numbers should not
be generated with a metal children at
random and we've seen too much
application just within the block cache
or using multiple block cache
why it's not secure when you are on
classical computing you have your own
computer you can use your time data in
your computer most movements to get a
random number
I remember when I was creating my
12-inch an address
they asked me to move them out to type
random stuff on the keyboard and usually
entropy but the problem is if you want a
random number in a serum which is
basically the world in future you will
each end up into a different phone
locally
why do we need those so the basic use
case is counting we use improve work we
need using complex but in systems
probably Stefano's Mossad is in my
opinion the state of the art in terminal
but in system we use for doing jewels in
the project I'm working on
that's what we do we need for AI to
visualize machine learning algorithms so
imagine you have an errand blockchain
with some academic personality if you
were both she fix the initiation number
you could treat the III into learning
valued him bad decisions
the first method which we use is trusted
path so you have some mr. meehan where
you could plug in a wrapper on it you
can directly call or a kite but the
problem isn't alive every single point
of failure and in case trusted party is
cheating you having a way to detect it
within a lot of the person using block
hash but that does not work so let's go
back to basic walk
the graphic function if you want to
compute H of X it's easy but if you want
to compute X that X of X is y so into a
wok basically either you start with a
new ones like zero and you a and it
stores and target you for the block and
if not you increment announced with n
equal 1 2 3 up to the point you find or
call someone happy so we could say ok at
the end we have ash which is random no
because when you get the final block you
can choose not to publish it and even
worse with smart contract you can bribe
the miner trust Leslie into not
publishing those blocks and you don't
even lose the world box well because you
published it as an uncle so ok only the
miner can do this attack and the effect
is just what just we're rolling the
number so it does not allow you to fix
it to a particular value but it tells
you to pay a small cost when you want
through some so on and get a new one
I've seen applications we are saying
okay
the cost is is what I have a stake in
each block in my application so I can
rely on the block cash to get but no
because the blockage is the same for
everyone so perhaps if in my application
it's not water attacking my name
replication the attacking a new
application that was attacking but
perhaps you can do an attack on all the
suite application at the same time and
in this case you may be more than the
attack 1 meter which is really useful
when you don't have rate of parties is
committee machines so the IDE you
generate a number locally you publish it
ash you had tons of party doing that
they pay a deposit and in a second phase
the Reavers numbers of course you verify
that the ash corresponds and the result
is the extra of all random numbers and
interesting property of Excel if you
excel something went down with whatever
is always wonderful so you just need to
have at one party inputting a random
number
the problem is that parties can choose
not to reveal and if you party does not
reveal the generation is stopped so yeah
you pull the Misuari deposit of the
party not revealing and in for example I
want to flip a coin with you that's a
really good method because it's only two
of us we fix the coin and if I want to
solve the flip I get timed up by
dribbling and I was deposited and we
assume that you want to flip so that
works very well but now imagine you have
one thousand users which are relying on
the same number and you just have one
not revealing to prevent generation so
you will need each party twelve you
deposit equal to what at stake for all
the others so this scale quadratically
to the number of policies so it made me
practice okay is playing poker but for
other person it won't work then you have
special signatures so special signatures
is a scenario which is where a lot of
parties get part of the key and design
part snatcher and if you get at least
the threshold of passive nature you
combine them and you get a signature
one interesting property of the Senate
regime is that no matter which party are
signing as long as we get a threshold we
get the same signature so if it's a Oba
signing or DLC or no matter what we
already get this is the same signature
so that's really good if you are in the
honest majority model because in this
case I thought about you with all and
everything goes right but the problem is
if you can get attack a 50 percent with
party proposing to revealed a design or
you
walls with parties we will collude to
get to know the random number and they
can sum sorry by making some cash attack
the other method is second cell prostate
so in classical proof of stage
you always subtract second cell probe
walk in the classical probe walk you can
paralyze it so you get one computer
having a known sequel hero one was 0.1
and the more computer you have the
faster you get to find a block in this
one it's not the case so you start with
the block cache and you a and you a
and you are initiated a a
so at each step you need the result of
the previous step so even if you get
tons of hardware you won't be faster so
what does it do you it's a time lock
cryptography the goal is to ensure take
some time to compute the random number
such as this way if you are minor and
you want to get bribed or you want no
tribute for yourself at the point where
you have your block if you wait to know
this result someone else will already
published one so okay you can some
source on but you don't know what you
sound so so it's still random but there
is still some catch because if you want
to compute some second shell - something
like 1 million time and you do that to
me smart contract you will run into the
gas limit so to solve that you need to
use interactive verification I guess
some of you have been at true--but
foundation so that's the same concept
except here it's quite simpler because
we just assumed
country or complicated stuff just ashes
so you let every party post the result a
deposit and then you have a replication
game which guarantee that each party
wins honest so the Challenger of a fake
number
all the defender of the right one will
always win the challenge and when
someone puts fake numbers you will
possibly deposit and give thought to
challenges so one charge of litigation
that's assumed here for the sake of the
example that I should use this one don't
use that as an ash at least for example
you compute you get seventeen and some
of the party said 35 which is a fake
cancer so you ask at this party what is
the value at the nine step and he says
27 so now you know that made mistake
between 0 and 9 so you ask except for it
says 4 4 is correct so you know it's
mistake is between 4 & 9
you ask 6 he says 24 is incorrect you
guys got five and now you show 5 plus 1
is 6 not 24 so you've proven that he
admits a mistake in computation but
there are still some some issue with
that which is that a party can put tech
numbers put some deposits and okay this
party won't be able to change a number
but this party will be able to delay the
time this number will be available so
also if we implement the incentive in
the challenge naively you would
challenge a number
and the policies we put in effect
numbers would challenge is own number
and make sure to lose against itself in
such a way that you don't win the part
of the deposit and our goal is to design
a system suggest if you have even a
small deposit that you can use to
challenge it make challenge compared to
an attacker with a large budget making
tons of fake numbers as you only say
okay at the first one you are going to
challenge one number you win and you get
alpha by deposit now you have 1.5
deposit the second step you do it again
now you get two deposits and now we get
to deposit so you can challenge two
numbers at the same time and next step
you get really posit and so over and
over and you deposit is increasing
exponentially of course to the point
where I will finish to disprove all the
numbers so the author ID is the splinter
reward between each party challenging no
matter which challenge is winning but
there is still a catch I receive an
issue where the attacker can when you
challenge one of this number keep a huge
part of this budget to also challenge it
such as this way you will get almost all
the reward you will get peanuts and you
will never be able to challenge multiple
numbers in any one run of challenge
so or to avoid that it's with committin
reveal so you commit to challenge a
particular number and in a second phase
you really will that you are you want it
to change this one an in such a way the
attacker it does not know which of his
number you're going to challenge so of
who we can try to challenge number one
only but if he's gonna challenge a
number which you have been challenged
it will either loose deposit as a
challenger all remove the tech number so
in both cases is losing of who's in the
wall scale in the worst case you have a
super look he attack her and each time
is getting right in the number that you
can a challenge but of course they'll
just relax in the worst case so we can
look at what would happen in the average
case and in this way from all the
strategy I such an attacker could have I
have include anyone which will not allow
to have the number by logarithmic amount
of depth so that's still a conjecture
you need to prove it because you need to
prove that there is no strategy are
going to do that and if someone is
interested by having this proof or
someone as insight in this proof I would
be really happy to speak about that so
for this seconds are full of work within
the problem which is that it takes time
so it's not suited for a real-time
application if you want to bet that's
not a good idea
Wow Oh in the rotary okay but if you
want to bet in real time that's a good
idea
if you can wait something like one day
or I guess
even less that should be really
interesting a method to get our numbers
the Brazilian nose that kind of attack
which would be an adware if you managed
to get an ad were able to compute ashes
order of magnitude faster than the other
way of hosers you could compute it super
fast and know what the number will be
and its way to a block cache attack so
thanks everyone and if you have a other
question or inside feel free to speak
with me as well there or by email
[Applause]
you
[Music]