[Applause]
Dominic is also fishery student in our
lab and most of will be here in a
second is permissive so the work trip is
scheduled in two parts we have one part
we will talk about trusting
communication the principal will also
explain why costume communication is
where it's not possible without a
trusted third party and then we'll also
have a technical deep dive into
Chamberlin specifically to see relate
and then with prepared game so
essentially if you have ganache
installed in a laptop if not you should
download it now you will get early
broken VDC relay implementation and you
get to fix small parts of it and we'll
have a game sir which tests attacks
against relay and then we'll have a
leaderboard so this workshop is based on
a paper we recently released so we wrote
up a systematization of knowledge on
across your communication so the tiny
print if you want to have a look at that
I won't be presenting everything because
it's just way too much content but yeah
if you're interested that's really so I
mean I guess we can all agree on riot or
probability is necessary but let me just
repeat it today there exist over 2000
cryptocurrencies and I think we can
agree that most of them different design
purpose not only functionality but also
the different views of the community of
how this thing should be used so we kind
of need a way to find have to
communicate between this different block
channels because it's very unlikely that
would be one change in the other one now
historically seen crossing communication
the principles of crushing communication
date back to communications across
disparate databases however the main
difference here is that databases
specifically within us within a single
data center you don't expect bit Centene
rather bizarre behavior right you soon
that everyone's honest you're a single
admin and the only thing that can happen
to your processes which push and pull
data from the databases they can crash
so basically not like non-blocking
atomic commit is a way because it
basically is a problem and they're
solutions for that and the problem is
that you want to make sure that your
process that is running correctly does
not fail and does not get stuck even if
other processes crashed now in despair
Ledger's and watching specifically the
difference is that we actually expect
participants to misbehave correct we can
of selfish - we can have people who try
to double spend and just attack the
protocol because anyone can join the
system and this is basically the major
difference between these two things so
if you briefly talk about the main
scenarios of cross change into
nationality if we're talking about the
main scenarios of prostration
communication I guess the one that
everyone knows about is exchange of
assets right swapping coins against each
other and also trying to transfer coins
from one chain to the other right making
a payment to merchants who may be only
accepts aetherium and you're only am
different now there we have atomic swaps
who also have the console integrated
assets we'll talk about this - imitative
anime now another very important thing
work so now you're across communication
occurs is synchronization estrada
systems specifically that you're
charting is that you separate the state
of a system and each charter responsible
to make to maintain and secure the
states or a subset of the state now the
problem is this only makes sense if you
can actually communicate between these
charge because otherwise your system of
isolated shards and then it's a recharge
so we'll talk about the differences in
the different hues consensus between
shrugging and crushing transfers belayer
now what I think not many people know is
that cross gene communication was
actually the first time implemented to
use something else specifically it was
used to introduce merge might and that's
basically food shopping technique to
largely object and then give theories
that you have one parent chain and you
allow minors to reuse the true for group
solutions from the parent chain for
example Bitcoin to create lots and other
options like name and essentially there
that means that name when can use the
security assumptions of Bitcoin but it
also becomes dependent because the
fitment bills
so does name because it uses the same
and finally and this is the train
recovery this bit more in the paper
there is his term of site chance now
this factor to see many many different
definitions of it over the years and
it's have become an umbrella term for
block change of ability general and I
guess the most famous to that we have
seen his side chains are an approach to
extend functionality of a one block
chain which becomes a parent chain and
you have small options on the side which
are dependent on the security model of
the package but the other definitions
and also quite famous one specifically
in academia which suggested side chains
basically referred to one block to
verify mistake of the other now in the
paper would try to clarify this and we
try to not to use this throw at all
because it's very confusing to check so
again we'll talk about these two things
are working in more detail today now
maybe a question to the audience how
many of you think that cross chain
communication is possible and trustless
matter
okay if you've seen our to be 34 okay so
the answer is none and I'll try to
explain why this is the concern but
before being a being epidemics you know
before we explain something we always
have to make a system you know to be
sure that we cover all cases and that we
understand what we're talking about
so in cross-chain communication we for
simplicity assume that we have two
different lectures right in this case
bit kinetic theory now we also have two
parties or processes as in dispute
assistance with Alice on Bitcoin and Bob
with you on now now let's assume we have
two transactions right transaction what
the blue one is all day out so she can
push it to the box and since actually
two is owned by God
now transaction one is a Bitcoin
transaction it can only go into the
physical monitor as action to is valid
and etherium it can only go into theory
so far simply right facing now
Thank You of cross communication is that
Alice ones that Bob writes transaction
do to aetherium and Bob would like that
Alice read transaction one to Bitcoin
now this and basically this also implies
that Alice knows exactly how transaction
looks like and the other way around both
of those what she actually wants to have
now if what reduces to practice you can
imagine this being an exchange right
transaction two gives a theory of Travis
transaction one is bit go to Bob right
and let's keep this in mind for the rest
of the discussion now the goal of
crushing communications to synchronize
these two processes right we were to
make sure that Alice writes transaction
one to Bitcoin but bubbles the rest
interaction to to theory and we actually
wanted to ensure that they both write at
the same time or at least atomic now we
have three properties for customer
communication the paper I will not bore
you with a theoretical definitions here
I'll just try to give the intuition what
she took with each of the means so
effectiveness basically states that if
everything is alright if Alice and Bob
are honest and the transactions are as
they expect then cross your
communication will receive correct right
so this basically
process to be executed now atomicity
reduces the set of potential behaviors
to ensure that either Alice and Bob
write transactions to the respective
blockchain
so either teks one goes into bit hundred
and six two thousand two theorem or none
of them do right because otherwise
Palace work Bob could be the
disadvantage and this took great-uncle
and finally timeliness basically ensures
that at some point the protocol
proceeded at some point Bob Morales will
initiate the process and then the
protocol starts with now let's recall
again we're looking at an exchange and
essentially cross gene communication
between Alice and Bob it can be seen as
a fair exchange of assets specifically
using our example to emphasize this
right because they want to make sure
that Alice receives coins of it on
aetherium and poverty points of Bitcoin
atomic otherwise one of them will be
cheap now the thing is that fair
exchange is impossible without a trusted
her prior this is a result from that
dating back to 1999
um if y'all gonna be three month outlook
it's written in this paper it's actually
fairly easy to follow and there's a
really good explanation also the
discussion about trusted through our
parties and what this actually means
well questions what do you consider
first place okay let's get back to that
out this is double talk about the same
because expressed using a few more
conferences
he's possible no and I'll try to explain
this I don't think the question is what
you consider
the definition before so let I'll
explain in a second you won't get to
that point but yeah HTC's allow you to
reduce trust in the third party but you
don't ever get anything here took that
the exchange will actually get time
we'll get to that in a second so again
we conjecture right right now that it's
impossible right and there's a whole
basically proof sketch in the paper and
I'll try to give an intuition here right
now because obviously I don't think you
should just trust me I'm saying so let's
assume again we have a smart contract
anything right then the smart contract
allows us to do way more things than
just teach those so it kind of
supersedes patent law contracts in this
case and you see this fart project what
we can actually do is we can enforce
that Bob behaves correctly if Alice
writes transaction tips want to bid
right because we can require lock to
lock in some coins in the contract and
the contract will then release these
coins if Alice control actually spent
send it to Bob in a bit better so this
is actually a very weak model using
angel season becomes more complicated in
fact the we'll cover this in the first
lesson there
now if Alice memorized transaction went
a bit grunt she wants to be sure that
she receives the Quincy theorem so what
she has to do he has to suggest me to
prove or somehow inform this smart
contract on the theory side that she
actually wrote the transaction to the
bit cross-eyed and the problem is within
a single chain yes this smart
contractors could actually very fine
right - good if Alice were to write -
theory you meant to call a function of
the smart contract the contract will
become aware that yes something is
happened but since these are separate
Ledger's this country by itself also
being a program which react system it
but it has no other way to verify that's
something I've been a bit of an accepted
someone who tells them that it's
happened and this is actually where the
comes in because the only way we can
solve this problem place we can make an
assumption that either all parties that
we have seen from the small that means
Alice is also online and that we know
that there's a bound on the message
delayed so basically in this case Alice
isn't mine she is honest to herself
obviously and she's an incentive to
claim the coins on the theorem set after
same fifth grade so she's the one who
submits the proof but the problem is if
we do not want to make this assumption
in a synchronous model and we went
without alistair crash which is the
typical assumption we have to make the
only other will be to achieve actual
cross the correct Russian communication
is by having a trusted third party which
then takes the transaction one proof and
submits it to the smart contract or once
never trust a third party you might as
well trust the third party to be the one
who locks the points of the game which
allows to be just stratified like
so there's a sudden to write his name in
this day so the trucks or the trust
certify in the sense of disability mean
obviously wanted to behave honestly you
make this assumption but if you build a
game around this trusted third party it
doesn't guarantee you that this party
will be a vomits her
it's just incentive exactly so if you
say this party must block collateral it
will reimburse you you may not face
financial damage but the protocol still
fit right you still the actual view me
like I'm not security mathematical let's
say let's put it that would trustless in
game theory is grave definition right I
mean essentially if you and we have
their protocols which ensure that you
don't face man like hence the letter but
in all these protocols you have some
time outs and some time whoops and some
synchrony assumptions because if you
don't have a synchronous function and
bricks but we'll come to that in a bit I
mean we'll we'll discuss atomic swaps
cryptocurrency back assets and you'll
see where the synchronous assumption
comes in actually so your argument in
this example was that Ellie's would not
be able to do that
third party so the thing is in this
model you must allow Alistair krei right
cannot assume I if we assume that the
amount of time international approaches
in the second and I'll actually have an
example way to still at the problem but
essentially the problem your problem but
I mean not exactly that's also a problem
but in half my contracts they only
ensure that you cannot steal it was
behave within a certain period of time
but if you crash in the time of expires
it still fit there's a specific example
of this yeah okay sorry question yeah
can you talk a little bit about how
important it is for us to not rely on
the synchrony assumption and like why I
mean the thing is so anyway we design
protocols often we make the assumption
that we have a synchronous the network
model because it's way easier to design
these things right we assume that if I
send a message at some point you will
receive however if we cannot make this
assumption then I do not know and that
we assume that nodes to be malicious
then I do not know if your malicious or
you just did not get the message there's
a really famous FOP miscibility result
by Mansu inch which should actually
states consensus is impossible in the
system where you have more than one but
these ones also note if it's a
synchronous because again I send you the
message but if I cannot make an
assumption I don't know whether you
received it or not I don't know maybe
your malicious and you were just you
know pretending not to know it or the
network actually has a huge delay
usually the synchronous and network
assumption and not participant
assumption sounds like here it's an
assumption regarding Alice so I was just
one day affair which one is in this case
I mean it's both because you need now is
beyond light which is because your she
needs to send a messenger but you can
usually ensure that somehow but if the
now
we don't have the super new assumptions
and it's hard yes
so the problems within a single system
you you can try to ensure that Alice
sends the message or something that's
the time and such right at some point
Alice read the message but here we kind
of have two separate systems so if two
separate networks but yeah I see the
question the Phoenicians are more clear
than paper hopefully it's just it's not
an easy thing to just explain by
intuition but I hope this kind of makes
sense to everyone
are they any more questions okay so if
you have questions you'll just have to
trust so yeah we conjecture that it's a
coolant and then there's a discussion in
the 1999 impossibility result on why
this is the case and they try to give a
similar explanation of why actually
having a synchronous model is very
similar to having a trust a third party
friend cuz again Alice if she has to be
online and we must expect the message
will be delivered on time it's the same
thing as if we have a trust with their
price for the trusted third parties
online and it ensures that messages are
delivered on time and ensures that a
vertical progresses if we have assumes
if we assume synchrony Alice's her own
third party where she trusts herself
because she knows she'll be online and
necessarily deliver so if you it's
basically it's the same thing whether
you some interested third party or you
some sequences bond Theory respect now
obviously as soon give us a third party
the processor pipe is still your coins
and everything but for the correct
execution of the protocol and again this
is where the games running perspective
comes an even 50
it still is
[Music]
fire fire yes is basically when you
basically first a message unchanged and
there is the recovery of both face and
so what would be in some cases if you
try to swat an asset and you want that
swap to be atomic or whether conception
to be a moment in the sense that and if
you if you
we've x2 chain wide but it's X
consistently loose chain like there's
two different ways of just dealing that
this way I forget where you basically
customize 19 X say K X will not be
beautiful chain wife and there's no will
become professors behind that so like
there's no way you can fail she say you
can say I want to be checked in the next
to Y then there's no there's never a
more stable recovery person like that
[Music]
but here the two-phase commit further
goals there is a port or recovery phase
in the case for our transaction fails
okay so so you might change object X we
change Y but you might be light but what
do you check the world object s chain
while it might be the case that you
might have to undo that because
determine the overall transaction that
this process is part of fails so and
this is when our board comes in okay and
now it will become more clear when we
actually go through the actual verticals
but it is a classification second
classification is a local mover cane so
when you actually do push fast
communication or first chain
communication who is responsible for
verifying that medication for some
principles local her kitchen which is
basically when needed the participants
who are involved in that question
communication are responsible for
verifying that question
for example hdl-c basic level swaps
so for example if Alice wants to send
money to Bob 30 Bob is responsible for
verifying that that money has been sent
on the other hand with global
verification you don't just need the
team participants all the participants
of the question communication protocol
deserve to be involved in their
verification you also need the entire
consensus to be without verification or
you to verify the consensus by some
consensus that will header or object and
one example of this is public swaps with
transaction including roots so
transaction inclusion with some Bricklin
for example the ethereal chain has to
receive a block header from the Bitcoin
chain and the etherium chain has to
verify that proof of work with that
block header answer that's global
perfect Asian because the chain is
verifying in the consensus of the big
question
so the entirety of James Ray's be
involved in some way of verifying the
communication I finally have security
model the different security rules for
authentication as homogeneous and
heterogeneous
[Music]
heterogenous
let's talk with heterogeneous that's
most important and tension venus is
basically when you have different chains
the aren't really kind of connected the
or directly connecting to each other for
example let's say you want to
communicate with from Bitcoin to Syria
or any or any of these chains this is
considered a true genius because these
chains are built differently and have
different
security assumptions okay so you might
not be able to certainly make
assumptions about the security of in
today's chains like I could just create
my own boxing and I'm gonna get with
Bitcoin for example using atomic swap
but bigger people have Bitcoin can't
make assumptions about the security of
my chain now with our genius with emojis
it's used as a uniform level of security
for example father ensure in Charlotte
in a Charlotte system there's multiple
chains but there's chains above the same
system and they use the same consensus
protocol and they they designed to be
connected to each other so you can make
assumptions about the security of those
chains and usually each other's systems
as I exaggerate that if one chain fails
then send us the other because the best
chains rely on the state if each other
so you might be familiar with cosmos for
example or talk about one that I closed
most for example have a heterogeneous
security model so for example the cosmos
of water that you can create your own
zone or chain with your exercises well
first for example they see empty
pointers shopping or any viable because
it to be the Virginia's I'd say when I
go through different variables and
pronounce no we're not going to do much
detail but they do give you the next
NTFS table with atomic swaps so yeah
also just one thing on this on this
finger saw I mean we won't have time to
go into detail upon all of them but one
thing that you may notice is that local
verification so when only to the
participants are involved in the
exchange have to know to do the checks
it's actually an agnostic of the
blockchain is where this agnostic
elicits reading one obviously need to
make sure that the locking mechanism is
available but otherwise they don't care
about any consensus level deeds and so
on because again only Ostergard effect
so let's talk about cross station
transfer than I hope I'll be able to
answer your personal agencies may not
solve your problem with respect so I get
an atomic spouse abuse method I like
okay sure
so in atomic spots using symmetric locks
the idea is that both parties Alice and
Bob use the same locking condition on
both chains an example our hash locks
right so what Alice traits you generates
a secret and greets the current
expanding condition on Bitcoin for
example which says if you really if you
can provide me with a secret you can
take these quotes and Bob does the same
thing so usually they'll have a setup
phase in exchange for application
transactions and so on but then they
both know the hash of the secret so Bob
names the same lock now in the next step
we'll if Alice wants to spend Bob's corn
stress to reveal the secret and this
again ensures that bob has a secret and
can also stay calluses Clause now
typically you also have time locks to
prevent
one of the parties crashes where the
exchange never starts that your friends
are not locked up indefinitely but this
bears a problem and this is I hope the
big is basically this is my digital
seized unsolved opponent or the constant
communication problem because what can
happen is Ibaka crash right Alice spends
the coins from ethereal believable
reveals a secret but Bob never sees it
because he's crashed and what happens
then is Alice can wait until the time it
expires and take her coins back from the
Bigfoot side that's why it looks like
this it doesn't matter it doesn't rush
is know there are crashes before heat so
up never have even sees the secret
teachers of life they boasted a lot and
he crashed when the secret is still
there just have to find it it means
everything is public you don't know but
love Bob the guy who could spend these
coins because this is not just the hash
book it's hash lock ended up singing
from the business right this can only be
spent ballast is can only be spent my
bomb right so that's how I shoulda
season struggle in scenario and if both
crashes and he never sees the secret and
he does not come online before the time
look of this thing expires Alice can
withdraw because that's it that's why
I'm not in a way like this so he has
enough time to do it
okay Jochen it's not a contradiction yes
you do that it was a time lapse but if
he's offline no man indefinitely the
travel is P type of mining definitely of
course
the youth participant walked resolutions
okay yeah well I think these are fine
but that's impossibility so you're very
good yeah I mean of course it's
essentially what a bomb does yeah it's
bad but it's it's still impossible with
and without anyone enforcing that he
stays online that's a result I don't say
that you should participate in the
exchange if you think you may crash
that's where you can always watch stars
but still now you can also do is you can
try to say well what if Bob is we can
make sure that Bob actually is a livable
time and he can actually go flying
because using this in our contract and
that's the same example as we show using
a disability zone so Bob walks is fun
looks launched this coincidence my
contract and says okay well if you can
prove to this contract or any way that
you send Bitcoin into my account on the
Bitcoin side you contain these quotes
and now the responsibilities on Alice
because she is the one who has to push
the coins to Bitcoin and also send the
crunch of MIT pen and push the proof the
problem is so Bob can go offline for
what if Alice crashes so Alice sends the
Bitcoin and then she goes offline and of
course Bob could say well okay I'm a
nice guy I'll give you all out send the
proof myself or anyone else could do it
that's already an improvement because
now anyone can push the proof and the
contract will give you the coins but
it's again if you think about it's the
same thing as when hto seats and
furthermore if this time of expires
again Bob can take the quiz at so in if
Alice crashes and she's a fine or
promise the guy who actually has a close
to the knowledge service attack against
Alice here you can actually steal quote
so another approach and this is
basically some a different approach
across communications use
cryptocurrencies back assets so instead
of trying to circumvent this
impossibility result each time we
exchange but we can do is we can create
a representation of Bitcoin on a theater
and with the whole paper describing this
concept term to explain and I'll try to
give a very very brief or word so what
you do is you send coins to a pulp which
is collateralized and insured through
internet serum smart contract so you
have to give through it to guarantee
that if if nothing goes wrong so is
something was wrong
you'll get reimbursed in this case any
theory you still have to meet agrees
changes now Allison submits approved to
the contract that she locked up the
coins and receives bid compact optics
and she can use these tokens to
nominative atomic swaps we were better
guarantees and it can optimize more we
sell did possibility result of fair
exchange also the free option problem
but at least we're not have to
synchronize clocks and everything else
across two chains and we also don't have
to trust that at this point in time
there is no attack of it which prevents
can actually be included so do you do
the slow set that they cost this set
that phase once then you can trade these
tokens and use them smart contracts
options I'd say you don't have that much
time but it's it's a fairness problem
that I can cancel the exchange and
basically get a free option because I
know what's your offer is but if you
don't know about my Center so now when I
want to go back I burn these coins and
then the vault has to release these
funds to me otherwise it can get slashed
and to get the collateral back in some
it's proof I'm skipping over this
because running out of time but there's
a whole paper describing this concept
then we also have some Coraline yeah
no so the vault so this thing was
constructed in a way that you do not
need smart contracts only in one chain
evolved to be a smart contract or a
participant it could be a human on the
bitter end side
we just need smart contracts on the
decide where you issue the topic sorry
it's a trusted party from digital
assistance perspective for lightness but
from financial perspective it's it's
insured with collateral so if it fails I
can get back collateral from the theory
side so I so the construction is if the
exchange rates don't crash completely I
is a participant did not face financial
damage that's a different thing
the ball can go flying but then the
contract I can if I'm online and I can
go to the concert and say wait a second
this government of but then I have to be
online to accuse him right I have to
then say well he didn't do it
or in our case actually involved is not
submit to prove from time I'm
automatically reimbursed but if you
think about it that the communication
actually failed because nothing happened
on the midwestside right I didn't
actually trigger a process in the
business side I just got reimburse on
the theory of site so cross your
communication fail but I still because
the protocol is constructed that way I
got a reimbursement on the one chain
that I'm off so there's two different
aspects is you have to be careful to
separate now that's a most effect I'm
gonna give you a brief review of quite
sharp communications
so this is a very high should be atomic
transaction procurement so what is the
atomic transaction brother is also the
can also be called the training result
program this suppose Alice wants to book
a track a treatment and she needs a
hotel room and the train seat to get to
the hotel
unless suppose that there's a travel
agent contract or the chain and what
that contract basically does he booked
it books on hotel room and a train seat
at the same time just like when you go
to Expedia you can book a package with
your flights that they tell other same
plan now let's suppose that the hotel
room object or contract is insured one
and the train seat is in short tube so
that means the travel agent contract
will have to communicate with birth
chart to execute this transaction where
others wants to book a hotel room and a
fancy at the same time okay but the key
thing here is that Alice wants to put
first in her stroller and transit we
don't want to end up in a situation
where one of those transactions payable
because if the Train see transaction
fails then at least has a hotel room but
nowhere that gets written or if the
hotel fails in the Trinity but nervous
state now so this opposed each
transaction happen this is trick she
tries to make this transaction but this
person lost second boat comes along and
tries to book the same and celebrate one
second earlier right but Alice has
already submitted this transaction also
missing one second
can end up the situation where Bob ends
up at the hotel room and analyst has a
train seat but she has failed to put the
head celebrate so that transaction say
the transaction was an atomic okay now
the goal of a short communication is to
have atomic transactions so that it
should be that either Alice gets the
birthday metal roof of the train seat or
nothing it's all the mouthing we don't
want to out we don't want a half
complete transaction so there's there's
two kind of broad categories of doing
flash-flood communication the first one
is basically we tax based returning
family plot first focus on services as
she called it for short acting but it's
actually basically Texas which was
invented the seventies and the idea is
very simple so basically what we do is
you issued a Yank command for the
interpreter household room and what that
does is it removes that hotel room from
that shot and that shot generates a
receipt that this has happened that the
hotel room has been removed from the
shot and that was it simply a message in
the block and the receipt itself is
basically can be proven using a relative
proof and then what else does is sends
that receipts and that child to reach
this receipt and we creates this hotel
room in that shot so until now the hotel
room and the train seats are now in the
same shot and so now there's no no
classified communications be even needed
which was actually going to happen in
the same car so no so yeah so I just
described was a fire and forget protocol
so this was a here
it's a fire on forget protocol there's
no recovery phase there's no water face
right there's no way that there's not
there's no failure bird here the
potential failure bird here is if when
during the time that Alice moved to this
hotel room to this chart but might move
this train seats to talk to trot one
so then chassis beef and so the hotel
room back to your I thought one but in
terms of the actual first pole is
through the protocol itself does not
have a built-in support orthographies
well the other mechanism for doing
computation is called the C phase grid
and then the derby of to involve
everyone diagram like spin it and T
phase commit is a very old principle
that I told is because using distributed
systems design but it can also be
applied to shotting it's called defense
commit because there's two phases okay
so this ability have short one and for
two short one manages a hotel trust to
manage the Train the user sends the
transaction to birth charts and then
what they first do is they check that
the transaction is valid using by
Santana and they run up my son time for
at home whatever just like a bit risky
114 is to agree the transaction on
function an ordering of the transaction
second taste and then they lock they
lock these objects okay that means that
once these objects are locked no other
transaction can come along and try to
use these objects because this one's a
this objects these objects will be
locked in this transaction so it's like
this transaction is reserving reserving
these objects it sounds like when you're
an event right for example and you try
to book a ticket it says this ticket has
been reserved for seven minutes or so
grab that if you don't cook it within
seven minutes then you will need dessert
again exactly it's the same principle
you're basically reserving these objects
for this transaction and once both of
these what all of the shots have locks
all the objects necessary as needed for
this transaction
they basically communicate with each
other to tell them that yes these
objects have been locked to this
transaction and then they can execute
the transaction and unlock the objects
or specifically actually just destroy
objects depending on how depending on
your puzzle they see you chase a model
you will destroy the object because it
is already spent what once there is a
contract well open it's basically on top
and so that's basically the principle
what could happen is another transaction
another transaction it welcomes long as
fancy reserved the same hotel is locking
will this locking will fail and then
versatile objects will be unlocked but
the transaction will be aborted the
transaction will be committed it will be
reported
[Music]
okay so now we're going to look pretty
about question for every camera a pretty
poor showing the verification validation
and this I think we're going demo don't
okay workshop actually how many how many
people actually have a laptop here and
can't participate in the coding part
okay can you raise like just we see so
okay cool yeah then let's just go to a
survey up just okay so question
verification and validation when you do
question credit transactions means you
validate that's the messages that you're
receiving question are actually valid
verified now there's different levels of
verification for watching okay as we
with question for same communication
first level state verification like that
means verifying that states correct I
mean just verifying what the state is or
what or what or what the consensus
thinks the state is for example checking
that some sort of locator state is just
for work right yeah that's government is
not fitting but so checking this is
valid checking what does the consensus
was what states that the consensus we're
gonna agree on like what next
it's just taking a piece of work so if
you have a half mmm oh good or sorry a
block header then this simply involves
checking that that Bach header has a
piece of work but it all has has a crest
sensors this is my business flashing
maybe has from the tube sorry I've ever
stopped yes sir I'm not over to use this
consensus so step number one is just
saying some particular that the high
flow is constant is to separate checking
if the consciousness is the consensus
agrees on what the state is so this is
simply my plants so that OS pv s pv
verification so one you download a
follow it for particular example Android
Android where Bob Willis is downloading
that small piece of the block through
the blog header and his stuff is not
actually checking what the state is it's
just checking that the state has
consensus instead level is ticking
what transactions are fruits in the
state that are relevant to you so not
necessarily every transaction so for
example you might want some what you
might want to check but someone sent to
use transaction so you will ask for
notice to give you a proof that a
translation has been included in the
dock simple memory and number four is
stake validity so just because you know
that the state has consensus does not
mean that the state is valid okay so
it's very possible that this one is
majority of miners or speakers could
produce a blog that is invalid or even
like a single miner to do that actually
got a diamond size majority so in the
big quake principle or if they report
for a block to be valid it's not it's a
common misconception actually that's a
lot of people think for a block to be
valid it needs to have people needs to
have its consensus but that's not sure
nobody exactly has consensus the actual
the actual transactions in the block has
to be correct as well so a dishonest
majority of consensus
this fence not be able to concerns by
the transactions it's a block that's
still people's money so that's why it's
also important you've actually validate
the state and what just as trusted
consensus and that's what basically the
purpose of full notes if you run a full
minute to verify a entire part in your
checking every single transaction
you're not just simply trust you know
trusting with consensus and the fifth
level which we'll talk about is data
availability which is basically checking
I guess that's kind of coupled with
checking well is he checking that is all
the block data is actually available for
a verification and this can be actually
done as alternative sustainability
instead of checking it's not checking
that the state is correct yourself this
is assume that I see is correct
and rely on something called flood proof
do you tell people generated if the
stick is incorrect so they can prove to
you that the city's incorrect so I'm
normally not use a like a guilty until
proven is a model where you achieve that
every block is incorrect as where you
prove otherwise
whereas for previous user in a sense
about proven guilty and yeah the green
stuff is basically what my plans are
this degree clarity and which you'll be
relevant to their top and
the other is Oliver African descent
direct observation you run a full know
yourself sexy chick predators give the
change Watchtower so you can then ask
ask someone to run a full note on your
behalf as a full battle if you fail I'd
like this they say ways to do this does
not that does not require trusting at
work shower or just simply record narrow
just if we trust someone
oh this verification games so what so
presently like tribute to these the
computation happens off chain but if if
the execution is correct you can
challenge the execution result or chain
and there's like an interactive game
that is stated to challenges our
verification result and basically the
best news to me that I've had told to
reduce the money okay so into a really
good technical deep them into
Chamberlain's which is relevant for the
practical part and then since then
everyone has a laugh that I suggest we
split the room so wondering can do the
corium sample will also provide this
align the afterwards so we have to prep
the serve and everything will have a UI
and you can play the game later on so
we'll make it a game and then in the
other side if you have any more
questions ones are dispersed we have
okay so but let's do a five minutes
because that's kind of relevant Fred
even if you're not spending today
so I mentioned genuine lays are
basically to be quite right so the
allowance verify the state the state
agreement estate volusia
of another budget now state can also be
considered as a part six in
transactional data right you just know
well you can parse the data of a big
transaction but you've no clue where
it's actually included or even yeah just
now the thing is when SP declines and
that's a kind of a problem because it's
not really been defined in practice I
mean you have a lot of formal frameworks
for this now the back for model but I
have not really seen a lot of clear
definitions of what has to be planned
should we mean basically everyone knows
but then we don't really write a plan
but if we build a study plan that's when
we actually not start to think about it
so what do we need to verify and the
first thing is we need to be aware of
the difficulty just because otherwise
since we know that bit where the
difficulty is switched every 2016 blocks
and experiments different but we need to
make sure that our Chamberlain program
knows what the difficulty is expected at
this point in time otherwise I could
submit flops which are too easy next we
have to verify that before that's clear
we have to check that each block that we
submit is an ancestor but because they
want to make sure it's a chain then we
also have to make sure we can detect its
forms right we need to know if we have
two chains which one is the main chain
which is the shorter and finally we also
want to make sure that we can check
transaction including proofs because
that's actual thing that you want to
achieve when you do a Spivey point you
want to know if the transaction existed
for you accordingly now in our game
today we've simplified implementation
we've dropped the difficulty just for
verification and would remove for
account otherwise the code base become
stupid so we assume that with constant
difficult deal with no force right so
simple more any other but we were the
tester so you want payment to printers
so a question that people often ask it
what what what happens in proof of state
blocks right because it seems similar
but then there's a there's a there's a
subtle differences instead of checking
interacting the difficulty adjustment
you need to track the state distribution
change because you need to know who is
allowed to sign in each round write and
perform do you know the guy who found it
before and that the prefer work master
difficulty target he's the one from us
take me in a faculty but you need to
know what are they the ones were
satisfied and then you checked
signatures which is usually efficient
than perfect for at least if you do a
cross chain and the rest basically stays
the same
now practical challenges that we face
with implementations obviously we will
need to make sure that we have a
cryptographic primitives there so we
need to be able to verify that before
work of the change or technique right so
this works a permit to go in on etherium
but if you try to do the same thing for
like when we run into major problems
it costs around 100 bucks worth of a
theorem gas to verify single a coma so
that doesn't really work and then you
must make sure that your chain rule is a
life right it's a single SBB client
employed in the chain and if no one
provides the data on both then it's not
reducible and the problem is we know
that it costs us money to submit the
blocks to the chain rule or the theory
when you have to pay the gas costs so if
you come along to the BBC relay and last
time I checked it was around ninety
thousand blocks planet incoming chain so
if I don't want to use the original
chain rule a deployment it's already
feasible so your best goal is to
redeploy agree with your parties that
you have a new block that you're aware
of and then you start submitting again
or one day maybe we'll have more
efficient light clients that use flight
client or super block people pause we
have a discussion in the paper and we
point to the links I won't go to detail
them because yeah so yeah we actually we
looked at the baby silver that was
deployed originally and what we see here
is that there's kind of a discrepancy
between the time that the bits per month
is generated and where the rice may have
arrived in the ethereal blockchain
channeling and if we take a closer look
I mean we see that a lot of clocks will
delay around 3000 hours which is not
really practical and you'd expect six
hours to be late or maybe ten right
because we for information
but then someone should push it so the
problem the problem is incentives right
someone else to pay please
and what we also saw that only two
addresses submitted more than 90% of Lux
so the essentially this was consensus
running the business early but in
practice would if you have an
application you need to make sure you
separate split the fees among
participants
otherwise you may have incentive
problems and if the channel is not up to
date is not news and you run into the
problem that you can't submit the proofs
and yeah unfortunately it's not that so
the regional minis say that the
implementation is not normal running
their implementations by Summa so they
have a nice library will also done
around communication so there you kind
of a deployed if you need to use it but
the original one is unfortunately
definitely in sirs
so yeah finally the cost factor right so
we need to pay for submitting the blocks
and we need to do is we need to pay for
each block to be pushed to the business
unit I mean the cost thing is the same
for us to be clients except that if you
use your phone you can then delete the
data the blocks right if you don't need
them anymore
and the costing model is different
storage is not that expensive on your
mobile phone but it is very expensive if
you have a contract or anything so what
you can do then is you can try to
improve improve this using similar new
like fine techniques but this requires
changes to the actual blockchain your
very funny so both flight plan and super
block people Clause which I would have
described them to discuss in this slide
but we don't have time but they
basically allow you to only submit a
letter with logarithmic amount of blocks
instead of linear but yeah another maybe
practical challenge is that if we want
to deploy the so many chains for that
what we end up doing is we submit block
headers from any chains that we want to
verify to any change that were verifying
on so it doesn't it seems a bit kind of
a problem right so the lungs it's a long
term probably want to find out how we
can reduce this and maybe share data
across
no chance so yeah we don't cover
everything and being academics we just
say please read our paper for anything
else we discuss locking techniques how
to achieve atomicity hdl-c is ECDSA law
epsilon would also talk about the
implications for privacy security and
the network threat models so when you
design production across your
communication protocol these are the
things they must consider so yeah and
now to the practical part most exciting
we will release them at some point
[Applause]