Centrally Banked Cryptocurrencies George Danezis (University College - PowerPoint PPT Presentation

Centrally Banked Cryptocurrencies George Danezis (University College London) Sarah Meiklejohn (University College London)

who’s interested in ‘blockchain’? 2

who’s interested in ‘blockchain’? 2

who’s interested in ‘blockchain’? 2

who’s interested in ‘blockchain’? 2

who’s interested in ‘blockchain’? 2

who’s interested in ‘blockchain’? 2

who’s interested in ‘blockchain’? 2

fully decentralized cryptocurrencies 3

fully decentralized cryptocurrencies 3

fully decentralized cryptocurrencies tx tx(addr A → addr B ) 3

fully decentralized cryptocurrencies tx “mining” tx(addr A → addr B ) (generate transaction ledger) (generate monetary supply) 3

fully decentralized cryptocurrencies tx “mining” tx(addr A → addr B ) (generate transaction ledger) (generate monetary supply) append-only 3

fully decentralized cryptocurrencies tx “mining” tx(addr A → addr B ) (generate transaction ledger) (generate monetary supply) append-only transparent 3

fully decentralized cryptocurrencies tx “mining” tx(addr A → addr B ) (generate transaction ledger) (generate monetary supply) append-only transparent pseudonyms 3

issues with Bitcoin no control over monetary policy hashing rates are out of control incentive structure is messed up attacks on mining 4

issues with Bitcoin no control over monetary policy hashing rates are out of control incentive structure is messed up attacks on mining not suitable for most applications! 4

RSCoin 5

RSCoin monetary supply decentral central central 5

RSCoin monetary supply decentral central central ledger decentral distribute central 5

RSCoin monetary supply decentral central central ledger decentral distribute central transparent? y y (or n) n 5

RSCoin monetary supply decentral central central ledger decentral distribute central transparent? y y (or n) n pseudonyms? y y (or n) n 5

RSCoin monetary supply decentral central central ledger decentral distribute central transparent? y y (or n) n pseudonyms? y y (or n) n computation high! low low 5

6

(generate monetary supply) bank 6

(generate transaction ledger) mintette mintette mintette mintette (generate monetary supply) bank 6

user (generate transaction ledger) mintette mintette mintette mintette (generate monetary supply) bank 6

user (generate transaction ledger) mintette mintette mintette mintette (generate monetary supply) bank 6

user (generate transaction ledger) mintette mintette mintette mintette (generate monetary supply) bank 6

user mintette mintette mintette mintette bank 7

user mintette mintette mintette mintette consensus? bank 7

user what gets sent? mintette mintette mintette mintette consensus? bank 7

how do mintettes user collect txs? what gets sent? mintette mintette mintette mintette consensus? bank 7

how do mintettes user collect txs? what gets sent? mintette mintette mintette mintette consensus? consensus? bank 7

consensus user tx: 1 2 8

consensus each address is owned by a set of mintettes user tx: 1 2 8

consensus each address is owned by a set of mintettes user tx: 1 2 mintette mintette mintette mintette mintette mintette mintette mintette mintette mintette mintette mintette mintette mintette mintette mintette mintette mintette a d d r e s s e s 8

consensus mintette 1 user mintette 1 1 tx: 1 2 mintette 1 9

consensus mintettes check for double spending … mintette 1 user mintette 1 1 tx: 1 2 mintette 1 …using lists of unspent transaction outputs (utxo) 9

consensus signed ‘yes’ vote (and head h) mintette 1 ✓ user mintette 1 1 tx: 1 2 ✓ mintette 1 10

consensus mintette 2 mintette 1 ✓ mintette 2 user mintette 1 ✓ ✓ 1 tx tx: 1 2 ✓ mintette 2 mintette 1 “bundle of evidence” contains ‘yes’ votes from majority of mintettes in shard 11

consensus mintettes check validity of bundle by checking for signatures from authorized mintettes… mintette 2 mintette 1 ✓ mintette 2 user mintette 1 ✓ ✓ 1 tx tx: 1 2 ✓ mintette 2 mintette 1 11

consensus …and if satisfied they add transaction to be committed and send back receipt tx mintette 2 mintette 1 ✓ mintette 2 user mintette 1 ✓ ✓ 1 tx tx tx: 1 2 ✓ mintette 2 mintette 1 12

consensus features 13

consensus features simple (adaption of Two-Phase Commit) 13

consensus features simple (adaption of Two-Phase Commit) scalable! 13

consensus features simple (adaption of Two-Phase Commit) scalable! T = set of txs generated per second Q = # mintettes per shard M = # mintettes 13

consensus features simple (adaption of Two-Phase Commit) scalable! T = set of txs generated per second Q = # mintettes per shard M = # mintettes ∑ tx ∈ T 2(m tx +1)Q comm. per mintette per sec = M 13

consensus features simple (adaption of Two-Phase Commit) scalable! T = set of txs generated per second Q = # mintettes per shard M = # mintettes ∑ tx ∈ T 2(m tx +1)Q comm. per mintette per sec = M scales infinitely as more mintettes are added! 13

14

each new mintette adds ≈ 75 tx/sec 14

compared to Bitcoin’s 7 each new mintette adds ≈ 75 tx/sec 14

how do mintettes user collect txs? what gets sent? what gets sent? mintette mintette mintette mintette consensus? consensus? (2PC) bank 15

(contacted based on shard) how do mintettes how do mintettes user collect txs? collect txs? what gets sent? what gets sent? mintette mintette mintette mintette consensus? (2PC) bank 15

(contacted based on shard) how do mintettes user collect txs? what gets sent? what gets sent? what gets sent? mintette mintette mintette mintette consensus? (2PC) bank 15

security properties no double spending (only “good” transactions get included) 16

security properties no double spending (only “good” transactions get included) (if honest majority) 16

security properties no double spending (only “good” transactions get included) non-repudiation (mintettes are held to their promises) 17

security properties no double spending (only “good” transactions get included) non-repudiation (mintettes are held to their promises) (because mintettes provide receipt upon committing transaction) 17

security properties no double spending (only “good” transactions get included) non-repudiation (mintettes are held to their promises) auditability (mintettes can’t cheat without detection) 18

mintette logs borrow ideas from Certificate Transparency to log actions 19

mintette logs borrow ideas from Certificate Transparency to log actions mintettes create log entry every time they: -act as mintette in first phase ( Query ) -act as mintette in second phase ( Commit ) -publish head of hash chain ( CloseEpoch ) rolling hash chain of log acts as commitment to actions 19

mintette logs borrow ideas from Certificate Transparency to log actions mintettes create log entry every time they: -act as mintette in first phase ( Query ) -act as mintette in second phase ( Commit ) -publish head of hash chain ( CloseEpoch ) rolling hash chain of log acts as commitment to actions mintettes cross-hash chains to provide evidence of activity 19

mintette logs borrow ideas from Certificate Transparency to log actions mintettes create log entry every time they: -act as mintette in first phase ( Query ) -act as mintette in second phase ( Commit ) -publish head of hash chain ( CloseEpoch ) rolling hash chain of log acts as commitment to actions mintettes cross-hash chains to provide evidence of activity send logs to bank at end of every period 19

security properties no double spending (only “good” transactions get included) non-repudiation (mintettes are held to their promises) auditability (mintettes can’t cheat without detection) 20

security properties no double spending (only “good” transactions get included) non-repudiation (mintettes are held to their promises) auditability (mintettes can’t cheat without detection) 20

(contacted based on shard) how do mintettes user collect txs? (cross-hashed chains) what gets sent? what gets sent? mintette mintette mintette mintette consensus? (2PC) bank 21

(contacted based on shard) how do mintettes user collect txs? (cross-hashed chains) what gets sent? mintette mintette mintette mintette consensus? (2PC) -collate transactions bank 21

(contacted based on shard) how do mintettes user collect txs? (cross-hashed chains) what gets sent? mintette mintette mintette mintette consensus? (2PC) -collate transactions bank -allocate fees -audit mintettes 21