l edger c ombiners for f ast
play

L EDGER C OMBINERS FOR F AST S ETTLEMENT Matthias Fitzi 1 , Peter Gai - PowerPoint PPT Presentation

Dec 19, 2022 •317 likes •994 views

L EDGER C OMBINERS FOR F AST S ETTLEMENT Matthias Fitzi 1 , Peter Gai 1 , Aggelos Kiayias 1,2 , Alexander Russell 1,3 1 IOHK Research 2 University of Edinburgh 3 University of Connecticut TCC 2020 Nakamoto Ledgers in a Nutshell ? Cartoon

  1. L EDGER C OMBINERS FOR F AST S ETTLEMENT Matthias Fitzi 1 , Peter Gaži 1 , Aggelos Kiayias 1,2 , Alexander Russell 1,3 1 IOHK Research 2 University of Edinburgh 3 University of Connecticut TCC 2020

  2. Nakamoto Ledgers in a Nutshell ? Cartoon description: ● transactions-carrying blocks appended in ever-growing tree ● current state: longest chain, extended by honest parties ● block-creation rights distributed “fairly” using anti-Sybil lottery

  3. Nakamoto Ledgers in a Nutshell ? Cartoon description: ● transactions-carrying blocks appended in ever-growing tree ● current state: longest chain, extended by honest parties ● block-creation rights distributed “fairly” using anti-Sybil lottery Properties: ● sufficient fraction honest ⇒ “eventual” consensus on winning chain ● immutability measure: #blocks on top

  4. Anti-Sybil Lotteries for Nakamoto Consensus Proof of Work (PoW): [Bitcoin, Ethereum, ...] ● parties solve a computational puzzle ● success proportional to invested computation Proof of Stake (PoS): [Ouroboros, Snow White, ...] ● parties own stake on the blockchain ● success proportional to owned stake Proof of Space (PoSp): [SpaceMint, Chia, ...] ● parties dedicate storage space ● success proportional to dedicated storage

  5. Nakamoto Consensus: Advantages NC very resilient, can tolerate hostile environments: ● Dishonest Minority ○ in principle, up to 1/2 of the underlying resource can be controlled by an adversary ○ cf. classical: typically up to 1/3 ● Sleepiness/Dynamic Availability ○ fluctuating level of participation, parties come and go without notifying others, lose access to necessary resources, ... ○ cf. classical: fix party sets, typically rely on counting

  6. Settlement Time for Ledger Protocols ● a.k.a. latency time tx enters tx the system stabilized “How long does it take a transaction from being injected into the system until universally recognized as a stable ledger entry?”

  7. Latency Barrier of Nakamoto Consensus time ∊ tx

  8. Latency Barrier of Nakamoto Consensus time ∊ tx ● tx stability proportional to number of blocks on top

  9. Latency Barrier of Nakamoto Consensus time ∊ tx ● tx stability proportional to number of blocks on top Intrinsic Latency Barrier: limited block creation rate ⇒ limited settlement speed (to avoid forks)

  10. Overcoming Nakamoto Latency Barrier Overlay structures for improved latency: ● stronger assumptions ● latency improved in optimistic settings ● e.g. Hybrid Consensus [PS16], Thunderella [PS17], Afgjort [MMNT19] ● layer-2 solutions ● no longer maintains a distributed ledger of all transactions ● e.g. payment channels and state channels [PD16,DFH18,DEFM19,DEFHH19] Best latency guarantees achievable by Nakamoto? Our approach: Parallel Composition (also taken in Prism [BKTFV19])

  11. Our Contributions 1. An Abstract Model for Ledgers 2. A Combiner for Security Amplification (= Latency Reduction) 3. A Robust Ledger Combiner

  12. Abstract Ledgers ➢ ledger ● a static set of transactions T ● rank function: T ⟶ ℝ + ○ orders transactions ○ captures their stability ○ loosely related to time ○ e.g.: block timestamp

  13. Abstract Ledgers ➢ ledger ● a static set of transactions T ● rank function: T ⟶ ℝ + ○ orders transactions ○ captures their stability ○ loosely related to time ○ e.g.: block timestamp ➢ dynamic ledger ● time-indexed sequence of ledgers ● sufficient to express persistence, liveness

  14. Ledger Combiner for Security Amplification/Latency Reduction ( ) ... ⇒ m parallel, independent 1 “virtual” dynamic ledger ⇒ dynamic ledgers

  15. Ledger Combiner for Security Amplification/Latency Reduction ( ) ... ⇒ m parallel, independent 1 “virtual” dynamic ledger ⇒ dynamic ledgers rank 1 ( tx ) , … , rank m ( tx ) rank( tx ) := F(rank 1 ( tx ), …, rank m ( tx )) ⇒

  16. Ledger Combiner for Security Amplification/Latency Reduction ( ) ... ⇒ m parallel, independent 1 “virtual” dynamic ledger ⇒ dynamic ledgers Fast (m-fold) submission: settlement time t t / Θ(m) ⇒

  17. Ledger Combiner for Security Amplification/Latency Reduction ( ) ... ⇒ m parallel, independent 1 “virtual” dynamic ledger ⇒ dynamic ledgers Fast (m-fold) submission: settlement time t t / Θ(m) ⇒ Slow (single-ledger) submission: settlement time t t . O(ln m) ⇒

  18. Ledger Combiner for - weaker condition suffices: subindependence Security Amplification/Latency Reduction - achievable for PoW, PoS ( ) ... ⇒ m parallel, independent 1 “virtual” dynamic ledger ⇒ dynamic ledgers Fast (m-fold) submission: settlement time t t / Θ(m) ⇒ Slow (single-ledger) submission: settlement time t t . O(ln m) ⇒

  19. Ledger Combiner for Security Amplification/Latency Reduction ( ) ... ⇒ m parallel, independent 1 “virtual” dynamic ledger ⇒ dynamic ledgers m scales with λ: constant-time settlement with negligible error Fast (m-fold) submission: settlement time t t / Θ(m) ⇒ Slow (single-ledger) submission: settlement time t t . O(ln m) ⇒

  20. Ledger Combiner for Security Amplification/Latency Reduction ( ) ... ⇒ m parallel, independent 1 “virtual” dynamic ledger ⇒ dynamic ledgers Fast (m-fold) submission: settlement time t t / Θ(m) ⇒ tradeoff: tx fee ⇔ settlement time Slow (single-ledger) submission: settlement time t t . O(ln m) ⇒

  21. Robust Combiner for Dynamic Ledgers ( ) ... ⇒ m parallel dynamic 1 “virtual” dynamic ledger ⇒ ledgers

  22. Robust Combiner for Dynamic Ledgers ( ) ... ⇒ m parallel dynamic 1 “virtual” dynamic ledger ⇒ ledgers ● robust : some persistence+liveness guarantees maintained even if minority of ledgers fully corrupted ● illustrates versatility of our dynamic ledger notion

  23. 1. An Abstract Model for Ledgers

  24. Abstract Ledgers ➢ ledger: 𝕄 = (T, rank) ● set of transactions T ● rank function: T ⟶ ℝ + ○ transactions ordered by increasing rank

  25. Abstract Ledgers ➢ ledger: 𝕄 = (T, rank) ● set of transactions T ● rank function: T ⟶ ℝ + ➢ dynamic ledger: 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ● time-indexed sequence of ledgers 𝕄 (0) 𝕄 (1) 𝕄 (2) 𝕄 (3) 𝕄 (4) ⋮

  26. Abstract Ledgers ➢ ledger: 𝕄 = (T, rank) ● set of transactions T ● rank function: T ⟶ ℝ + ➢ dynamic ledger: 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ● time-indexed sequence of ledgers ● sufficient to express liveness, persistence 𝕄 (0) 𝕄 (1) 𝕄 (2) 𝕄 (3) 𝕄 (4) ⋮

  27. Dynamic Ledger Properties Dynamic ledger 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ➢ Liveness. For any r, t 0 , t ≥ t 0 +r: tx 𝕄 (t) : t 0 t 0 + r

  28. Dynamic Ledger Properties Dynamic ledger 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ➢ Liveness. For any r, t 0 , t ≥ t 0 +r: tx 𝕄 (t) : t 0 t 0 + r

  29. Dynamic Ledger Properties Dynamic ledger 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ➢ Liveness. For any r, t 0 , t ≥ t 0 +r: tx 𝕄 (t) : except with error l(r). t 0 t 0 + r

  30. Dynamic Ledger Properties Dynamic ledger 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ➢ Liveness. For any r, t 0 , t ≥ t 0 +r: tx 𝕄 (t) : except with error l(r). t 0 t 0 + r ➢ Persistence. For any r, t: t-r t 𝕄 (t) : 𝕄 (t+1) : 𝕄 (t+2) : ⋮ r

  31. Dynamic Ledger Properties Dynamic ledger 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ➢ Liveness. For any r, t 0 , t ≥ t 0 +r: tx 𝕄 (t) : except with error l(r). t 0 t 0 + r ➢ Persistence. For any r, t: t-r t 𝕄 (t) : = 𝕄 (t+1) : = 𝕄 (t+2) : except with error p(r). ⋮ ⋮ r

  32. Dynamic Ledger Properties Dynamic ledger 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ➢ Liveness. For any r, t 0 , t ≥ t 0 +r: tx 𝕄 (t) : except with error l(r). t 0 t 0 + r ➢ Absolute persistence. For any r, t: t-r t 𝕄 (t) : = 𝕄 (t+1) : = 𝕄 (t+2) : except with error p A (r). ⋮ ⋮ r

  33. Dynamic Ledger Properties Dynamic ledger 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ➢ Relative persistence. For any r, s, t: t - r - s t - s t 𝕄 (t) : ⋮ 𝕄 (t’) : ⋮ r s

  34. Dynamic Ledger Properties Dynamic ledger 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ➢ Relative persistence. For any r, s, t: t - r - s t - s t 𝕄 (t) : ⋮ ⊆ 𝕄 (t’) : ⋮ r s

  35. Dynamic Ledger Properties Dynamic ledger 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ➢ Relative persistence. For any r, s, t: t - r - s t - s t 𝕄 (t) : ⊆ ⋮ ⊆ 𝕄 (t’) : ⋮ r s

  36. Dynamic Ledger Properties Dynamic ledger 𝔼 = 𝕄 (0) , 𝕄 (1) , 𝕄 (2) , ... ➢ Relative persistence. For any r, s, t: t - r - s t - s t 𝕄 (t) : ⊆ ⋮ ⊆ 𝕄 (t’) : ⋮ except with error p R (r,s). r s

  37. Why Relative Persistence? ● weaker than absolute persistence, occurs faster ● often sufficient for settlement!

  38. Why Relative Persistence? ● weaker than absolute persistence, occurs faster ● often sufficient for settlement! l(r) -liveness (absolute) settlement in r+s steps p A (s) -absolute persistence } ⇒ with error l(r) + p A (s)

  39. Why Relative Persistence? ● weaker than absolute persistence, occurs faster ● often sufficient for settlement! “ledger up to tx will not change” l(r) -liveness (absolute) settlement in r+s steps p A (s) -absolute persistence } ⇒ with error l(r) + p A (s)

More recommend