Kevin Sekniqi and Emin Gün Sirer - Using Avalanche for Pre-Consensus on Nakamoto Consensus Protocols

[Music] so I hope everyone can hear me I just want to say a couple of words and hand it over to Kevin for the technical part of the presentation but it's great to see you guys it's absolutely fantastic and we're sorry we can't be there and but but we do the best we can do the next best thing we can do is wake up at 5:00 a.m. in our little little town in upstate New York and chime in to your lovely Italian town so so it's great to be here and so I wanted to say one critical thing because as you well know you know a certain person is at least shadowing me on me wherever I go and keep saying things like you know I mean how how was secret to Bitcoin or whatever so so we are talking to you today as Avalanche people but at the same time we're not just Avalanche people we're also animal cell blocks throughout person and blocks throughout the very existence for that system is to target and provide the relay network for Bitcoin cash that's how it came about I was worried that the relay network was going to get shut down and Bitcoin cash might get Bannen and I'm also and Kevin also as well is it scientist or Walt so we're all scientists and what's the most important thing is the truth and that's exactly what led us onto this journey and well no I think I was people coming out with this information campaign from various various factors in the in the cryptocurrency space way before the fork and way before anything else so so we're very very sympathetic making this this particular approach work and I hope but if you don't Kevin will give you an overview and we'll talk about an interesting deployment scenario for avalanche which is how do we take it and combine it with a power coin this was one of the very first things we've talked about when the idea came to us to deploy it in things and and so Kevin will do the the actual technical presentation sounds good okay thank you guys for having us so again it is quite early out here we are a little bit disoriented so apologies if we we sound a little bit off I will try to speak slowly just so I can get the words to go through the video and nothing kind of breaks off but let me see now to share the screen give me one second okay allow okay can you guys see the screen fantastic okay so so the the talk will be really exactly what you just mentioned using Avalanche for pre consensus on Nakamoto consensus based protocols now a little bit of an introduction Nakamoto consensus again is the security is 100% dependent on the underlying proof of work chain by definition about construction and you know despite what other assumptions you may make the probability of safety of a transaction is really exponential in the number of confirmations no matter what you do if you do not use any further new modifications then you're really relying on the number of confirmations in the chain to to guarantee security and in fact depending on the Byzantine presence in the network this number of confirmations can actually increase and I had this brief Twitter post about this where at as you approach 50 percent of the Byzantine presidents the number of confirmations required to be safe against the double spend actually which is asymptotically as 50 percent there is no known solution you need to wait for an infinite number of blocks before you can accept a transaction that's the theoretical result of Nakamoto consensus so is zero so basically zero cough implies by mathematically by the protocol itself zero probability of safety does this mean that zero cough is technically impossible in all scenarios well no not quite under basic and reasonable assumptions is actually quite possible and here's what we're going to talk to you about and at a very high level we're gonna layer the current Nakamoto transaction commitment model with a mechanism really that provides some sort of freaking sense this is a weird word but it's the closest I can think of it grew choirs it provides some sort of a pre consensus it requires a soft fort with majority of miners adopting the protocol but that's okay because we believe that this is uh the it's very reasonable given the benefits that you're going to get now this is one construction that we gonna provide and it's not necessarily the only one using avalanche in fact you can further you improve the protocol the word provide you're gonna provide you today to also increase throughput but predominantly were focused on zeroconf confirmations for sure for certain transactions in the system and then future work will we'll maybe talk about throughput as well okay so what is the current Nakamoto commitment model a transaction by a user is sent to a bunch of miners eventually the miners will join in the transaction and then place it on the blockchain eventually after a certain number of confirmations the the client can see the transaction is very deep enough and the client can commit this transaction now the way you would adopt or rather go from a proof of work based system to a system that requires some form of identity management is you create a basically a a pre agreement soft pre agreement on the set of miners by a signaling whether miners will accept a certain transaction or not and the new model basically looks like so the transaction is sent to the miners the miners amongst themselves first very quickly within a few seconds are able to decide whether this transaction will be included in the next block or not and remember the assumption here is that the the majority of the miners have soft forked to to use this new protocol and then the client can immediately if the client sees the virtual set of signatures from the from the the client from the website the miner is that this rejection will be included in a particular block let's say block n then the miner the client immediately accepts eventually the transaction will be placed on the blockchain and because the miners that are signalling commitment are greater than some percentage majority and you can set this up as high as you want for example you can say that 60% actually agree on this and this is verifiable using avalanche the higher this percentage agreement is more likely the transaction will be placed on the blockchain in the particular specified block using the protocol if you get close to 50% there might be some you know attack that can happen for some period of time but the higher it is and this is measurable then the more sure you are of the transaction being committed in the in the blockchain so this this middle part here how do you achieve basically almost nearly instantaneous commitment without using crazy new methodologies in a network of potentially thousands or even millions of miners and remember you don't have like suppose you don't have tools here you have individual mining nodes well the basic idea is you use avalanche and what is avalanche it introduces fundamentally new mechanism for building BFD protocols so it's not really an incremental improvement over classical B of T s like p b FD and temperament and ripple and and etc even algorithm for example it exploits a mechanism inherent in epidemic networks epoch where simple gossiping pulls and pushes in the in the network actually provides a strong toppling effect of where everybody moves over to a particular proposed value so no sample almost a nearly constant size set of neighbors and again nearly because it's not exactly constant but it's bad for all practical purposes is basically constant and then repeat the step for a logarithmic number of routes and eventually after this a number of messages we all converge to the same proposal very basic visual representation of how this works so you have this node over here it doesn't have a proposal yet is in black but these nodes that I mean its neighbors have red and blue it samples these neighbors and the symphysis simple majority and then it becomes red itself and basically this process is repeated in parallel amongst all notes and it turns out that this sort of mechanism is robust enough that again it said in just a few rounds we're all going to converge in the same value so it's extremely fast and efficient and lightweight using the the core mechanism you can actually amortize the cost of the logarithmic number of rounds into just a single sample for every single transaction so basically you get a total cost of oh of one per transaction in the system now remember that this personal transaction complexity is still unchanged we're still only amortize the cost but effectively this is what you get over over time so what are the properties of avalanche is extremely fast and lightweight as I said it brings around complexity to o of one scales to thousands or millions of nodes and then lastly it does not need precise membership this is a very important feature that differs from more classical-style protocols like pbft where you know you have a hundred and you require it precisely to know exactly these 100 nodes and then you require a specific threshold to agree in this case for pbft 2/3 on a proposal in avalanche no such requirements you can have discrepancies in the in the views of the of the nodes after you can actually set yourself the required threshold for agreement that you would like you can set it to be 60% 70% 80% and so on and the higher this threshold is it will impose a little bit of round complexity to the system and message complexity you will require a little bit more work to do but still it's gonna be very fast yet you're gonna have much much stronger security guarantees so it's a it's a very tunable knob that it provides in comparison to other products so average for pre consensus the protocol very high level the client sends the transactions the miners within one or two seconds the miner either approves the transaction for block n or rejects and the client itself does not need to rely on a single miner it can actually do this verification itself it samples and network exactly the same way that the miners in the network would and then if a proof the transaction will eventually appear on on block n some transactions will not be included in block N and the reason is because well we have only limited throughput per block and of course if you have you know thousands of thousands resurrections coming for block n snow Berman will not be included in blocking and therefore will need to wait for confirmation in block n plus 1 and so these kinds of transactions will not get nearly instantaneous commitment so they were required waiting into the next block ok so conclusion we have incomplete but foundations are there avalanche provides latency in one or two seconds throughput is completely unaffected implications is that not all transactions get instant confirmation so how do we get to a bit to get all the transactions to get instant confirmation we basically have to work with the throughput to get the throughput to to go much higher now that will require unfortunately more soft I am thank you for that yeah I do have a question like roughly if you if you look currently at we assume very efficient block propagation and basically the total amount of bandwidth that we use for a transaction is only the size of the transaction plus the size of an inventory message per connected pair for for everyone and I'm zooming here by there's got to be more cryptographic data needs to be sent back and forth what would be an estimate of the total amount of extra data requirements that were looking at per transaction so I actually could not hear you quite well can you maybe I got it I understand it is the amount of extra communication requirements as right yes yeah so um so I think it's it's simple to say that it's it's it's quite modest so um avalanches so there is some here let me try to give you a very short readout of what Kevin said so deep down what you're suggesting is there are sort of certain ways in which people think Bitcoin works but it doesn't work that way Bitcoin really works by electing somebody and having that guy dictate and Kevin's saying look before that face why don't you have the guys who mine participate in a short very short big consensus protocol and in that protocol select know the content that's going to go into the next block and the way by virtue of the way avalanche works those people will have to be miners and it's going to be a democratic process every miner gets gets a voice and they pick which cut transaction is going and that particular process so there's a woman catch but maybe may or may not have community Avalanche is really designed for really large networks and the Bitcoin miner network is rather small so I can give you a numbers for really large networks and maybe Kevin can give you a number so very very small networks but large large networks let's say you have thousands of nodes and you want to reach consensus what you have to do with avalanche is essentially sample very small sets say five nodes or so for a very small number of rounds say 13 through 15 or 17 or really large network so that can suit something I think the numbers that I view 17 gives you like 50,000 nodes and and 13 gives you a thousand will do something am i right Kevin speaking yeah it goes very little yeah yeah grows very little so the number of messages sent by a node to achieve consensus among a very large group here is very very modest you know asking everyone else so it's not like every miner is talking to every other minor your sub simple you're creating so so imagine that you're in a stadium of 50,000 and you're ascending 85 messages right that's what 5x5 by 17 is 85 so 85 minutes it just gets you that three constants on that consensus that you need so it's like you do per transaction and we need to do that yes there we go and it is this kind of per transaction right for the for the one who wants to know the contents okay just for my understanding we're talking about did this difficult census is done for each transaction but then only from the one who wants to know the certainty in this model yes you can certainly batch transactions hours for simplicity as you know saying persons action only but certainly you can batch transaction there is nothing preventing you from batch enough okay yeah thank you can you do something where it's actually done only when you have a conflict in transaction I don't see why not but then you don't quite know when the converter session will be detected in network that there's no specific and yeah so all right so but it seems like yeah easy to it on a per transaction and some vendor yeah so thank you very much for the talk my question is more about how you are thinking about knowing that it was a minor membership so how do you prevent people that are non minors from doing the vote and how do you tie the votes to guarantee you is actually a minor that actually provided the vote so that's a very interesting question and to repeat I believe the question is you guys are coming through a little muffled so I heard it is that you're asking how we prevent people who are not minors from coming in and messing up the entire process so that's a great question very very insightful question the lovely thing about having the for work blockchain behind the scenes is a it gives us security right things that are committed there you know people understand that process by now people are committed in Bitcoin to the security of the blockchain the effort that went into mining those blocks they understand the energy that went in that also gives them a sense of value as well for psychological reasons and so that's all great but be it also does something else you tell me I'll just go identify those nodes that have hash power so they're simple thing one can do is is of having mine in the recent past so if you have a power and you've named a block in the last same month then you get to you get to be a miner or the definition of participating in the pre consensus protocol now one if one wanted to make noise and create sort of the reason to reject this idea one can say oh that's not Aryan what about me one day one then I can't participate well that doesn't prohibit you from actually participating in the mining and earning of reward so that is suppose I'm a brand-new miner and I just turned on my machine can I have no no no blocks to my name whatsoever okay then I'm still good to listen into the pre consensus I still know exactly what you mine and when I do mine things in big blocks will still be accepted and as soon as I have that first block and I have the necessary food for being able so that makes a lot of sense when there's I'd love to see a speck on exactly how they would notify that they had created that block in the past but that's exactly what my thought process was so as you get more specs on exactly what that looks like I would love to see those last sentence I was just saying that when there's an official specification on what the miner needs to do to prove that his mind a previous block I would be very interested in the research on how that would actually be implemented so when that is available feel free to reach out to me right love to look at yeah we don't have an official spec yet yeah there's no spoken over yeah I want to very carefully emphasize this the nothing that Kevin described it requires a sense of identity for minors and and also there is absolutely no censorship vector here so a minor and not sensor transaction just because like if I'm spending some money to the Alice then it's not the case that the minor can say no through this the Avalanche process will necessarily okay that turns actually yeah this is the decision process can only pick between conflicting transactions so if I smell the bubbles then that's the only time that the miners get to stay red versus blue so if I spend the palace and to bomb the same ugh so that's when this process gets yes to have some decision pattern otherwise it's the default process you and ask people they say yes I know that transaction and I have done that at that point they accept it so property of the flag there's no leader to to elect the transaction at any particular block if a transaction is available to be placing in a block it will be placed in the block and every the network will will converse with it right so I'm I have to question the first one is can you talk about the the incentive structure a bit that arise when a miner decide to disregard Avalanche and mined a block that you know contains something that doesn't comply with what was decided by other land so what do you do do you often the block or do you accept it anyway or like what what's happening there so that's the first question the second one is have you considered two other set of participant in there such as I can imagine big-big payment processor or large exchanges or like generally big business in the space would be interested in participating in that consensus algorithm so I think the first question was what happens if a miner decides to mine a block that goes against the Avalanche protocol yes yes right so under the assumption that the the set of miners that do such a thing are minority they will be orphaned over time of course if it's like 50 they will never be or you will always have like theoretically this is this equal generation of blocks but if it's a minority then it will be orphan pretty quickly so I think I think the simple answer is this this should be a sophomore and and if it's a soft fork and people who don't obey the protocol will get their blocks Ortman now we can solve it we can make it a soft soft look or something like that soft cubed one in the sense that there are if you mind if you mind a block and there are transactions in it that the Avalanche or whatever the pre consensus protocol has not seen then no harm done and that's okay too it's only a problem if if the pre consensus protocol indicated to the world that Elvis was going to get paid and then you went ahead and mining the block that's the opposite in that case nor a malicious miner and you've now mind the payment for Bob instead of Alice and everybody else was expecting for the last ten minutes that now isn't going to get depend so you're doing something really hokey and bad in that case the hash majority should not respect your block and say look this was a you did not do this properly and we're going to have to to reject this and go back to our strong guarantees for zero comp transactions yeah and what was the second question by the way I wasn't able to follow okay yeah so first question great answer the second question is so you need a civil resistant mechanism for avalanche to participate in avalanche and you guys are proposing to use proof-of-work for that so that miner can participate and what I wanted to ask is have you thought about using different mechanism such as maybe coinage or or whatever else so that other big network participant can participate so I can imagine that a merchant processor like bit pay for instance would be interested in in participating in such protocol so the question is are the mechanisms besides proved of work to use for civil yes protection yes well I mean there are proof of stake mechanisms but not necessarily that you wouldn't eat them in such a case you could potentially use the underlying proof of work mechanism or the chain to get a sense of who the miners are or but differently yes absolutely there are many many different ways of doing anti-civil mechanisms in the other coin we are building we are exploring proof of stake but if one wanted to use this with Bitcoin - the way to do it would be to take advantage of the lovely lovely blockchain and how mechanism underneath so chains like steak and barley and you switch the lava cone it has a bunch of other benefits in particular there is no energy expenditure you get rid of the miners entirely and you know and there was no leak of value from system etc etc I could go on to describe why of a coin I think has some amazing futures as well but Bitcoin - good they love the mining it's like the users are you know I understand it this is what what people like and cutting out the miners I think is the non-starter for this particular application if you wanted to use avalanche for pre-owned census you would take advantage of the existing complication okay thank you we're moving on to one one final question I'm just curious if this would effectively kill as PV mining so I already can't hear your sorry can you speak up a little bit I'm sorry would this disable SPV mining I think would it be impossible to mine empty blocks III cannot I cannot hear I think the question without empty blocks Kevin oh okay well okay yeah go ahead would this disabled and blue mining empty blocks are you asking are empty blocks allowed to be mined yeah certainly sure if that that means the empty transactions are required to be placed in the block and like agreed upon by the Pegasus's I think in general all right there are many good reasons to allow any blocks so miners have crashes their databases get out of sync they find themselves in a bind they are not going to turn off the you guys have anybody who's ever rebooted a miner knows how stressful that is for the machinery as well so it's a dumb idea I think to try to try to get rid of them and and I think it's it's it's okay to have somebody mine an empty block that doesn't cause a merchant to lose money I agree you wanted to if you wanted to view that generally we must help the the confirmation process they help the security of the network SPV mining is something I'm a Korean fan of but it's actually good for the network so so all of those things are fine and I don't see a big problem with them in some circles sometimes people get really upset and that I think in a Bitcoin cash domain one does have to worry about some kind of a bad my mother who persistently and a very long time empty blocks and if you guys are worried about that one could potentially come up with mechanisms to fix it that will be in the conference of recompenses mechanism so I'm happy to have that conversation as well but it has very little in fact nothing to do with pre consensus so fixing that that issue or that vulnerability if you will yeah it's it's something we can contemplate luckily it's something we haven't seen even or Bitcoin cash is only what six percent of the Bitcoin measure we can come we can explore it if you like but it's a completely independent of n village yeah and to kind of give like summarization what the precursor gives you is for search transactions whether that transaction will be placed in block and or not and it gives you quick finality for that question there might be other empty transactions place in the block and that's okay because you don't have to agree on those but as long as you agree on the actual transfer of ownership transactions that's fine yeah one second what do you mean with empty transactions what's that mean just fill up the block so you can have a l'espace Bob one transaction in the block four block in and the rest can all be empty if there's no more complications you guys have to understand that Kevin is this kind of a mathematician so yeah the standard terminology so Kevin everything such thing as an empty transaction okay well I'm just saying you can fill it up with this is that yeah yeah I got it got it I got it okay okay thank thank you very much again to the to the two of you for getting up this early in the morning and should we give them around once again I love you guys enjoy Italy thank you thank you for that but thank you bye guys [Music]