27 research outputs found
Fait Accompli Committee Selection:Improving the size-security tradeoff of stake-based committees
We study the problem of committee selection in the context of proof-of-stake consensus mechanisms or distributed ledgers. These settings determine a family of participating parties-each of which has been assigned a non-negative “stake”-and are subject to an adversary that may corrupt a subset of the parties. The challenge is to select a committee of participants that accurately reflects the proportion of corrupt and honest parties, as measured by stake, in the full population. The trade-off between committee size and the probability of selecting a committee that over-represents the corrupt parties is a fundamental factor in both security and efficiency of proof-of-stake consensus, as well as committee-run layer-two protocols. We propose and analyze several new committee selection schemes that improve upon existing techniques by adopting low-variance assignment of certain committee members that hold significant stake. These schemes provide notable improvements to the size-security trade-off arising from the stake distributions of many deployed ledgers
Tight consistency bounds for Bitcoin
We establish the optimal security threshold for the Bitcoin protocol in terms of adversarial hashing power, honest hashing power, and network delays. Specifically, we prove that the protocol is secure if [ra < 1/I"0 + 1/rh,,] where rh is the expected number of honest proof-of-work successes in unit time, ra is the expected number of adversarial successes, and no message is delayed by more than I"0 time units. In this regime, the protocol guarantees consistency and liveness with exponentially decaying failure probabilities. Outside this region, the simple private chain attack prevents consensus. Our analysis immediately applies to any Nakamoto-style proof-of-work protocol; in the full version of this paper we also present the adaptations needed to apply it in the proof-of-stake setting, establishing a similar threshold there
Stake Shift in Major Cryptocurrencies: An Empirical Study
In the proof-of-stake (PoS) paradigm for maintaining decentralized,
permissionless cryptocurrencies, Sybil attacks are prevented by basing the
distribution of roles in the protocol execution on the stake distribution
recorded in the ledger itself. However, for various reasons this distribution
cannot be completely up-to-date, introducing a gap between the present stake
distribution, which determines the parties' current incentives, and the one
used by the protocol. In this paper, we investigate this issue, and empirically
quantify its effects. We survey existing provably secure PoS proposals to
observe that the above time gap between the two stake distributions, which we
call stake distribution lag, amounts to several days for each of these
protocols. Based on this, we investigate the ledgers of four major
cryptocurrencies (Bitcoin, Bitcoin Cash, Litecoin and Zcash) and compute the
average stake shift (the statistical distance of the two distributions) for
each value of stake distribution lag between 1 and 14 days, as well as related
statistics. We also empirically quantify the sublinear growth of stake shift
with the length of the considered lag interval. Finally, we turn our attention
to unusual stake-shift spikes in these currencies: we observe that hard forks
trigger major stake shifts and that single real-world actors, mostly exchanges,
account for major stake shifts in established cryptocurrency ecosystems.Comment: 20 pages, 8 figures, 2 tables, paper accepted for publication at
Financial Cryptography and Data Security 2020 (FC 2020, see
https://fc20.ifca.ai
Ledger combiners for fast settlement
Blockchain protocols based on variations of the longest-chain rule—whether following the proof-of-work paradigm or one of its alternatives—suffer from a fundamental latency barrier. This arises from the need to collect a sufficient number of blocks on top of a transaction-bearing block to guarantee the transaction’s stability while limiting the rate at which blocks can be created in order to prevent security-threatening forks. Our main result is a black-box security-amplifying combiner based on parallel composition of m blockchains that achieves Θ(m) -fold security amplification for conflict-free transactions or, equivalently, Θ(m) -fold reduction in latency. Our construction breaks the latency barrier to achieve, for the first time, a ledger based purely on Nakamoto longest-chain consensus guaranteeing worst-case constant-time settlement for conflict-free transactions: settlement can be accelerated to a constant multiple of block propagation time with negligible error. Operationally, our construction shows how to view any family of blockchains as a unified, virtual ledger without requiring any coordination among the chains or any new protocol metadata. Users of the system have the option to inject a transaction into a single constituent blockchain or—if they desire accelerated settlement—all of the constituent blockchains. Our presentation and proofs introduce a new formalism for reasoning about blockchains, the dynamic ledger, and articulate our constructions as transformations of dynamic ledgers that amplify security. We also illustrate the versatility of this formalism by presenting robust-combiner constructions for blockchains that can protect against complete adversarial control of a minority of a family of blockchains
Tight Bounds for Keyed Sponges and Truncated CBC
We prove (nearly) tight bounds on the concrete PRF-security of
two constructions of message-authentication codes (MACs):
(1) The truncated CBC-MAC construction, which operates as
plain CBC-MAC (without prefix-free encoding of messages), but
only returns a subset of the output bits.
(2) The MAC derived from the sponge hash-function family by
pre-pending a key to the message, which is the de-facto standard
method for SHA-3-based message authentication.
The tight analysis of keyed sponges is our main result
and we see this as an important step in validating SHA-3-based
authentication before its deployment. Still, our analysis crucially
relies on the one for truncated CBC as an intermediate step of
independent interest. Indeed, no previous security analysis of
truncated CBC was known, whereas only significantly weaker bounds have
been proved for keyed sponges following different approaches.
Our bounds are tight for the most relevant ranges of parameters, i.e.,
for messages of length (roughly)
blocks, where is the state size and is the desired output
length; and for queries. Our proofs rely on a novel
application of Patarin\u27s H-coefficient method to iterated MAC
constructions
Practical Settlement Bounds for Longest-Chain Consensus
Nakamoto\u27s longest-chain consensus paradigm now powers the bulk of the world\u27s cryptocurrencies and distributed finance infrastructure. An emblematic property of longest-chain consensus is that it provides probabilistic settlement guarantees that strengthen over time. This makes the exact relationship between settlement error and settlement latency a critical aspect of the protocol that both users and system designers must understand to make informed decisions. A recent line of work has finally provided a satisfactory rigorous accounting of this relationship for proof-of-work longest-chain protocols, but those techniques do not appear to carry over to the proof-of-stake setting.
This article develops explicit, rigorous settlement bounds for proof-of-stake longest-chain protocols, placing them on equal footing with their proof-of-work counterparts. Our techniques apply with some adaptations also to the proof-of-work setting where they provide improvements to the state-of-the-art settlement bounds for proof-of-work protocols
Tight Consistency Bounds for Bitcoin
We establish the optimal security threshold for the Bitcoin protocol
in terms of adversarial hashing power, honest hashing power, and
network delays. Specifically, we prove that the protocol is secure if
where is the expected number of honest proof-of-work successes
in unit time, is the expected number of adversarial successes, and
no message is delayed by more than time units. In this
regime, the protocol guarantees consistency and liveness with
exponentially decaying failure probabilities. Outside this region, the
simple private chain attack prevents consensus.
Our analysis immediately applies to any Nakamoto-style proof-of-work protocol;
we also present the adaptations needed to apply it in the proof-of-stake setting,
establishing a similar threshold there
Practical Settlement Bounds for Proof-of-Work Blockchains
Nakamoto proof-of-work ledger consensus currently underlies the majority of deployed cryptocurrencies and smart-contract blockchains. While a long and fruitful line of work studying the provable security guarantees of this mechanism has succeeded to identify its exact security region---that is, the set of parametrizations under which it possesses asymptotic security---the existing theory does not provide concrete settlement time guarantees that are tight enough to inform practice.
In this work we provide a new approach for obtaining concrete and practical settlement time guarantees suitable for reasoning about deployed systems. We give an efficient method for computing explicit upper bounds on settlement time as a function of primary system parameters: honest and adversarial computational power and a bound on network delays. We implement this computational method and provide a comprehensive sample of concrete bounds for several settings of interest. We also analyze a well-known attack strategy to provide lower bounds on the settlement times. For Bitcoin, for example, our upper and lower bounds are within 90 seconds of each other for 1-hour settlement assuming 10 second
network delays and a 10% adversary. In comparison, the best prior result has a gap of 2 hours in the upper and lower bounds with the same parameters