Blockchains
Overview & Applications

Roger Wattenhofer

ETH Zurich – Distributed Computing Group2008

Blockchain

Blockchain Basics

Transaction

Transaction

Transaction

Transaction

Block

Blockchain

Blockchain is Replicated

Blockchain
Distributed Systems & Cryptography(1982)(1976)

Rule of Thumb
Blockchain

Blockchains* may disrupt yourbusiness if you use signatures.

Distributed Systems & Cryptography
Fault-Tolerance & Digital Signatures*or blockchain-like tech

Blockchain Variants

Permissionless / Open

Permissioned / Closed

no

No Blockchain(use Database)noPermissionless
Blockchain

yes

Permissioned
Blockchain

The Seven Blockchain Dimensions
PrivacyMultiple
Participants?
yes
Writers
Known?

EnergyPersistence

Blockchain

Blockchain

Persistence

Fault-Tolerance

Speed

Throughput

Database

Correct

1 hour

10 tx/s

Immutable

Crash

1 minute

10k tx/s

Provable

Byzantine

1 second

10m tx/s

Blockchain
Scalability
10 nodesEnergy Consumption

100 nodes
1000 nodes

Economic Incentives
Market Ȁ Energy Value ൎ 12 GW$1M/h$0.08/kWhPrivacy

The Seven Blockchain Dimensions

Proof of WorkHashrate ȉ Energy/Hash ൎ 1.3 GWͳ͵ ȉ ͳͲଽ GH/s
0.1 J/GH

What About Privacy?

PersistenceIt’s Complicated.

EnergyPrivacy
Anonymity/Public

Identity/Private

Applications

eMoneyBitcoineMoneyAnonymity

Accountability

Open/Anarchic

Closed/Private

Blockchain

Paxos, PBFT, …

Eventual Consistency

Strong Consistency

Proof-of-Work

Central BanksPermissioned Blockchain
Permissioned Blockchain&
Payment Network

Payment Network

eVotingWhat’s Wrong with Paper?

Cost

Verifiability

Anonymity
Identity Swapper
Identity Mixer…

Election Help

Democracy Beyond Yes or No
2025

Wie viel sollen die SRG-Gebühren pro Jahr kosten?

42.Thank You!
Questions & Comments?

Don’t bring a Blockchain
to a Gunfightwww.disco.ethz.ch

/E<YQ[O QjE]Q[!QEg]d<sZI[j P<[[IY"Ijq]gXh.]OIg7<jjI[P]NIg

0;kgQEP QhjgQDkjIG ]ZdkjQ[O qqqGQhE]IjPvEP

0Ir+]Q[jN][jhkhIGQ[!
.I<GjPI0Ir+]Q[jZ<[k<YDIN]gIs]kGIYIjIjPQhD]r$$$$$<[ QjE]Q[DI<.I<Y kggI[Es

0PI Y]EXEP<Q[

7UDQVDFWLRQ

7UDQVDFWLRQ

7UDQVDFWLRQ

7UDQVDFWLRQ

7UDQVDFWLRQ

7UDQVDFWLRQ

7UDQVDFWLRQ

7UDQVDFWLRQ

7UDQVDFWLRQ

7UDQVDFWLRQ

7UDQVDFWLRQ







7UDQVDFWLRQ

0%PLQ

PLQpO0rIIQ[IEÃÁÂÈà¹ÆÁkhj P<[OI+<g<ZIjIgh

+g]d<O<jQ][/dIIG

Y]EXEP<Q[]gXh%ORFNSURSDJDWLRQ



%ORFN


>'HFNHU:@3')

WKSHUFHQWLOHWKSHUFHQWLOH













7LPHVLQFHILUVWREVHUYDWLRQ>V@





%ORFN

[EgI<hQ[O+g]d<O<jQ][/dIIG

/Z<YY[Ijq]gXGQ<ZIjIg
khjpIgQNsDY]EXPI<GIghDIN]gId<hhQ[O][.IkhIjg<[h<EjQ][h<YgI<GsX[]q[]IhQjIYd

"]j.I<YYs/jQYYYIhhjP<[¥g]kOPYs¦ÂÁÁjrh
6Qh<ÆÇÁÁÁjrh!QEg]d<sZI[jhk[G<ZI[j<Y/E<Y<DQYQjs+g]DYIZ
pIgs"]GI/IIhpIgs/Q[OYI0g<[h<EjQ][

+<sZI[j"Ijq]gX+<sZI[j"Ijq]gXh0 r<ZdYI¥hIYYhj]¦Ä/I[GZ][IsQNg
QhX[]q[<jjQZIÅ<hPIG0QZIY]EXIG ][jg<Ej¥0 ¦È1hI
hIEgIjg
j]<EEIhhO]]GÅ/I[GZ][IsQNg
QhX[]q[<jjQZIÄÇ/I[GZ][IsQNg
QhX[]q[<jjQZIÂÆ/I[GZ][IsQNg
QhX[]q[<jjQZIÃÂI[Ig<jI
g<[G]Z
hIEgIjgÃ/I[GP<hP¥g¦j]

/Q[OYI]dQ["Ijq]gX

kdYIr!QEg]d<sZI[j P<[[IYh¥r<ZdYIN]g/Z<gj ][jg<Ej¦

kdYIr!QEg]d<sZI[j P<[[IYkdYIr!QEg]d<sZI[j P<[[IY



7 










kdYIr!QEg]d<sZI[j P<[[IYkdYIr!QEg]d<sZI[j P<[[IY%ORFNFKDLQ%ORFNFKDLQ




7 

7 
















kdYIr!QEg]d<sZI[j P<[[IYkdYIr!QEg]d<sZI[j P<[[IY%ORFNFKDLQ%ORFNFKDLQ




7 

7 


















7 



7 




P<[[IYZkhjDIgI[IqIG]NjI[>'HFNHU:@kdYIr!QEg]d<sZI[j P<[[IYkdYIr!QEg]d<sZI[j P<[[IY%ORFNFKDLQ
ǹ7 
ǹ7 

ǹ7 



ǹ7 

ǻ7 




ǹ7 
ǹ7 



ǹ7 




ǹ7 

ǻ7 

ǹ7 

ǹ7 



ǹ7 

ǹ7 
ǹ7 

.IY<jQpIjQZIY]EXhj]XIIdEP<[[IY<YQpIN]gIpIgǹ7 kj][YsÊÊjg<[h<EjQ][h>'HFNHU:@kdYIr!QEg]d<sZI[j P<[[IY0 .IpQhQjIG

ǹ7 
ǹ7 

ǹ7 



Y]EXEP<Q[

ǹ7 

0ÞÂÁÁ


ǹ7 
ǹ7 
ǹ7 



ǹ7 

/IjjYIZI[j0g<[h<EjQ][

ǹ7 



ǹ7 
ǹ7 

ǹ7 
ǹ7 
ǹ7 




Å/I[GZ][IsQNg
QhX[]q[<jjQZIÄ

0ÞÊÊ




E<[DIhdI[jDsDYkIqQjPhIEgIjg]g
DsOgII[<NjIgÄG<sh0 .IpQhQjIGY]EXEP<Q[

0ÞÂÁÁ




/LJKWQLQJ1HWZRUN




0ÞÊÊ






E<[DIhdI[jDsDYkIqQjPhIEgIjg]g
DsOgII[<NjIgÄG<sh



0ÞÊÉ

Å/I[GZ][IsQNg
QhX[]q[<jjQZIÄ

QOPj[Q[O"Ijq]gX P<[[IY

QOPj[Q[O"Ijq]gX P<[[IY$q[IGDs$q[IGDsÆj]OgII[<NjIgÆÁÁDY]EXh]gÆj]DYkIQ[hj<[jYsqQjPhIEgIjhO

Æj]OgII[<NjIgÆÁÁDY]EXh]gÆj]DYkIQ[hj<[jYsqQjPhIEgIjhO$q[IGDsÆj]DYkI<NjIgÆÁÁDY]EXh]gÆj]OgII[Q[hj<[jYsqQjPhIEgIjhDÆj]DYkI<NjIgÆÁÁDY]EXh]gÆj]OgII[Q[hj<[jYsqQjPhIEgIjhD$q[IGDs$q[IGDsÅj]OgII[<NjIgÆÁÁDY]EXh]gÅj]DYkIQ[hj<[jYsqQjPhIEgIjhO>3RRQ'U\MD@>3RRQ'U\MD@$q[IGDsÇj]DYkI<NjIgÆÁÁDY]EXh]gÇj]OgII[Q[hj<[jYsqQjPhIEgIjhD

QOPj[Q[O"Ijq]gX P<[[IY

QOPj[Q[O"Ijq]gX P<[[IY$q[IGDs$q[IGDsÆj]OgII[<NjIgÆÁÁDY]EXh]gÆj]DYkIQ[hj<[jYsqQjPhIEgIjhO







Æj]DYkI<NjIgÆÁÁDY]EXh]gÆj]OgII[Q[hj<[jYsqQjPhIEgIjhD$q[IGDs

$q[IGDs$q[IGDs$q[IGDsÅj]OgII[<NjIgÆÁÁDY]EXh]gÅj]DYkIQ[hj<[jYsqQjPhIEgIjhOÅj]OgII[<NjIgÆÁÁDY]EXh]gÅj]DYkIQ[hj<[jYsqQjPhIEgIjhO>3RRQ'U\MD@$q[IGDsÇj]DYkI<NjIgÆÁÁDY]EXh]gÇj]OgII[Q[hj<[jYsqQjPhIEgIjhD

6ROYHG">3RRQ'U\MD@$q[IGDsÇj]DYkI<NjIgÆÁÁDY]EXh]gÇj]OgII[Q[hj<[jYsqQjPhIEgIjhD

6WLOO7RR0DQ\&KDQQHOV"<EP<[GpIgs P<[[IY<EP<[GpIgs P<[[IY«[IIGhjq]jg<[h<EjQ][h][DY]EXEP<Q[«[IIGhjq]jg<[h<EjQ][h][DY]EXEP<Q[ÃÁÁÉÁÁ!EP<[[IYh][Ys«P<hY]EXIGQ[Nk[GhDsD]jPd<gjQIh«P<hY]EXIGQ[Nk[Gh<YYZsDQjE]Q[h<gIY]EXIGQ[«h<G

Y]EXEP<Q[/d<EI]EXIGk[Gh""Y]EXEP<Q[hd<EI䍙[kZDIg]NhQO[<jkgIh""

VRIDUVLJQDWXUHVIRUHYHU\FKDQQHOk[GQ[O/IjjYIZI[j[]GIq<[jhj]Z<XIE][[IEjQ][h«7PIgIG]IhQjY]EXjPINk[Gh!kYjQ <sIg"Ijq]gXh!kYjQ <sIg"Ijq]gXh



0ÞÂÁÁ


ǹ0ÞÂÁÁ

0ÞÂÁÁ














§ kgEPIgj7ÃÁÂÈ¨









&KDQQHOIXQGLQJOD\HU

ǹ0ÞÊÊ





0ÞÊÊ



















§ kgEPIgj7ÃÁÂÈ¨





0ÞÊÊ






3D\PHQWQHWZRUNOD\HU!kYjQ <sIg"Ijq]gXhǹ0ÞÂÁÁ

!kYjQ <sIg"Ijq]gXhǹ0ÞÂÁÁ


























ǹ0ÞÊÊ












/IjjYIZI[j0g<[h<EjQ][







§ kgEPIgj7ÃÁÂÈ¨





ǹ0ÞÊÊ















/IjjYIZI[j0g<[h<EjQ][







Ejk<YEP<[[IYh[IpIggI<EPjPI
DY]EXEP<Q[§ kgEPIgj7ÃÁÂÈ¨Y]EXEP<Q[0g<[h<EjQ][hÅhQO[<jkgIhdIg
EP<[[IY]YG:KDW(OVHLV1HHGHG"

[Iq





















ÃhQO[<jkgIhdIgkhIg
Q[GIdI[GI[j]NEP<[[IYh/dI[GQ[ONg]Z1[hQO[IG0g<[h<EjQ][h/dI[GQ[ONg]Z1[hQO[IG0g<[h<EjQ][hY]EXEP<Q[

Y]EXEP<Q[





0ÞÂÁÁ

0ÞÂÁÁ
















.INIgI[EIDs0g<[h<EjQ][<hP]N
dgIpQ]khjg<[h<EjQ][«.INIgI[EIDs0g<[h<EjQ][<hP]N
dgIpQ]khjg<[h<EjQ][«

Q[EYkGIhhQO[<jkgIhQ[EYkGIhhQO[<jkgIh

7I[IIGj]Z]pIjPIhQO[<jkgIh]kj]NjPIjg<[h<EjQ][$UH:H)LQDOO\'RQH""²$GGUHVVLQJ7UDQVDFWLRQ0DOOHDELOLW\0W*R[KDVGHWHFWHGXQXVXDODFWLYLW\
RQLWV%LWFRLQZDOOHWVDQGSHUIRUPHGLQYHVWLJDWLRQVGXULQJWKHSDVW
ZHHNV7KLVFRQILUPHGWKHSUHVHQFHRIWUDQVDFWLRQVZKLFKQHHGWREHH[DPLQHG
PRUHFORVHO\

7KH0W*R[,QFLGHQW
 -XO\)LUVWWUDGHRQ0W*R[
 7UDQVDFWLRQPDOOHDELOLW\LGHQWLILHGDVORZSULRULW\LVVXH )HEUXDU\0W*R[KDOWVZLWKGUDZDOV )HEUXDU\0W*R[FLWHVWUDQVDFWLRQPDOOHDELOLW\DVURRWFDXVH )HEUXDU\0W*R[ILOHVIRUEDQNUXSWF\
0W*R[FODLPVWKDWELWFRLQV PLOOLRQ86' ZHUHORVWGXHWRWUDQVDFWLRQPDOOHDELOLW\

6LJQDWXUHV DIEEGHIE
H
7KHUHDUHPXOWLSOHZD\VWRVHULDOL]HDVLJQDWXUH 0XOWLSOHSXVKRSHUDWLRQV E\WHE\WHE\WH
 1RQFDQRQLFDO'(5HQFRGLQJV
 3DGGLQJ 

7UDQVDFWLRQ0DOOHDELOLW\$WWDFN

7UDQVDFWLRQ0DOOHDELOLW\$WWDFN

5HG

7;

7;

7UDQVDFWLRQ0DOOHDELOLW\$WWDFN,QFLGHQW7LPHOLQH&XPXODWLYHPDOOHDEOHGRXEOHVSHQGV

ELWFRLQV

7;"
5HIXQG


QG3UHVV5HOHDVH










YDOXH







E
)H

QXPEHU




E
)H





E
)H





E
)H

%7&





E
)H














E
E
E
E
E
)H
)H
)H
)H
)H

>'HFNHU:@WUDQVDFWLRQV

VW3UHVV5HOHDVH



!<YYI<DQYQjs!<YYI<DQYQjs




7 

7 
















gII[dkjh<[]jPIghQO[<jkgI][jPIjg<[h<EjQ][«
[Iqjg<[h<EjQ][!<YYI<DQYQjs


7 






gII[dkjh<[]jPIghQO[<jkgI][jPIjg<[h<EjQ][«
[Iqjg<[h<EjQ][%ORFNFKDLQ+RZLVWKLVIL[HG"

/IOgIO<jIG7Qj[Ihh/kZZ<gs

[jg]GkEI<[IqjsdI]Njg<[h<EjQ][/QO[<jkgIh<gIhId<g<jIGNg]ZjPIgIhj/]NjN]gXE]Zd<jQDYIIE<ZI<EjQpI<h +ÂÅÂQ[kOkhjÃÁÂÈ/]NjN]gXhph<gGN]gXh

0P<[Xs]k

-kIhjQ][h/]NjN]gXƔ $YGZQ[Igh<EEIdjDY]EXh]NjPI[IqZQ[IghƔ "IqZQ[IghgIWIEjh]ZIDY]EXhàN[IqZQ[Igh<gIZ<W]gQjsIpIgs][IZQ[Ih][jPIh<ZIEP<Q[
<gGN]gX0;kgQEP QhjgQDkjIG ]ZdkjQ[Og]kd qqqGQhE]IjPvEP

0P<[Xhj]
PgQhjQ<[IEXIg][g<G kgEPIgj

Ɣ "IqZQ[IghgIWIEj]YGDY]EXhƔ $YGZQ[IghgIWIEj[IqDY]EXhà0q]DY]EXEP<Q[hIrQhj

/]NjN]gXh$YGZQ[Igh<EEIdjDY]EXh]NjPI[IqZQ[Igh

Economy and Other Problems$YGZQ[Igh<gIZ<W]gQjs

ROG

ROG

QHZ

QHZ

ROG

ROG

ROG

(YHU\RQH
VZLWFKHVKHUH

QHZ(YHU\RQH
VZLWFKHVKHUH"IqZQ[Igh<gIZ<W]gQjs

Roger Wattenhofer
QHZ

QHZ

(Thanks to Maurice Herlihy for some colorful slides)
ETH Zurich – Distributed Computing Group

Hello World!

timingcrashesomission
Byzantine

Now solve
consensus

Classical Adversary
3The Market

meltdownЗдравствуйте!

spectre• Cryptocurrencies are a new asset class, worth >$100B– Hundreds of currencies

re-entrancy• $1.4B invested in startups, as of Jan 2017

• Billions of value in ICOs

zero-day• Black Hats Meet White Hats

Now hold
an election– Dark net market operators & Bank of England at the same conferences• Social movement– Hodlgang!

Modern Adversary

Hype“First practical solution to alongstanding problem in computerscience, Byzantine Generals.”4… and Criticism“A non-deliberate Ponzi scheme”“It’s yet another eventuallyconsistent database”“Satoshi solved a problem that
academic computer scientists thought“Flawed technology, inherently
was impossible”
limited in scale and performance”“Bitcoin is digital gold, it will put usback onto a sound monetary policy”“Unlikely to impact the financesector”“Bitcoin will end wars”

What is Money?

BTC in USD

Fungibility?

=

Inflation

Magic Numbers

Inter-block time &difficulty adjustment
window

Monetary Policy:
deflationary,hoarding not
spending

Limits on block &transaction size
(fighting words)
Dogecoin:harmonicallydiminishing inflation
Freicoin: constantinflation
17

What is Money?

What is Money?

Smart Contracts

20

21

I am willing toallow this party …

… to withdraw
this amount …

Standard for tradeable tokens
Widely used for ICOs
Market cap about $40 Billion

22… from myaccount.

23

Aliceauthorizes
Bobtowithdraw
$100

Alice

Alice

Alice
authorizes
Bobtowithdraw$100
I am Bob’s
secret friend

miner

Bob

Miner, please change Bob’s
authorizationAliceto $50Miner, please change Bob’s
authorizationAliceto $50

aauthorizes
uthorizes
Bobtowithdraw
$100

Alice
ce

miner

Bob

Alice
ce
!!!

aauthorizes
uthorizes
Bobtowithdraw
ithd
$100

!!!

Bob

miner

Bob

miner

Miner, please change Bob’s
authorizationAliceto $50Miner, please change Bob’s
authorizationAliceto $50

aauthorizesuBob
to Bobwithdraws
withdraw
w
$100
$100

Alice
ce

aauthorizes
Bob
to Bobwithdraws
withdraw
w
$100
$100

Alice
ce

Heh-heh…

Heh-heh…

miner

Bob

Miner, please change Bob’s
authorizationAliceto $50

Alicece
Got $100Bobaauthorizes
u
Bob
Alice
to Bobauthorizes
withdraws
w
withdraw
w
Bob
$100
$100
to
withdraw
$50
miner

miner

Bob

Miner, please change Bob’s
authorizationAliceto $50

Alicece
Got $150

Bob

aauthorizes
Bob
Alice
Ali
to Bobau
authorizes
withdraws
w
withdraw
w
Bob
$100
Bob
ob
b Heh-heh…
$100
towithdraws
draawswithdraw
$50
$5
50
$50
miner

What makes a transaction valid?

relay

When miners say so.

developer hodler

user miner

Canonicalism: all and only what
Satoshi revealed.
Fails to explain upgrades …
… and bug fixes.
35

Example: Corporate governanceDe facto governance by …
“Genesis” block“Core Bitcoin Devs”
Board of directors = Alice, Bob, and Carol
Commit access to bitcoindmajority vote of the board needed for
all governance decisions

Supported by the Bitcoin
Foundation
Controversy wrt block sizes, etc.
36

37

Example: Corporate governance

Example: Corporate governance

January

February

Carol resigns from board

Alice & Dave delegate to Ellenauthority over stock options

Alice & Bob vote to replace her with DaveEllen issues $10000 stock options to Fred

38

39

Logics of Incentives

Example: Corporate governanceHow to prove that Fred owns those options?
Notice that rules modify themselves …
Were rules in effect at the time followed?
Were the rule changes legitimate?
40

LICS 201641

Client behavior?

Small Game Fallacy

Altruistic: follows protocol
The dangerous illusion that clients’ objectivefunctions known to system designers

Rational: responds to incentives
Byzantine: vandalizes everything

42

43

Small-Game
Small
Game Fallacy:

Example: Selfish Mining
Bitcoin miners that withhold newly-mined blocks …

Sometimes earn disproportionate profits
Reduce own earnings, but …
Reduce others more!
Mining cartel might bully others
e intoers
in
nto joining
joini
44

45

Game Theory

Majority miner?
If one dishonest miner controls > 50% then …

Nakamoto claims: Bitcoin is stable aslong as miners follow own self-interest.

All islost!

Is compliance a Nash equilibrium?

Can roll back other transactions …
If so, do other equilibria
exist?

Censor transactions you don’t like…

Can non-compliant strategies
dominate compliance?

Not a good idea, if invested in Bitcoin
stability, reputation
46

What if miners collude?

48

Stability when rewards decline?
Models assume constant coinbase
rewardEffects of declining rewards? No rewards?

Miners could form cartel …
… to simulate evil majority
miner?
Stable? Would members defect?

Model real-world vs BTC profits?

Real issue: mining pools are a thing

Liquidity & exchange rates?

50

Sunk costs(ASICS)?

51

Feather-Forking
Goldfinger Attacks

Blackmail the chain

Intent to bring down Bitcoin, not profit“We refuse to mine on any chain that includes
Alice’s transaction in last k blocks”

Hostile state actor?
Protest?

If threat credible, rational miners
incentivized to blacklist Alice too

Short position?

“alt-coin infanticide” actually
happens
52

Mining pools

Pools can infiltrate other pools

53

Peer-to-Peer stability

Nodes have incentive not to sendtransactions to other nodes

Submit partial shares, withold complete blocks
Proposes reward scheme to fix incentive

2 pools: “Iterated prisoner’s dilemma”
Multiple Pools: tragedy ofthe commons54

Long-term stability of
Bitcoin network layer
uncertain55

Alternative
Computatonal
PuzzlesOnce, BTC mining
was done on
laptops

Now, mostly donewith ASICs

Not-outsourcablepuzzles …

Hard to compute
Easy to check

Alternative:“memory hard”
puzzles

Mining now requires
capitalization,
Deep pockets

Alternative
Computatonal
Puzzles

Memory-intensive
ASIC-resistant
56

57

Alternative
Computatonal
Puzzles

Proof of Stake… to thwart mining
pool formation

Random sample ofminers weighted bycurrent allocation of
wealthHarder to acquire
51% wealth than
51% hashpower?

Useful work puzzles
s…

Protein-folding,
SETI, prime number
sequences, etc.
58

No trees were
harmed in mining
this block59

Proof of Stake

Proof of Coin-Age:post transaction toself, weighted bytime

Post bond for good
behavior

DesignatedAuthority
Algorand: random beacon,
deterministic but unpredictable

Participants can prove they arechosenEthereum will switch
to proof-of-stakesometime soon (?)60

Unlikely too many dishonest chosen
61

Deanonymization
Multiple inputs to a transaction
usually reveal common ownership
Heuristics for identifying “change”
addresses

Once cluster identified,interact to learn identity
P2P network leaks
SPV nodes leak addresses of interest

62

Holders create series of transactions
which (privately) permute ownership63

Holders send transactions to 3rdparty mixer, receive transactions
back

Altcoins that use zero-knowledge
proofs for unlinkability
64

65

Payment Networks

Cross-chain swaps

Frequent, recurring transactions

Alice has alt-coin, wants bitcoin

Done off-chain, post summarytransactions infrequently

Bob has bitcoin, wants alt-coin

Better latency, throughput, privacy, etc.

Multiphase protocol
guarantees atomic swap
66

67

Thank You!
Questions & Comments?

www.disco.ethz.ch