|
|
@@ -15,47 +15,97 @@ consensus.
|
|
|
|
|
|
## Blockchain
|
|
|
|
|
|
-Blockchain $\mathbb{C}$ is a series of epochs: it's a tree of chains,
|
|
|
-$C_1$, $C_2$, $\dots$, $C_n$, the chain of the max length in $\mathbb{C}$
|
|
|
-is the driving chain C.
|
|
|
+Blockchain $\mathbb{C_{loc}}$ is a series of epochs: it's a tree of chains,
|
|
|
+$C^1$, $C^2$, $\dots$, $C^n$, the chain of the max length in $\mathbb{C_{loc}}$
|
|
|
+is the driving chain $C_{loc}$.
|
|
|
|
|
|
+Crypsinous Blockchain is built on top of Zerocash sapling scheme, and Ouroboros Genesis blockchain.
|
|
|
+Each part $U_p$ stores it's own local view of the Blockchain $C_{loc}^{U_p}$.
|
|
|
+$C_{loc}$ is a sequence of blocks $B_i$ (i>0), where each $B \in C_{loc}$
|
|
|
+$$ B = (tx_{lead},st)$$
|
|
|
+$$tx_{lead} = (LEAD,st\overrightarrow{x}_{ref},stx_{proof})$$
|
|
|
+$st\overrightarrow{x}_{ref}$ it's a vector of $tx_{lead}$ that aren't yet in $C_{loc}$.
|
|
|
+$stx_{proof}=(cm_{\prime{c}},sn_c,ep,sl,\rho,h,ptr,\pi)$
|
|
|
+the Blocks' $\emph{st}$ is the block data, and $\emph{h}$ is the hash of that data.
|
|
|
+the commitment of the newly created coin is:
|
|
|
+$(cm_{c_2},r_{c_2})=COMM(pk^{COIN}||\tau||v_c||\rho_{c_2})$,
|
|
|
+$\tau$ is the clock current time. \emph{$sn_c$} is the coin's serial number revealed to spend the coin.
|
|
|
+$$sn_c=PRF_{root_{sk}^{COIN}}^{sn}(\rho_c)$$
|
|
|
+$$\rho=\eta^{sk_{sl}^{COIN}}$$
|
|
|
+$\eta$ is is from random oracle evaluated at $(Nonce||\eta_{ep}||sl)$, $\rho$ is the following epoch's seed. $\emph{ptr}$ is the hash of the previous block, $\pi$ is the NIZK proof of the LEAD statement.
|
|
|
|
|
|
-## Epoch
|
|
|
+## st transactions
|
|
|
+the blockchain view is a chain of blocks, each block $B_j=(tx_{lead},st)$, while st being the merkle tree structure of the validated transactions received through the network, that include transfer, and public transactions.
|
|
|
|
|
|
-An epoch is a multiple of blocks. Some of those blocks might be empty
|
|
|
-due to the nature of the leader selection with VRF.
|
|
|
+## LEAD statement
|
|
|
+for $x=(cm_{c_2},sn_{c_1},\eta,sl,\rho,h,ptr,\mu_{\rho},\mu_{y},root)$, and
|
|
|
+$w=(path,root_{sk^{COIN}},path_{sk^{COIN}},\tau_c,\rho_c,r_{c_1},v,r_{c_2})$
|
|
|
+for tuple $(x,w) \in L_{lead}$ iff:
|
|
|
|
|
|
+ * $pk^{COIN} = PRF_{root_{sk}^{COIN}}^{pk}(\tau_c)$.
|
|
|
+ * $\rho_{c_2}=PRF_{root_{sk_{c_1}}^{COIN}}^{evl}(\rho_{c_1})$.
|
|
|
+ note here the nonce of the new coin is deterministically driven from the nonce of the old coin, this works as resistance mechanism to allow the same coin to be eligible for leadership more than once in the same epoch.
|
|
|
+ * $\forall i \in \{1,2\} : DeComm(cm_{c_i},pk^{COIN}||v||\rho_{c_i},r_{c_i})=T$.
|
|
|
+ * \emph{path} is a valid Merkle tree path to $cm_{c_1}$ in the tree with the root \emph{root}.
|
|
|
+ * \emph{$path_{sk^{COIN}}$} is a valid path to a leaf at position $sl-\tau_c$ in a tree with a root $root_{sk}^{COIN}$.
|
|
|
+ * $sn_{c_1}= PRF_{root_{sk}^{COIN}}^{sn}(\rho_{c_1})$
|
|
|
+ * $y = \mu_{y}^{root_{sk_{c_1}}^{COIN}||\rho_c}$
|
|
|
+ * $\rho = \mu_{\rho}^{root_{sk_{c_1}}^{COIN}||\rho_c}$
|
|
|
+ * $y< ord(G)\phi_f(v)$
|
|
|
+note that this process involves renewing the old coin $c_1$ who's serial number gets revealed(proof of spending), becoming an input, to $c_2$ of the same value,
|
|
|
|
|
|
-## Genesis block
|
|
|
|
|
|
-The first block in the epoch updates the stake for stakeholders, which
|
|
|
-influences the weighted random leader selection algorithm. For epoch j,
|
|
|
-the pair ($S_j,\eta_j$) is the genesis block's data for n stakeholders
|
|
|
-of the blockchain:
|
|
|
+## transfer transaction $tx_{xfer}$
|
|
|
+transfer transaction of the pouring mechanism of input: old coin, and public coin, with output: new return change coin, and further recipient coin. such that input total value $v^{old}_1 + v_{pub} = v^{new}_3 + v^{new}_4$
|
|
|
+$$ tx_{xfer} = (TRANSFER,stx_{proof},c_r)$$
|
|
|
+$$stx_{proof} = (\{cm_{c_{3}}),cm_{c_{4}}\}),(\{sn_{c_2},{sn_{c_1}}\}),\tau,root,\pi)$$
|
|
|
+$c_r$ is forward secure encryption of $stx_{rcpt}=(\rho_{c_3},r_{c_3},v_{c_3})$ to $pk_r$.
|
|
|
+the commitment of the new coins $c_3$, $c_4$ is:
|
|
|
+$$(cm_{c_3},r_{c_3})=Comm(pk_{pk_s}^{COIN}||\tau||v_{c_3}||\rho_{c_3})$$
|
|
|
+$$(cm_{c_4},r_{c_4})=Comm(pk_{pk_r}^{COIN}||\tau||v_{c_4}||\rho_{c_4})$$
|
|
|
|
|
|
-$$
|
|
|
-S_j=((U_1,v_1^{vrf},v_1^{kes},v_1^{dsig},s_1),\dots,(U_n,v_n^{vrf},v_n^{kes},v_n^{dsig},s_n)
|
|
|
-$$ $$ \eta_j \leftarrow \{0,1\}^\lambda $$
|
|
|
+### spend proof
|
|
|
+the spend proofs of the old coins $sn_{c_1},sn_{c_2}$ are revealed.
|
|
|
|
|
|
-<sup><strong>Note that new stakeholders need to wait for the next epoch
|
|
|
-to be added to the genesis block</strong></sup>
|
|
|
+### NIZK proof $\pi$
|
|
|
+for the circuit inputs, and witnesses
|
|
|
|
|
|
-## Block
|
|
|
+\begin{math}
|
|
|
+x = (\{cm_{c_3},cm_{c_4}\},\{sn_{c_1},sn_{c_2}\},\tau,root) \\
|
|
|
+w = (root_{sk_{c_1}^{COIN}},path_{sk_{c_1}^{COIN}},root_{sk_{c_2}^{COIN}},path_{sk_{c_2}^{COIN}},pk_{c_3}^{COIN},pk_{c_4}^{COIN},(\rho_{c_1},r_{c_1},v_1,path_1),(\rho_{c_2},r_{c_2},v_2,path_2),
|
|
|
+\\(\rho_{c_1},r_{c_1},v_1,path_1))
|
|
|
+\end{math}
|
|
|
+
|
|
|
+$\pi$ is a proof for the following transfer statement using zerocash pouring mechanism.
|
|
|
+
|
|
|
+$$\forall_i \in \{1,2\}: pk_{c_i}^{COIN} = PRF_{root_{sk_{c_i}}^{COIN}}^{pk}(1)$$
|
|
|
+$$\forall_i \in \{1,\dots,4\} : DeComm(cm_{c_i},pk_{c_i}^{COIN}||v_i||\rho_{c_i},r_{c_i})=T$$
|
|
|
+$$v_1+v_2=v_3+v_4$$
|
|
|
+
|
|
|
+$$path_1\text{ is a valid path to } cm_{c_1} \text{ in a tree with the root} \emph{ root}$$
|
|
|
+
|
|
|
+$$path_2\text{ is a valid path to } cm_{c_2} \text{ in a tree with the root} \emph{ root}, sn_{c_2}=PRF_{root_{sk_{c_1}^{COIN}}}^{zdrv}(\rho_{c_1})$$
|
|
|
+
|
|
|
+$$path_{sk_{c_i}^{COIN}} \text{ is a valid path to a leaf at position } \tau \text{ in }, root_{sk_{c_i}^{COIN}} i \in \{1,2\}$$
|
|
|
+
|
|
|
+$$sn_{c_i}=PRF_{root_{sk_{c_i}^{COIN}}}^{sn}(\rho_{c_i}), \forall_i \in \{1,2\}$$
|
|
|
+
|
|
|
+# toward better decentralization in ouroboros
|
|
|
+
|
|
|
+the randomization of the leader selection at each slot is hinged on the random $y$, $\mu_y$, $\rho_c$, those three values are dervied from $\eta$, and root of the secret keys, the root of the secret keys for each stakeholder can be sampled, and derived beforehand, but $\eta$ is a response to global random oracle, so the whole security of the leader selection is hinged on $\textit{centralized global random node}$.
|
|
|
|
|
|
-A block $\textbf{B}$ is the building block of the blockchain.
|
|
|
+## solution
|
|
|
|
|
|
-Block $B_{i}=(st, d, sl, B_{\pi}, \rho, \sigma_s)$ created for slot i
|
|
|
-by a stakeholder, and slot i leader $U_s$:
|
|
|
+to break this centeralization, a decentralized emulation of $G_{ro}$ functionality for calculation of: $\eta_i=PRF^{G_{ro}}_{\eta_{i-1}}(\psi)$
|
|
|
+$$\psi=hash(tx^{ep}_{0})$$
|
|
|
+$$\eta_0=hash("let there be dark!")$$
|
|
|
+note that first transaction in the block, is the proof transaction.
|
|
|
+
|
|
|
+
|
|
|
+## Epoch
|
|
|
+
|
|
|
+An epoch is a vector of blocks. Some of the blocks might be empty if there is no winnig leader.
|
|
|
|
|
|
-$$\textbf{\textcolor{red}{st}}: \text{state of the previous block,
|
|
|
-Hash(head($\mathbb{C}$))}$$ $$\textbf{\textcolor{red}{d}}: \text{data held
|
|
|
-by the block}$$ $$\textbf{\textcolor{red}{sl}}: \text{slot id generated
|
|
|
-by the beacon}$$ $$\textbf{\textcolor{red}{$B_\pi$}}: \text{proof
|
|
|
-the stakeholder ${U_s}$ is the owner, $B_{\pi}=(U_s,y,\pi)$, y,$\pi$
|
|
|
-are the output of the VRF}$$ $$\textbf{\textcolor{red}{$\rho$}}:
|
|
|
-\text{random seed for vrf, $\rho=(\rho_y,\rho_{\pi})$}$$
|
|
|
-$$\textbf{\textcolor{red}{$\sigma_{s}$}}: \text{owner signature on
|
|
|
-the block}$$
|
|
|
|
|
|
|
|
|
## Leader selection
|
|
|
@@ -63,27 +113,26 @@ the block}$$
|
|
|
At the onset of each slot each stakeholder needs to verify if it's
|
|
|
the weighted random leader for this slot.
|
|
|
|
|
|
-$$y < T_{i}$$ <center><sup><strong>check if VRF output is less than some
|
|
|
+$$y < T_{i}$$ <center><sup><strong> check if the random y output is less than some
|
|
|
threshold </strong></sup></center>
|
|
|
|
|
|
This statement might hold true for zero or more stakeholders, thus
|
|
|
we might end up with multiple leaders for a slot, and other times no
|
|
|
-leader. Also note that no one would know who the leader is or how many
|
|
|
-leaders are there for the slot, until you receive a signed block with
|
|
|
+leader. Also note that no node would know the leader identity or how many
|
|
|
+leaders are there for the slot, until it receives a signed block with
|
|
|
a proof claiming to be a leader.
|
|
|
|
|
|
-$$y = VRF(\eta||sid)$$
|
|
|
|
|
|
<center><sup><strong>$\eta$ is random nonce generated from the blockchain,
|
|
|
$\textbf{sid}$ is block id</strong></sup></center>
|
|
|
|
|
|
$$\phi_{f} = 1 - (1-f)^{\alpha_i}$$ $$T_{i} =
|
|
|
-2^{l_{VRF}}\phi_{f}(\alpha_i^j)$$
|
|
|
+L \phi_{f}(\alpha_i^j)$$
|
|
|
|
|
|
Note that $\phi_f(1)=f$, $\textbf{f}$: the active slot coefficient is
|
|
|
the probability that a party holding all the stake will be selected to be
|
|
|
a leader. Stakeholder is selected as leader for slot j with probability
|
|
|
-$\phi_f(\alpha_i)$, $\alpha_i$ is $U_i$ stake.
|
|
|
+$\phi_f(\alpha_i)$, $\alpha_i$ is $U_i$ relative stake.
|
|
|
|
|
|
The following are absolute stake aggregation dependent leader selection
|
|
|
family of functions.
|
|
|
@@ -181,14 +230,17 @@ $$\phi(\alpha)=c^{\alpha} \mid c \in \mathbb{R}$$
|
|
|
|
|
|
#### no solution for the lead statement parameters, and constants $S,f, \alpha$ defined over group of integers.
|
|
|
|
|
|
-
|
|
|
assume there is a solution for the lead statement parameters and constants $S, f, \alpha$ defined over group of integers.
|
|
|
-for the statement $y<T$, $$T=ord(G)\phi_{max}\phi(\alpha)=S\phi(\alpha)$$
|
|
|
+for the statement $y<T$, $$T=L\phi_{max}\phi(\alpha)=S\phi(\alpha)$$
|
|
|
$$S=ord(G)\phi_{max}\phi(\alpha)$$
|
|
|
such that S $in Z$
|
|
|
$\phi_{max}=\phi(\alpha_{max})$ where $\alpha_{max}$ is the maximum stake value being $2^{64}$, following from the previous proof that the family of function haveing independent aggregation property is the exponential function $f^\alpha$, and $f \in Z | f>1$, the smallest value satisfying f is $f=2$, then $$\phi_{max} = 2^{2^{64}}$$
|
|
|
note that since $ord(G)<<\phi_{max}$ thus $S<<1$, contradiction.
|
|
|
|
|
|
+### target T n term approximation
|
|
|
+- s is stake, and $\Sigma$ is total stake.
|
|
|
+- $$ \sigma = \frac{s}{\Sigma} $$
|
|
|
+- $$ T = -[\frac{k}{\Sigma}s + \frac{k^{''}}{\Sigma^2 2!} s^2 + \dots +\frac{k^{'n}}{\Sigma^n n!} s^n] $$
|
|
|
|
|
|
|
|
|
## Leaky non-resettable beacon
|
|
|
@@ -207,7 +259,6 @@ beginning of epoch $e_{i-1}$ to the slot with timestamp up to $(j-2)R +
|
|
|
\frac{16k}{1+\epsilon}$, note that k is a persistence security parameter,
|
|
|
R is the epoch length in terms of slots.
|
|
|
|
|
|
-# Protocol
|
|
|
|
|
|
# Appendix
|
|
|
|
|
|
@@ -265,22 +316,3 @@ without the need of forking the blockchain.
|
|
|
| `rand_seed` | `Seed` | Random seed for the VRF |
|
|
|
| `signature` | `Signature` | Block owner signature |
|
|
|
| `address` | `Address` | Block owner address |
|
|
|
-
|
|
|
-
|
|
|
-## Streamlet Metadata
|
|
|
-
|
|
|
-| Field | Type | Description |
|
|
|
-|-------------|---------------------|-----------------------------------------------|
|
|
|
-| `votes` | `Vec<Vote>` | Epoch votes for the block |
|
|
|
-| `notarized` | `bool` | Block notarization flag |
|
|
|
-| `finalized` | `bool` | Block finalization flag |
|
|
|
-
|
|
|
-## Participant
|
|
|
-
|
|
|
-| Field | Type | Description |
|
|
|
-|---------------|---------------------|-----------------------------------------------|
|
|
|
-| `public_key` | `PublicKey` | Node public key |
|
|
|
-| `address` | `Address` | Node wallet address |
|
|
|
-| `joined` | `u64` | Slot node joined the network |
|
|
|
-| `voted` | `Option<u64>` | Last slot node voted |
|
|
|
-| `quarantined` | `Option<u64>` | Slot participant was quarantined by the node |
|
mohab metwally