Whiteboard Series with NEAR | Ep: 15 Izaak Meckler from Coda Protocol |

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:03

   hi everybody we have Isaac here from Kota and he'll tell us more about how to succinctly validate the chain introduce yourself a little bit and they're like in diamond sure yeah I don't know okay so I'm Isaac I work on a project called coda the I guess the cool thing about it is existing block chains you know it's pretty much impossible for most devices to actually verify the train because the you know amount of data that you need to

2. 0:37

   verify is proportional it's like number of transactions which happen on the train in coda somehow we use snarks to kind of compress the whole blockchain down to one little proof so any device basically can verify super easily by just downloading this one proof cool so let's get the quick overview of how that all works sure so I can maybe maybe I can start by kind of explaining it at a

3. 1:02

   high level and then we can dig into any particular details so I guess you know if you can imagine sort of a blockchain you know it looks like this there's some blocks they go forever and yeah in order to to verify the chain you sort of you know you go down you look at this block you say okay is it good does it match you know up with the previous state and so on oh look at this block oh is good does it match up with the previous state

4. 1:32

   and so on and you know you march down that way so as I kind of alluded to this is is pretty crappy because it means if if you want to verify the chain like you need to look at all the blocks right okay so for example if you're like on a phone or something that's a no-go so like what people do practice is like you basically like you know look at a third party server and just look at look at whatever they say the blockchain hashes like I'm mad at masks or

5. 2:03

   something like that so right okay so what what snarks let you do okay so should I explain what to do with snarks or okay so snarks so basically the idea is right okay so you you you do some computation let me let me let me try and give a sexy example yeah so okay so like imagine imagine there's like oh crap okay so I should have done this before and okay so so imagine you like run your computer of some computer it's like a big powerful computer you know this is a computer and it runs for like a thousand

6. 2:46

   years so time goes by a thousand years okay so at the end you know you're gonna get some output it says like the answer I don't know equals 42 42 I don't know you're talking about so it says like the the answer for example equals 3 and and you say okay well that's all well and good but you know how am I supposed to believe you that the answer equals 3 I didn't that's not my computer you know I didn't run that computer for a thousand years I don't know so and imagine

7. 3:19

   furthermore that you know doing this computation required computing on a lot of data so data okay so what snarks let you do is they allow you to create a very small amount of data so you can think of it somehow maybe sometimes I like to think about it like a like a like a snapshot like a photograph you know of this computation happening yeah you know ok and and it's like a Polaroid and someone wrote three on the bottom

8. 3:47

   and and and you know you just send that to someone instead and and the cool thing is that this is like a snark Sarek so it's it's very small so it's small it's like concretely it's like you know I don't know kilobyte ish and it's easy to verify okay so how easy like on the order of like tens of milliseconds okay so pretty easy to verify and this took a thousand years so you know not bad so okay so that's snarks so cool that's like general principle now you know how

9. 4:35

   does this actually how can we use this to solve our problem of like let's not have to download every transaction should ever happen to verify the blockchain you do it in the following way basically let's see how to best explain it okay so if you think about this what it said is you know any computation that you have no matter how long it takes and you know how much data it operates on you can make this little this little proof which is small and easy to verify which convinces someone that you know

10. 5:00

    that you ran that computation and really you know the output was really you know what it was supposed to be what you claimed it is but it also need to know input data well maybe so you don't write so you don't need to know the input data it just says there's some input bits as there is some input data so that if you were to run this program on that in potato this would be output yeah exactly

11. 5:23

    thanks for clarifying so okay so you know verifying a blockchain that's an algorithm that's a computation which means we can use snarks to certify its execution now we need to be sort of careful about how exactly we do it because if you do it in the naive oi it's it's not gonna be efficient it's not it's not gonna really be feasible but you know snarks are still sort of cutting edge technology you need to make sure you treat them nicely you can't throw anything at them so we let me kind

12. 5:56

    of explain a little bit more in depth how it actually works so okay so we have this idea that snarks can sort of oh this one we have this idea that snarks can sort of a you know certified some computation so that you can be convinced to the answer without having to redo it yourself okay that's that's the idea we need to give this technology our mind well I guess I can can I use this I guess I can use this so I didn't this is a bad whiteboard work

13. 6:23

    so how do we use this for in the blockchain context and by the way like this technique that I'm about just I'm not now I'm looking at this oh I'm still looking at this this okay okay so this this technique that I'm about to describe it's it hasn't really nothing to do with bots I mean it doesn't have anything in particular to do with blockchains it's very generic and you know any sort of state machine really you can certify its execution in the way that we're gonna describe we're using snarks and ball chains are some kind of

14. 6:56

    state machine yeah so okay so yeah okay so how does it work so well yeah in a blockchain we have a state blockchain state okay and what's in the state well okay for example let me talk about coda there's the Merkel root merkel root loops of the database of accounts and there's some consensus related information essentially there's maybe a little bit more than this but so this is essentially information that you need to

15. 7:52

    make progress in consensus you know to propose a new block and also to do chain selection so this has things in it like length and then a bunch of more sort of Ouroboros specific stuff ruh-roh I'm always bad at spelling this orb or specific stuff which we can get into later if there's interest hmm okay but if it was proof of work that for example could be the overall yes exactly if it was proof of work this for example would be could be the

16. 8:24

    strength of the chain the you know the expected number of hashes right this would have like the expected number of hashes you know that we're needed to compute in this chain the strength and also the last few difficulties and block times of the could do difficulty adjustment but don't use proof work it's bad you know seriously like we're in a climate catastrophe oh no sit okay okay everyone ever admit hopefully everyone knows that

17. 8:50

    by now turn off your Bitcoin miner but so let's see so people just started turning them on the electricity's prize going down okay well anyway so right okay so maybe I'll come back here so we have this box chain stick and then we sort of have like an update blockchain function okay update function okay and basically what does this do so the input is you know like the previous state and say you know a block

18. 9:41

    whatever that is and the output you know is the new state okay so what we want to do is basically make a snark which somehow says you know I know some sequence of blocks so that if you call this update function with that sequence of blocks on you know starting on the genesis state you'll end up in state s okay and then so so yeah we have some snark which says this isn't will be my

19. 10:20

    diagram for snark it's a photo it says you can get from Genesis to state s and you know it says something about the update function and so on okay so then you know if I want to convince you for example oh yeah here's how much money you have in the current blockchain you know for example or like I really sent this payment to you or whatever I keep looking the wrong camera I just send you this proof that convinces you you know you see all the proofs floating out

20. 10:59

    there on the network you pick the strongest one that convinces you what about what the current state is state s then you would know from that you would know the miracle root of the database of accounts then you have to get from somewhere you ask another node of the network for a merkel path into your account and then you see your balance you know seventeen dollars or whatever forty-two dollars yeah anyway so yeah so

21. 11:30

    that's the basic idea okay so now how do you actually do this snark that's this technique of recursive composition and I can explain that or we can go on to something else no I mean this is that's the core right yeah that's the core we can talk about that so I mean I think like an interesting part here is that snarks itself right you can normally apply it to a specific function right so like when you have this photo you

22. 11:55

    actually need to know kind of what computation was done ahead of time so that food approves you yeah yeah so like so snarks like natively or whatever only work with like fixed size computations so you know night the naive thing would be you'd have to sort of say ahead of time like like yeah this but for 10 blocks or for a thousand blocks you have to fix the number you know of blocks

23. 12:18

    that you wanted to sort of compress into one it's gnarrk and so the technique of recursive composition makes it possible to do not have to do that to certify you know the execution of an unbounded number of iterations of this update function this is a this is a general technique so first I'll talk about the general technique which you can apply to any snark and then I will talk about some snark specific things that I so right so usually you wouldn't want to use this

24. 12:50

    general technique because it's really slow but then there's some kind of magic that is true about some smart constructions which let you to make this technique much more efficient than you would naively expect okay so let me explain first the general technique it's it's a very interesting technique but basically it's the following oh let's see what's the best way to explain it okay so you know before we

25. 13:30

    talked about this update function maybe I'll still talk about it in those terms even though it'll be a it's really a bit more abstract but let's say we have some function you okay and this is like our update function function you you know from some state just some state okay okay and you know what we want to prove is basically let's let's say like this so so okay maybe I can say this

26. 14:04

    about snarks with snarks there's always this sort of public thing that's like what I wrote on the bottom of the polaroid that's you call it like the the instance or the or the public input maybe so whenever you want to like define a snark a smart construction you say okay what is the input what is the instance and what is the and what are you proving about the instant okay so here's what we want to do we want to will have our input or our instance will

27. 14:36

    be a state okay let yeah maybe two states as 0 and s 1 okay and we'll prove ah okay I'm not going to explain in full generality because it it doesn't matter for the main idea okay so we're going to prove basically okay instance this this yes there exists you know some number and maybe I won't use that I don't know who's watching but let me try not to use any mathematical notation that I don't need to there is some n some number n so

28. 15:37

    that if you do you N times on s0 it's its equal to s1 okay just abstractly really you know you'd want to if you want to talk in full generality then there's also some sort of input or whatever like the blocks the turns of the transitions the state transitions but let's think about this trivial case because it still illustrates the the general concept without having to write more notation so so it's clear what we would like to do

29. 16:22

    we would like to have a snark which lets us prove statements over this form okay so how are we gonna do it okay here's here's the idea mmm yes so instead this is what this is you know one thing but instead how would we do this you're said prove a 0 is equal to s1 or there is a proof a snark PI so that pi proves oh sorry there's a proof pi hmm okay so either s0 is equal to s1 or

30. 17:23

    there is a proof PI and a state s so that pi proves the statement as 0s and U of S is equal to s1 okay so we interrogate ask me some questions so that I clarify what I said yeah I mean pretty much yes you define your cursor function right where you have the base base condition and then a step decomposing it into right yeah it's like induction yeah its induction step so you want to prove that if you do this some number of times you can get from su

31. 18:20

    at s1 what you prove is either oh you're already there as the ORS equaled s1 or somehow you know I already know that I can that I can get from s 0 to s some intermediate state and if I can just take one step from s I get test 1 and you don't care you just take care that the proof exists you don't really care what that proof is it doesn't matter where it's not an input yeah yes it's a

32. 18:43

    it's a yes it's it's part of the witness and so the the tricky part here is what is meant by PI proves s0 s1 right I mean what does that mean well it means if you run the snark verifier on PI with inputs as you're on and and as you'll you'll get true right so we need to make this more explicit so that you know yes snark snark verify on pi with s 0 and s equals true but even this is not enough because snark verify it doesn't just take the proof and the instance it also takes another

33. 19:29

    argument which is called the verification key ok do you know what I'm talking about here's that the program itself pretty much it's sort of the program itself but yeah so people might know like with with snarks you know it doesn't make sense to just say start snark verify well let me say it like this for any particular like program that you want you want to certify the execution of you can

34. 20:00

    generate parameters for that program and probably many people know that there's this NPC that you have to do when you're using pairing based snarks which is like you know to to generate good randomness to use right and so that good randomness is is for generating a proving key and a verification key and that verification key yeah it's sort of like a description of the program it's an additional input to the snark verify function you know

35. 20:25

    does that make sense yeah yes I mean that's what toxic-waste pretty much is when they generated yeah so right so the toxic waste is like a byproduct of generating the verification so right so you have to pass in the VK okay but which PK ah this is a bit of a problem because it's the supposed to be the verification key for the program that were right now defining right you see you sent I'm saying yeah so I mean

36. 20:50

    you're pretty much saying so you have you from you from you right and you and you decompose this part out and you're saying hey this there is a PI without this part yes but the pie itself proves this part right yeah so pretty much you need the VK that proves I mean depends on how pie is structured right that's what right so what I'm saying is like what we would want is that VK is the verification key corresponding to the statement that were

37. 21:22

    right now defining it yes right so there's a chicken and egg problem it's a step itself pretty much well to the induction step not nor the key is not an induction step decays the fool induction to the hole to the host to the whole statement that says either base case or you take one step right so that seems a bit problematic right because well you know we didn't finish defining the program yet how are we supposed to do a parameter generation and get the verification key so well I

38. 21:52

    don't know how about we just make the verification key part of the input so right so we just say snark verify on oh right so this isn't yeah well that's not going to quite work sorry so okay so some sorry let's not make a part of the input yet so somehow we're gonna have to get this BK right so here's what you do you say right yeah I guess you couldn't make it part of the input so you can think it's like a binder like in a

39. 22:29

    programming language right like it's not it's not in scope liaison its scope so we need to bring it to scope somehow in the snark there's two ways that you can I mean it literally there's two ways that you can bring something into scope one is you have it be part of the way the instance okay that's you know this binds the variables as you're on s1 by saying declaring that they're part of the instance or you can do this there is you can do this non-deterministic choice that's the other binder so you can say

40. 22:55

    there is a proof pie in now I can state s and I can talk about PI NS and what follows okay so I can either bind it here or I can bind it in there is the most obvious thing is to try is to bind it here so to say okay part of the instance is also V K so when you verify the proof you actually sort of pass in the verification key as part of the input it's sort of like a function that calls upon you can kind of think about it like you're passing in a function

41. 23:18

    isn't as an argument and it calls itself you know it's like if anyone ever implemented like a fixed point function or something or Y Combinator you know it's kind of its kind of like that so what yeah so yeah okay but actually it's very interesting you can do this why can you not do this is a great trick you can't do this as actually the size of the verification key depends on the size of the instance so let's say the instance has size let's

42. 23:57

    say you know the instance would have to have some size let's say it has size K all right for example well you can't actually have size k because if it has size k then it's a verification key has size basically k plus 1 so for example right or caples at least k plus 1 so okay so that's contradiction so it can't have any size so that doesn't make sense so that's actually a no-go so oh that's

43. 24:22

    too bad but it's kind of funny okay so what's our only other choice we only have one other binder this this market ID - we only have one other binder which is this there is okay so that's where we need to find it so there is a proof pie and state s and a verification key such that this okay so now we've found it so that's good okay so now we take a look at what we've done so far is this gonna work no it's not why because we said

44. 24:53

    it's just an arbitrary verification key so that's totally useless it's gonna always return true oh yeah you can always find it you can always find a key to that returns true so that's no good so now now we think and now here's the amazing thing we now we look back at our instance and we say okay what was the problem the problem was that in order for the verification key to have sort of a fixed size or whatever like the well the the the

45. 25:25

    instance need to have has have a size that didn't depend on a verification key so do we have the key and just pass the hash of the yes exactly so instead of instead of having the instance be a pair s0 and s1 you can have it be just a single value which is a hash so it's just a hash hash H and then what you do is you say we use our other binder so now as your and s1 are in scope anymore but that's okay because we have this other binder which is there is so

46. 25:55

    yes yeah so we say there is a zero is using script s as 0 s 1 B K so that first of all this is the write s 0 s 1 and B K so hash of s 0 s 1 the BK is equal to H and everything else that we said before but that doesn't work right now or not all right because you will naturally have to pass this hash in here but as doesn't match right okay so here's C that's right that's the point so now we need to just change this

47. 26:37

    so instead of saying snark verify BK and this we say snark verify BK with hash of of s 0 s and V K ok but also I implying that I can can I snark if I snark verify function yes yes yes that's the whole point of it yeah yes that's the point of a course competition so the snark verify function is defined regardless of what the verification key is so and it's small it's quite it's quite simple so this is just some computation how many Gators

48. 27:24

    you so so which one do you use so you use like the Shonan there is Peterson hash function and so this in practice is this recursive snark applied to every block or every transaction yes that's a good question so you know what I described was talking about it for every block but you need to do something with the transactions and in particular in order

49. 28:25

    to decouple it's important in encoded for example that the ball time is short this is important for burrows so you want to decouple the block time from the proving time as much as you can and the snark proving time because it's pretty long right so if if if all the transactions that you wanted to include in the block you had to do at the same time you know as you produce the block

50. 28:48

    that would not be so good because you could only do very few friend transactions in the short block time that that you want to do so in encoder there's there's this kind of pipelining that goes on where there's really actually kind of a buffer of transactions which have yet to be snarky yet but are also kind of part of this state and one you win a block you you essentially in queue things onto this buffer and also you know compress some things that have been compressed in the meantime from the beginning to clear

51. 29:21

    more space and yeah so every block contains some transactions yet to be snarky fries yes yes as in addition to like some transactions that had been previously included that would have now been snark fide that you sort of pop off this queue but but in reality is it the case that you like let's say I have two transactions right exponent X - yeah is it the case that I'm first gonna prove that x1 is valid yeah and then I'm going to prove that I have the snark of checks

52. 29:50

    1 and X 2 is valid like recursively yeah or in the case that I will prove checks one separately checks two separately ext separately and then somehow a Greek merge them to get us actually that's how you do it and that's that's important because otherwise things are gonna be really slow and you're never really crappy throughput right so but but but then the I was interesting right because because

53. 30:13

    imagine that Elia has ten tokens yeah and they have transaction tx1 which sends them to me and transaction tx2 that sends them to you then you can naturally prove both of them so the aggregation step is in a smart way rules that let me explain yeah so I'm gonna prove them when you apply the state yeah so right as you said we have these transactions let's say there's four thank you produced a transition not right because these are sitting in a buffer they've been a linearized you know there is a definite order on them

54. 30:53

    and so we can we can do it without worrying about you know what you said basically yeah it's effective there was like some state zero here state one state two those can be computed very quickly compared to snap computation right you can you store them with a with the buffer of transactions yes yeah exactly and and then what you do is instead of you know here we had once called a snark

55. 31:17

    verify because you can imagine having to and that's just what you do so you verify you have a proof that verifies two proofs and so you sort of you know go up a tree so right and it's also going to prove that the output state of one of the transactions equal yes that they match up and then it's like something greater than the kiss end yeah yeah right so let's say you do to once so right so here it's like s0 to s1 s1

56. 31:43

    to s2 so you're just like merge merge these together and then you can get from s 0 to s 2 similarly you know you merge these together and you can get from s2 to s4 and then you you merge everything together and so right and so like the total you know wall clock time taken to do this is logarithmic in the number transactions instead of being linear in the number of transactions so you're happy but you but

57. 32:10

    you need a number of workers which is linear a number of transactions yeah the total the total amount of work they do is yeah I know so I mean all the workers need to have pretty much somewhat sophisticated data structure to contain the like just chopped up state yes yeah there's there's some dead structure which if you go and github and look at our code it's in it's in a file called parallel scan I didn't name it I don't

58. 32:34

    love this name but anyway it's it's a tree that the head that has all sort of the intermediate states of all these computations and you know hold onto all the day it's very complicated yeah what does ml stand for oh okay it's a okay well as obvious from the abbreviation oh yeah that should has a mouth yeah okay the suffix yeah it's because of you know I'm it's a part of the ML family of

59. 33:00

    languages like SML actually alright so usually one snark how long like for you know one state transition it's it's something it's it's something like 30 seconds some on a CPU right so on the GPS will be faster Matt their lips yeah so you have 30 seconds right and then you have a height of it but this is this is also 30 seconds because roughly they all the same what well they're different if it's a

60. 33:40

    mortar magnitude let's say yeah so logo from the transaction so how many transactions do having a block I don't remember the exact number but let's say you want to do like a thousand transactions or something what transaction is final when it is included into the buffer right yes so we really don't care how long this takes in some sense yeah yeah but that's your pretty much how soon do you have a snark frizzes yeah let's say it's the next day

61. 34:05

    yeah but then as a mobile phone you downloading the snark one day worth of blocks which is yeah yeah it's yeah it is so how often do you have produced blocks I mean maybe that's like good segue into yeah so we haven't went to consensus and so well into your into the changes of this so we haven't totally set the parameters hopefully it will depend it we have to like get the previewing time a little lower but hopefully it'll be somewhere on 10 seconds for one block that's the hope

62. 34:38

    for the ball time it might be a bit more I don't know I don't commit it's not on board but also in practice too once once this proofs were proven for one block right and we're moving up the tree are you already starting proving the the lowest level for the next yeah yeah there's some kind of smart thing where there's multiple trees that are in progress at the same time and the orchestration of this process is it also on on the blockchain or or is that independent

63. 35:10

    sort of so like is it sort of itself certified within the snark is that what you mean or no my question is is the information what is the information about what what which parts are computed already on the block yes that information is is it in the blockchain but who it's this is actually worth mentioning who is actually producing these proofs it doesn't have to be it can be anyone so there's actually a mechanism let me

64. 35:34

    say there's kind of two kinds of nodes that two kinds of nodes who are not just verifying so two kinds of nodes who are computing there's like staking nodes you know what people who are actually like proposing new blocks and there's like snarking nodes and they may be the same people and basically Sarki knows they produce proofs which somehow have attached to them you know I would like to receive this fee for this proof and those are

65. 36:03

    gossip around the network and then staking nodes can use those proofs when building their blocks to work on this do work on the tree that's in progress so in theory they can screw up starting node by just computing them themselves and including it because yeah if they want you yeah and so the only damage is taking node can can do is waste some it's not computational resources right they may not select this person's proofs yeah oh they can also do reworks I guess

66. 36:29

    right they can also do rewards like they can work out the chain is taking notes oh yeah we can talk about consensus it's that so one question just to just to be clear so this is really like 30 seconds for a money transfer yeah yeah but it would be similar yeah it it you know there's techniques that you could do that would make it similar for more general kinds of computation to like Jorian complete well

67. 36:55

    probably not I mean in some sense so you can imagine doing like a like a sexy style system where you pretty much need to check in the type of program you want ahead of time yeah yeah so like like the the off chain computation would be would be more depending on the complexity of this program but the on chain computation would or you know the the snark work or whatever it would still be a small because you can just sort of recursively a do recurse composition

68. 37:25

    basically so like if you have any computation you make a snark for it and then in the ways actually works it's like all you're doing is certifying snarks on chain so you're not certifying the computation itself but just a snark that sort of it's self certified to computation so I get a transaction is a snark pretty much yeah that's what here's a punchy yeah the kind of yeah the idea right instead of a signatory of the snark zac swansey requires one trusted set up I guess it depends what

69. 37:51

    you mean by one set up but yeah but yeah only one this one talked toxic waste laughs yes I mean if you did sexy with like with something like Sonic for example what but then why not use tonics for everything I mean I guess the problem with Sonic as it currently is is it's low but I've heard that there are there ought to be similar systems which should be much faster but they they're not public yet so this is the only one that I know how to talk but my question was

70. 38:22

    about zexion snarks because so for example in your case right you will do one trusted set up yeah for your circuit that i guess for like multiple circuits right you have a circuit for the payment circuit for the verification whatever I'm gonna talk about that it's cool it in in Zig see if I create a new let's call it smart contract doing it to do I do trust that setup or smart contract or do i do one smart oh it's not expands with Sonic's or the one at the beginning

71. 38:46

    oh sorry sexy with snarks not with Sonic what's not excuse yeah you'd have to do it once per per contract for program yes doctor yes unfortunately yeah but you can use something or some or soon you know or stark all right anything gray well Sark is a little bit those other ones are more difficult to do but yeah so you mentioned rapping that's for the whole block oh yeah well sort of so right so there's this um right I mentioned like this is the general we

72. 39:17

    talked with the general technique of recursive composition but there's if you try and do it in a naive way what I what all would that we just described you're in for a lot of pain because that snark verify function is gonna be millions of constraints so or actually probably even more so how to not experience that pain and and that's that what I was just talking about with the wrapping but we can talk about that ever even talk about consent I don't know it's up here how

73. 39:54

    much I mean yeah right yeah we can talk about concepts a little bit more I think that's okay yeah interesting how this all builds into a chain oh wait one more thing you know while I'm on the video I just want to say it that we're talking about those that matter guys we're also going to be doing a contest for improving the snark River and in particular GPU implementations so stay tuned for that

74. 40:18

    follow us on Twitter you know well will tweet about it okay so consensus yeah what's really so can you actually give a high-level overview of Ouroboros because I think most of the people cannot really process that right right right it's well known that if you met in this paper to someone that there's very much one thing they will say about it which I won't say okay oh yeah first of all nobody can spout so it's really hard to find it yeah I think

75. 40:52

    that's spelled correctly so okay so what's the basic idea of or bar so it's good enough steak and it's I guess by IOH gay people which is Cortana right yeah so and it's you know they were the first favorites only two thousands I want to say to us in seventeen or something like that because in sixteen but they've done a series of improvements so it's a lot better than the original thing but I'll let me explain everything okay so we reverse how does it work basically how it works is the following

76. 41:34

    you have time is it continuous is a discrete I don't know but you discretize time and first you chop off chop up time let's say yeah into slots so so slots so this is just this isn't that important you discretize time into slots how long is one slot so this is like the block time so this is what you would want to be like 10 seconds yes I know all the nodes assumed to have give or

77. 42:23

    take synchronous clocks yes yes like up to that precision yes you know yeah let it come that well you'd want it to be more precise than yeah they need to communicate right yeah than that okay so and then once you've broken up time into slots you break it up further into what are called epochs so I just expand once love so like it's some number I'm sorry you break up the this like this a box are bigger than slots so there's just like how like well data rotation stuff

78. 43:02

    it's something like that exactly but yeah something like that so these are parts 0 1 and so on and then the idea is at the basically at the beginning of each epoch sort of you have some randomness okay which somehow was given to you by nice people in the past and you you use that randomness to randomly sample in some sense who who are gonna be the winners in each of the slots in the subsequent epoch

79. 43:42

    now how you actually do that randomness how you actually accumulate the randomness and how you actually select the winners it depends based on well you know in the original warhorse it's one way in in or browse it's another way and we use the techniques in WordPress they're much more conducive to house yeah to being smart and also I can just simpler and yeah and then what or boss person ends up giving you is somehow some kind of

80. 44:23

    security okay so like this gives you sort of the ability to sort of select or prefer a chain you know to distinguish an attacker chain distinguish an attacker chain assuming it did not work too long ago from from the change that you know and how long is too long it's it's basically it's a fraction in an epoch it's a fraction of an e-book or maybe suppose I can remember it maybe the practice of one I think it's up to you know Forks up

81. 45:09

    to sort of recent Forks okay so that's no good what that means is this is this is a good way to go so long as you're on line frequently or if the snapshot or if or if you you know put on my Bitcoin blockchain hash calm or whatever right and so they were the solder Baker called or Boris Genesis and this lets you distinguish distinguish you know for long Forks actually arbitrarily long force but it's not it's not really star Keable because it

82. 45:56

    requires it requires sort of looking if you have a fork it requires looking at looking at the point where they forked and and then making some judgment about about that and this is not a horrible thing to say you know to say oh go go go look in an arbitrary point in the past all you have is current state so we have some modification and I think we'll I think monastry who works for us is writing a blog post about it so we'll write something up about this soon which makes

83. 46:33

    its markable okay so which involves somehow computing some summary statistic that somehow approximates what you were doing quite looking at the point where they forked but yeah but what the Ness is the same it's it's a similar idea yeah so what happens was in a place is just more proposes yeah how do you win right so here's how you win and let me talk about browse at and it's the same exactly the same in Genesis the only thing changes in Genesis the chain

84. 47:02

    selection rule so how do you want so here's what you do so at the beginning of an epoch I have some randomness that was given to me by the very kind people from epoch and - one called are I think in the paper they called a nonce okay so it's it's some random bits that were somehow generated by these people in such a way that an adversary sort of can't mess with it and say I'm here and I'm like hey I wonder if I won epoch our slot number

85. 47:39

    three or two here because I have kind of things here there one two I wonder if I once thought number two and let's say you know my public key I have a public key you my balance my account balance is like you know a or something and or B for balance and the total amount the total amount of stakin system is like t i'm assumed to do to take my entire balance or balance is specifically how much is staked your your staking your entire balance yeah

86. 48:21

    awesome so right so what you do is there something called a vrf which is like a verifiable random function and it's actually really simple and I can explain it but basically you somehow run your own private lottery okay and it's somehow associated to your public key this you have some personal random function which is somehow associated to your public key and you evaluate it on basically the input slot ID yes the slot

87. 48:54

    ID exactly so like basically two comma you know or one comma two like epoch number comma slot number say oh and then with the randomness so would a hash a hash of a signature be over ERF that's basically it that's almost exactly what you do yeah it pretty much it can't be high for signature because because signatures have randomness in them but but you want to be able to grind but but that's that's almost

88. 49:20

    exactly the idea so what you do is basically you take the message and you raise it to your piracy private key you take the message you interpret it as a group element somehow and you raise it to your private key and then you hash it and then yeah so but then I don't I don't know if I won right I just know if my number is big I sort of and then you and then you compare this number to some function of B and T and you basically

89. 49:49

    check you know there's some threshold function which say you know takes B and T as inputs and and returned some pretty much it says you should try or you shouldn't try well well it will just be a real number and you and you can compare you can compare with others right like it like you're not gonna know immediately that you want that sounds like magic no because they don't know others others will have

90. 50:14

    different VRS right which I do not know yeah the multiple okay yes you so they all produce blocks pretty much they all of them everyone produces the block like this is bloc where's the transactions they have so far they bust it and then everybody else pretty much does a chain rule yep and there's a parameter in the system which is like basically what percentage of the slots do you want to be full and that also implicitly

91. 50:51

    determines you know how often will the where that will there be multiple blocks per slot and but for example so let's say like four people one here and they all produce blocks right yeah and let's say just me who one here nobody else one okay yeah there is some algorithm which tells me which one to choose but I can choose arbitrarily still right it's up to me that's true yeah yeah chain link

92. 51:16

    right but then I didn't when I produced my block right so so I I said I'm actually gonna choose this one okay even though this one was higher I will just pretend I didn't see it the next person will always prefer mine right because mine is longest okay so we can attack up to there's some complicated analysis in or Burress I encourage you to read it it sort of it says you know if you don't have that much if you don't have you know fifty it's not it's not 50/50 percent it's a

93. 51:48

    little bit less actually it's like 40 something percent then you you can't do this often enough to to win eventually and do people stake explicitly or everyone who has any imbalance is taking yes this there's also delegation so you can also you can say actually you know there's basically a bit in your account or it's on a bit actually to public key there's a field in your account which is

94. 52:13

    like who do I want to delegate you by default it's it's you it's the same as the public key of the account but if you want you can I can say hey you know I don't really feel like sticking I'm gonna set it to to be your public key and then is there a slashing in there Oh Bruce no actually so that's that's a I guess open so what if I propose two different blocks like I want propose two

95. 52:37

    different blocks propaganda I I forget exactly I think if I think if if there's some explosive misbehavior you just ignore those of those persons blocks or something like that because their adversarial blocks I don't remember exactly you it is I forgot because I'm pretty sure if if there's multiple blocks with the same proposer in in one slot you ignored all of the blocks I think that's that's a fake oh you're slashing because you're losing your reward effectively I guess so I don't know how to say in those

96. 53:41

    terms yeah and the the problem is like was this kind of ignoring is that you because you're getting more reward especially if you're a bit bigger like bigger delegator you actually depriving them from reward long term which means that people who delegate to them will lose the income and will see this as a guy who has big bigger income and I'll go to him so you actually like centralizing everything that's by by by censoring other people and this I mean this is true about like proof of work as

97. 54:15

    well right as a mining pool your cash should start censoring other mining pools and they're there like if it's a small mining pools their revenue drop is way higher than yours and you can start like bringing people here like a have a better income anyway I'm writing a blog post about that yeah yeah yeah that's interesting I mean so what whatever what's happening if pretty much like randomness happens

98. 54:47

    like random has been generated from previous one right I mean yes assuming it's like some random CDF or something that's not that cannot be yeah tangled well yeah yeah yeah it's yes I I forgot exactly how it works out but basically like there's the middle third of each epoch is like one the generation of this rice takes place so like you actually know ahead of time who yeah you know

99. 55:10

    random this kind of ahead of time yes yes yes it's a frozen at its frozen here and so what happens is like I mean these guys are progressing and then people like here they get kicked out for whatever reason so they start building like a longer chain that's pretty much where well like the validators here right that were that produces blocks they are not validators anymore own they may yeah yeah no but let's say like wait Frankie we're describing a long long

100. 55:41

     road yeah that's what genesisn't I guess so the the number of blocks that sorry in each epoch the number of blocks that you would win is roughly proportional to well or at least this threshold function yeah because it's not it's not selecting a subset right it's actually like a fool everybody can participate but but I guess another question is so my my vrf only depends on the randomness here right it does not depend on the random it does not depend on the previous block

101. 56:13

     for example no right so you know the beginning of the part so immediately after the e-book has ended no matter how much take actually wasn't the system right I know exactly how much stake was how much they participated in the survey in this epoch right like I can add up the stake of every so so this is the blockchain so I don't really need to wait for them to unstick if I want to corrupt them I can immediately pay them

102. 56:35

     more than that and immediately fork out right can you explain that again so so let's say I'm an adversary okay but I guess it sort of breaks if it sort of breaks if people are actually online and see them that the the network but like in fact what I'm saying is that because they know everything let's say I have a way to reach out to each of these people okay right and so at any moment like the moment this block was produced I can already reach out to that person

103. 57:04

     and say I will pay you a little more than your stake not just take your reward because there's no question right I will just pay you a little more than you reward yeah and but you just say hey rewrite the block without this transaction right you had the transaction here it's like yeah no transaction awesome and then you just pay everybody else right and in reality you just needed to do like at the end of the book but but they do not promise you more than one like part of the e-book

104. 57:36

     like they assuming that if something was like one fraction of a fraction of an overnight book in the past then everybody already agreed on that but here it seems like you can because like I can rewrite it pretty much the next guy this guy decides who of this to changed to propose forward right like this guy if he includes this then like this chain is orphaned I mean I don't know all right what happened so yeah so let's see let's actually it's

105. 58:07

     40% rate malicious so there's a decent chance that I will have like let's say to first blocks it's like 20% right so if I manage to corrupt some people here which is very cheap to do right so let's say that the person staked like 50 so the reward could not be more than like a negligible percentage of that right like if you if you think about 5% or like let's say even 50% annual yield

106. 58:36

     right your your per block reward is going to be miserably small right so let's say you get like point point one of card a no or coda Jerkins that means that for anything that is more than point one like point two for them it's actually very meaningful to rewrite the block and because I already paid them point to it's okay that they will not get any reward because it will be detected right but they will produce the

107. 58:59

     block and then I have these two slots I will just approve this chain that that I built by corrupting them does make sense so there's no finality was in Napa pretty much not that I can I can build yeah yeah but yeah basically yeah I don't know I mean that's that's true yeah I guess what you say is true I have to think I guess I'd have to think more about it exactly what this attack is cool but about this is it something that Janice is sort of souls because you're

108. 59:24

     saying Janice is actually so has protection from any long range of taxi right so I'm sure here the range is not even that long III I think in their security arguments they assume 50 percent not corruptable I see so it's a I call it Algar and security they have the same assumption it might be reasonable but but not knowing people I think it's yeah it's like post facto not corrupt all right it is fake

109. 59:56

     economically descent advisable all right bought in I don't know ideological about it I don't know all right cool and then so pretty much in kurta you bring around this and then with some lag you pretty much wildly building this block you have like a snark for this block which kind of proves from Genesis so this but the light note yeah the light note it is not as easy as actually

110. 1:00:26

     just downloading a snark and the miracle path right because if they want to know something that happened recently is that right so so fact I do need to download few blocks right if you want to know something that just happened yeah then you would have to yeah so but like I want to know my balance right oh but I would know if I spent it sorta but you don't know if you achieved money but usually you want to check so in fact what you're saying like let's say I want

111. 1:00:49

     to check my balance right so if I if I know I wasn't spending anything and I check something that was like two hours ago I sort of know it's too up-to-date maybe someone sent me money in the last two hours I will just note hours later yeah and actually there's a there is sort of a well they can also show you some parts of this of this buffer to also convince you that they send you money right so because there is a miracle miracle proof and every on top

112. 1:01:17

     of the buffer yeah the buffer is all there's also like the half of the buffer is also sort of in the state and some information about that is actually certified I see cool okay we're covered everything yeah yeah I guess so roughly yeah awesome super cool all right yeah check out Kota Twitter website github competition competition is an upcoming yeah yeah leave comments and tweets thanks okay thanks guys