On the Origins and Variations of Blockchain Technologies
Total Page:16
File Type:pdf, Size:1020Kb
REAL-WORLD CRYPTO Editors: Peter Gutmann, [email protected] | David Naccache, [email protected] | Charles C. Palmer, [email protected] On the Origins and Variations of Blockchain Technologies Alan T. Sherman, Farid Javani, Haibin Zhang, and Enis Golaszewski | University of Maryland, Baltimore County e explore the origins of help people understand where and controls who may update state Wblockchain technologies blockchains came from, whether and issue transactions. A private to better understand the enduring they are important, and if they will blockchain is a permissioned block- needs they address. We identify the persist. (For a complete list of refer- chain controlled by one organiza- five key elements of a blockchain, ences, see A. Sherman et al.)1 tion. A consortium blockchain is show the embodiments of these a permissioned blockchain involv- elements, and examine how these Elements of Blockchains ing a group of organizations. In a elements come together to yield Blockchains provide a mechanism permissionless blockchain, anyone important properties in selected through which mutually distrustful may potentially append new blocks, systems. To facilitate comparing the remote parties (nodes) can reach with the consensus policy (e.g., a many variations of blockchains, we consensus on the state of a ledger majority of participants) determin- also describe the four crucial roles of information. To trace the origins ing which continuation is valid. of common blockchain participants. of these technologies, we start by Blockchains achieve consensus Our historical exploration highlights identifying their essential elements and control (and, in particular, the 1979 work of David Chaum, informally. A blockchain is a dis- prevent double spending) in part whose vault system embodies many tributed ledger comprising blocks through applying protocols and of the elements of blockchains. (records) of information, includ- establishing high costs (both eco- ing information about transac- nomic and computational) to modify Understanding tions between two or more parties. the ledger. Typically, permissioned Blockchains The blocks are cryptographically systems run faster than permission- With myriad blockchain distrib- linked to create an immutable led- less systems do because their control uted ledger systems in existence, ger. Nodes may append informa- and consensus strategies depend on more than 550 associated pat- tion to the ledger through invoking faster fault-tolerant protocols3 rather ent applications under review, and transactions. An access policy deter- than on time-consuming crypto- much associated hype, it can be mines who may read the informa- graphic proofs of work (PoWs), and difficult to make sense of these tion. A control policy determines they usually involve fewer nodes. systems, their properties, and how who may participate in the evolu- Gencer et al. show that permission- they compare. Through exploring tion of the blockchain and how new less blockchains (such as Bitcoin the origins of these technologies, blocks may potentially be appended and Ethereum) are much more cen- including David Chaum’s 1979 vault to the blockchain. A consensus policy tralized than many people assume: system, we provide insights and a determines which state of the block- 20 mining pools control 90% of the clear and useful way to think about chain is valid, resolving disputes computing power. blockchains. Our historical perspec- should conflicting possible continu- Some blockchains additionally tive distills important ideas, identi- ations appear. support the idea of smart contracts, fies enduring needs, and shows how As explained by Cachin and which execute terms of agreements changing technologies can satisfy Vukolic,2 a range of control policies between parties, possibly without those needs. This perspective will is possible, including permissioned, human intervention. These agree- consortium, private, and permis- ments might be embodied as arbi- Digital Object Identifier 10.1109/MSEC.2019.2893730 sionless blockchains. In a permis- trary computer programs including Date of publication: 20 March 2019 sioned blockchain, a body identifies conditional statements. 72 January/February 2019 Copublished by the IEEE Computer and Reliability Societies 1540-7993/19©2019IEEE Embodiments of PoW for both mining and achiev and private transaction computa- the Elements ing consensus. tions that protects individual pri- Although the seminal paper on Bit- PoW aims, in part, to defend vacy through physical security. coin appeared in 2008 (with the against Sybil attacks, in which adver- The building blocks of this system mysterious author Satoshi Naka- saries attempt to forge multiple include physically secure vaults, moto),4 most of the underlying identities and use those forged iden- existing cryptographic primi- technological ideas had arisen many tities to influence the consensus pro- tives (symmetric and asymmetric years earlier. A blockchain is a type cess. With PoW, however, a node’s encryption, cryptographic hash of distributed database, an idea that influence on the consensus process functions, and digital signatures), goes back to at least the 1970s (e.g., is proportional to its computational and a new primitive introduced by Wong11). More generally, the idea of power: forging multiple identities Chaum—threshold secret sharing.8 record keeping goes back millennia, that share the adversary’s given com- Chaum’s 1982 work went largely including to ancient Mesopotamia. putational power does not help. To unnoticed, apparently because he Kanare describes proper methods adapt to varying amounts of avail- never made any effort to publish it for scientific logging, including the able computational resources, PoW in a conference or journal, instead idea of preserving all transaction systems dynamically throttle the pursuing different approaches to records, in addition to the history difficulty of the PoW problem to achieving individual privacy. of any modifications to the collected achieve a certain target rate at which In Chaum’s system, each vault data—ideas that are found in many the problems are solved. signs, records, and broadcasts each systems (e.g., Hyperledger Fabric). Permissioned blockchains can be transaction it processes. Chaum The idea of immutably chaining modeled using the concept of (Byz- states, “Because the aggregate blocks of information with a cryp- antine fault-tolerant) state machine in cludes COMPRESSED_HIS- tographic hash function appears replication, a notion proposed in TORY, the [cryptographic] check- in the 1979 dissertation of Ralph 1978 by Lamport and, later, con- sum is actually ‘chained’ through the Merkle at Stanford, in which Merkle cisely formalized by Schneider. entire history of consensus states.”9 explains how information can be State machine replication specifies He further says, “Nodes remember linked in a tree structure now known what are the transactions and in and will provide all messages they as a Merkle hash tree. A linear chain what order they are processed, even have output—each vault saves all it is a special case of a tree, and a tree in the presence of (Byzantine) faults has signed, up to some limit, and will provides a more efficient way of and unreliable communications.3 supply any saved thing on request; chaining information than does a Thereby, to achieve a strong form only dead vaults can cause loss of linear chain. Subsequently, in 1990, of transaction consensus, many recently signed things.”9 Haber and Stornetta applied these permissioned systems build on the Chaum’s system embodies a ideas to time-stamp documents, cre- ideas from the 1998 Paxos protocol mechanism for achieving member- ating the company Surety in 1994. of Lamport7 (which deals only ship consistency: “Among other These prior works, however, do not with crash failures) and from the things, the algorithms must provide a include other elements and tech- 2002 Practical Byzantine Fault kind of synchronization and agree- niques of blockchain. Tolerance protocol of Castro and ment among nodes about allowing To prevent an adversary from Liskov. Nakamoto observed that new nodes into the network, remov- unduly influencing the consen- the permissionless Bitcoin system ing nodes from the network, and the sus process, many permissionless realizes Byzantine agreement in status of nodes once in the network.”9 systems require that new blocks open networks. The system also embodies a weak include a proof of computational Arguably, many of the elements form of transaction consensus, albeit work. Nakamoto’s paper cites Back’s5 of blockchains are embodied in vaguely described and apparently 2002 effective construction from David Chaum’s 1979 vault system,8 not supporting concurrent client re Hashcash. In 1992, Dwork and described in his 1982 dissertation9 quests: “If the output of one partic- Naor proposed proof of compu- at Berkeley, including detailed ular processor module is used as the tation to combat junk mail. The specifications. Chaum describes output for the entire vault, the other idea and a construction underly- the design of a distributed com- processors must be able to compare ing PoW, however, may be seen in puter system that can be estab- their output to its output, and have an initial form in 1974 in Merkle’s lished, maintained, and trusted by time to stop the output on its way puzzles,6 which Merkle proposed mutually suspicious groups. It is a through the isolation devices.”9 The to implement public-key cryptog- public record-keeping