Fully Homomorphic Encryption (FHE) is a cryptographic scheme that enables computations to be performed directly on encrypted data, as if the data were in plaintext. After all computations are performed on the encrypted data, it can be decrypted to reveal the result. The decrypted value matches the result that would have been obtained if the same computations were applied to the plaintext data. FHE supports basic operations such as addition and multiplication on encrypted numbers. Using these fundamental operations, more complex computations can be constructed, including subtraction, division, logic gates (e.g., AND, OR, XOR, NAND, MUX), and even advanced mathematical functions such as ReLU, sigmoid, and trigonometric functions (e.g., sin, cos). These functions can be implemented either as exact formulas or as approximations, depending on the trade-off between computational efficiency and accuracy. FHE enables privacy-preserving machine learning by allowing a server to process the client's data in its encrypted form through an ML model. With FHE, the server learns neither the plaintext version of the input features nor the inference results. Only the client, using their secret key, can decrypt and access the results at the end of the service protocol. FHE can also be applied to confidential blockchain services, ensuring that sensitive data in smart contracts remains encrypted and confidential while maintaining the transparency and integrity of the execution process. Other applications of FHE include secure outsourcing of data analytics, encrypted database queries, privacy-preserving searches, efficient multi-party computation for digital signatures, and more. A dynamic website version is available at (https://fhetextbook.github.io). Please report any bugs or errors to the Github issues board.
Payment Channel Networks (PCNs) are a method for improving the scaling and latency of cryptocurrency transactions. For a payment to be made between two peers in a PCN, a feasible low-fee path in the network must be planned. Many PCN path planning algorithms use a search algorithm that is a variant of Dijkstra's algorithm. In this article, we prove the correctness and computational complexity of this algorithm. Specifically, we show that, if the PCN satisfies a consistency property relating to the fees charged by payment channels, the algorithm is correct and has polynomial computational complexity. However, in the general case, the algorithm is not correct and the path planning problem is NP-hard. These newly developed results can be used to inform the development of new or existing PCNs amenable to path planning. For example, we show that the Lightning Network, which is the most widely used PCN and is built on the Bitcoin cryptocurrency, currently satisfies the above consistency property. As a second contribution, we demonstrate that a small modification to the above path planning algorithm which, although having the same asymptotic computational complexity, empirically shows better performance. This modification involves the use of a bidirectional search and is empirically evaluated by simulating transactions on the Lightning Network.
Theoretical guarantees for double spending probabilities for the Nakamoto consensus under the $k$-deep confirmation rule have been extensively studied for zero/bounded network delays and fixed mining rates. In this paper, we introduce a ruin-theoretical model of double spending for Nakamoto consensus under the $k$-deep confirmation rule when the honest mining rate is allowed to be an arbitrary function of time including the block delivery periods, i.e., time periods during which mined blocks are being delivered to all other participants of the network. Time-varying mining rates are considered to capture the intrinsic characteristics of the peer to peer network delays as well as dynamic participation of miners such as the gap game and switching between different cryptocurrencies. Ruin theory is leveraged to obtain the double spend probabilities and numerical examples are presented to validate the effectiveness of the proposed analytical method.
Research on Bitcoin (BTC) transactions is a matter of interest for both economic and network science fields. Although this cryptocurrency is based on a decentralized system, making transaction details freely accessible, making raw blockchain data analyzable is not straightforward due to the Bitcoin protocol specificity and data richness. To address the need for an accessible dataset, we present ORBITAAL, the first comprehensive dataset based on temporal graph formalism. The dataset covers all Bitcoin transactions from January 2009 to January 2021. ORBITAAL provides temporal graph representations of entity-entity transaction networks, snapshots and stream graph. Each transaction value is given in Bitcoin and US dollar regarding daily-based conversion rate. This dataset also provides details on entities such as their global BTC balance and associated public addresses.
Safety guarantees and security-latency problem of Nakamoto consensus have been extensively studied in the last decade with a bounded delay model. Recent studies have shown that PoW protocol is secure under random delay models as well. In this paper, we analyze the security-latency problem, i.e., how secure a block is, after it becomes k-deep in the blockchain, under general random delay distributions. We provide tight and explicit bounds which only require determining the distribution of the number of Poisson arrivals during the random delay. We further consider potential effects of recent Bitcoin halving on the security-latency problem by extending our results.
Marcell Dietl, Andre Gemünd, Daniel Oeltz, Felix M. Thiele · 5 authors
In this report, we introduce a novel approach to visualize extremely large graphs efficiently. Our method combines two force-directed algorithms, Kamada-Kawai and ForceAtlas2, to handle different graph components based on their node count. Additionally, we suggest utilizing the Fast Multipole method to enhance the speed of ForceAtlas2. Although initially designed for analyzing bitcoin transaction graphs, for which we present results here, this algorithm can also be applied to other crypto currency transaction graphs or graphs from diverse domains.
We analyze how secure a block is after the block becomes $k$-deep, i.e., security-latency, for Nakamoto consensus under an exponential network delay model. We provide the fault tolerance and extensive bounds on safety violation probabilities given mining rate, delay rate and confirmation rules. Next, modeling the blockchain system as a batch service queue with exponential network delay, we connect the security-latency analysis to sustainable transaction rate of the queue system. As our model assumes exponential network delay, batch service queue models give a meaningful trade-off between transaction capacity, security and latency. Our results indicate that, by simply picking $k=7$-block confirmation rule in Bitcoin instead of the convention of $k=6$, mining rate, latency and throughput can be increased sixfold with the same safety guarantees. We further consider adversarial attacks on the queue service to hamper the service process. In an extreme scenario, we consider the selfish-mining attack for this purpose and provide the maximum adversarial block ratio in the longest chain under the exponential delay model. The ratio in turn reflects the maximum rate of decrease in the sustainable transaction rate of the queue.
We study security-latency bounds for Nakamoto consensus, i.e., how secure a block is after it becomes k-deep in the chain. We improve the state-of-the-art bounds by analyzing the race between adversarial and honest chains in three different phases. We find the probability distribution of the growth of the adversarial chains under models similar to those in Guo and Ren (2022) when a target block becomes k-deep in the chain. We analyze certain properties of this race to model each phase with random walks that provide tighter bounds than the existing results. Combining all three phases provides novel upper and lower bounds for blockchains with small$\lambda \Delta $.
In this paper we describe protocols which use a standard deck of cards to provide a perfectly sound zero-knowledge proof for Hamiltonian cycles and Flow Free puzzles. The latter can easily be extended to provide a protocol for a zero-knowledge proof of many-to-many k-disjoint path coverings.
A survey is given of approaches to the problem of distributed consensus, focusing particularly on methods based on cellular automata and related systems. A variety of new results are given, as well as a history of the field and an extensive bibliography. Distributed consensus is of current relevance in a new generation of blockchain-related systems.
Smart contract risk can be defined as a financial risk of loss due to cyber attacks on or contagious failures of smart contracts. Its quantification is of paramount importance to technology platform providers as well as companies and individuals when considering the deployment of this new technology. That is why, as our primary contribution, we propose a structural framework of aggregate loss distribution for smart contract risk under the assumption of a tree-stars graph topology representing the network of interactions among smart contracts and their users. Up to our knowledge, there exist no theoretical frameworks or models of an aggregate loss distribution for smart contracts in this setting. To achieve our goal, we contextualize the problem in the probabilistic graph-theoretical framework using bond percolation models. We assume that the smart contract network topology is represented by a random tree graph of finite size, and that each smart contract is the center of a {random} star graph whose leaves represent the users of the smart contract. We allow for heterogeneous loss topology superimposed on this smart contract and user topology and provide analytical results and instructive numerical examples.
Suppose that Alice plans to buy a physical good from Bob over a programmable Blockchain. Alice does not trust Bob, so she is not willing to pay before the good is delivered off-chain. Similarly, Bob does not trust Alice, so he is not willing to deliver the good before getting paid on-chain. Moreover, they are not inclined to use the services of a trusted third-party. Traditionally, such scenarios are handled by game-theoretic escrow smart contracts, such as BitHalo. In this work, we first show that the common method for this problem suffers from a major flaw which can be exploited by Bob in order to extort Alice. We also show that, unlike the case of auctions, this flaw cannot be addressed by a commitment-scheme-based approach. We then provide a much more general result: assuming that the two sides are rational actors and the smart contract language is Turing-complete, there is no escrow smart contract that can facilitate this exchange without either relying on third parties or enabling at least one side to extort the other.∗∗A preprint of this work appeared in [1].
This paper presents several algorithms for hashing directed graphs. The algorithms given are capable of hashing entire graphs as well as assigning hash values to specific nodes in a given graph. The notion of node symmetry is made precise via computation of vertex orbits and the graph automorphism group, and nodes that are symmetrically identical are assigned equal hashes. We also present a novel Merkle-style hashing algorithm that seeks to fulfill the recursive principle that a hash of a node should depend only on the hash of its neighbors. This algorithm works even in the presence of cycles, which would not be possible with a naive approach. Structurally hashing trees has seen widespread use in blockchain, source code version control, and web applications. Despite the popularity of tree hashing, directed graph hashing remains unstudied in the literature. Our algorithms open new possibilities to hashing both directed graphs and more complex data structures that can be reduced to directed graphs such as hypergraphs.
Lăcrămioara Aştefănoaei, Pierre Chambart, Antonella Del Pozzo, Thibault Rieutord · 6 authors
First-generation blockchains provide probabilistic finality: a block can be revoked, albeit the probability decreases as the block "sinks" deeper into the chain. Recent proposals revisited committee-based BFT consensus to provide deterministic finality: as soon as a block is validated, it is never revoked. A distinguishing characteristic of these second-generation blockchains over classical BFT protocols is that committees change over time as the participation and the blockchain state evolve. In this paper, we push forward in this direction by proposing a formalization of the Dynamic Repeated Consensus problem and by providing generic procedures to solve it in the context of blockchains. Our approach is modular in that one can plug in different synchronizers and single-shot consensus. To offer a complete solution, we provide a concrete instantiation, called {{Tenderbake}}, and present a blockchain synchronizer and a single-shot consensus algorithm, working in a Byzantine and partially synchronous system model with eventually synchronous clocks. In contrast to recent proposals, our methodology is driven by the need to bound the message buffers. This is essential in preventing spamming and run-time memory errors. Moreover, {{Tenderbake}} processes can synchronize with each other without exchanging messages, leveraging instead the information stored in the blockchain.
We improve the fundamental security threshold of eventual consensus Proof-of-Stake (PoS) blockchain protocols under the longest-chain rule by showing, for the first time, the positive effect of rounds with concurrent honest leaders. Current security analyses reduce consistency to the dynamics of an abstract, round-based block creation process that is determined by three events associated with a round: (i) event $A$: at least one adversarial leader, (ii) event $S$: a single honest leader, and (iii) event $M$: multiple, but honest, leaders. We present an asymptotically optimal consistency analysis assuming that an honest round is more likely than an adversarial round (i.e., $\Pr[S] + \Pr[M] > \Pr[A]$); this threshold is optimal. This is a first in the literature and can be applied to both the simple synchronous communication as well as communication with bounded delays. In all existing consistency analyses, event $M$ is either penalized or treated neutrally. Specifically, the consistency analyses in Ouroboros Praos (Eurocrypt 2018) and Genesis (CCS 2018) assume that $\Pr[S] - \Pr[M] > \Pr[A]$; the analyses in Sleepy Consensus (Asiacrypt 2017) and Snow White (Fin. Crypto 2019) assume that $\Pr[S] > \Pr[A]$. Moreover, all existing analyses completely break down when $\Pr[S] < \Pr[A]$. These thresholds determine the critical trade-off between the honest majority, network delays, and consistency error. Our new results can be directly applied to improve the security guarantees of the existing protocols. We also provide an efficient algorithm to explicitly calculate these error probabilities in the synchronous setting. Furthermore, we complement these results by analyzing the setting where $S$ is rare, even allowing $\Pr[S] = 0$, under the added assumption that honest players adopt a consistent chain selection rule.
This paper compares mathematical models for automated market makers including logarithmic market scoring rule (LMSR), liquidity sensitive LMSR (LS-LMSR), constant product/mean/sum, and others. It is shown that though LMSR may not be a good model for Decentralized Finance (DeFi) applications, LS-LMSR has several advantages over constant product/mean based automated market makers. However, LS-LMSR requires complicated computation (i.e., logarithm and exponentiation) and the cost function curve is concave. In certain DeFi applications, it is preferred to have computationally efficient cost functions with convex curves to conform with the principle of supply and demand. This paper proposes and analyzes constant circle/ellipse based cost functions for automated market makers. The proposed cost functions are computationally efficient (only requires multiplication and square root calculation) and have several advantages over widely deployed constant product cost functions. For example, the proposed market makers are more robust against front-runner (slippage) attacks.
The blockchain data structure maintained via the longest-chain rule---popularized by Bitcoin---is a powerful algorithmic tool for consensus algorithms. Such algorithms achieve consistency for blocks in the chain as a function of their depth from the end of the chain. While the analysis of Bitcoin guarantees consistency with error $2^{-k}$ for blocks of depth $O(k)$, the state-of-the-art of proof-of-stake (PoS) blockchains suffers from a quadratic dependence on $k$: these protocols, exemplified by Ouroboros (Crypto 2017), Ouroboros Praos (Eurocrypt 2018) and Sleepy Consensus (Asiacrypt 2017), can only establish that depth $Θ(k^2)$ is sufficient. Whether this quadratic gap is an intrinsic limitation of PoS---due to issues such as the nothing-at-stake problem---has been an urgent open question, as deployed PoS blockchains further rely on consistency for protocol correctness. We give an axiomatic theory of blockchain dynamics that permits rigorous reasoning about the longest-chain rule and achieve, in broad generality, $Θ(k)$ dependence on depth in order to achieve consistency error $2^{-k}$. In particular, for the first time, we show that PoS protocols can match proof-of-work protocols for linear consistency. We analyze the associated stochastic process, give a recursive relation for the critical functionals of this process, and derive tail bounds in both i.i.d. and martingale settings via associated generating functions.
Alessio Meneghetti, Armanda Ottaviano Quintavalle, Massimiliano Sala, Alessandro Tomasi
Digital notarization is one of the most promising services offered by modern blockchain-based solutions. We present a digital notary design with incremental security and cost reduced with respect to current solutions. A client of the service receives evidence in three steps. In the first step, evidence is received almost immediately, but a lot of trust is required. In the second step, less trust is required, but evidence is received seconds later. Finally, in the third step evidence is received within minutes via a public blockchain.
Francesco Bortolussi, Zeger Hoogeboom, Frank W. Takes
Cryptocurrencies such as Bitcoin and Ethereum have recently gained a lot of popularity, not only as a digital form of currency but also as an investment vehicle. Online marketplaces and exchanges allow users across the world to convert between dozens of different cryptocurrencies and regular currencies such as euros or dollars. Due to the novelty of this concept, the volatility of these markets and the differences in maturity and usage of particular marketplaces, currency pairs may appear at multiple marketplaces but at different trading prices. This paper proposes a novel algorithmic approach to take advantage of these mispricings and capitalize upon the pricing differences that exist between exchanges and currency pairs. To do so, we model each combination of a currency and a market as one node in a graph. A directed link between two nodes indicates that a conversion between these two currency/market pairs is possible. The weight of the link relates to the exchange rate of executing this particular currency exchange. To leverage the mispricings, we seek for cycles in the graph such that upon multiplying the weights of the links in the cycle, a value greater than 1 is found and thus a profit can be made. Our goal is to do this efficiently, without exhaustively enumerating all possible cycles in the graph. Therefore, we convert our data and address the problem in terms of finding minimum weight triangles in graphs with integer weights, for which efficient algorithms can be utilized. We experiment with parameter settings (heuristics) related to the conversion of exchange rate data into integer weight values. We show that our approach improves upon a reasonable baseline algorithm in terms of computation time. Furthermore, using a real-world dataset, we demonstrate how the obtained minimal weight cycles indeed unveil a number of currency exchange cycles that result in a net profit.
We are proposing two greedy and a new linear programming based approximation algorithm for the total positive influence dominating set problem in weighted networks. Applications of this problem in weighted settings include finding: a minimum cost set of nodes to broadcast a message in social networks, such that each node has majority of neighbours broadcasting that message; a maximum trusted set in bitcoin network; an optimal set of hosts when running distributed apps etc. Extensive experiments on different generated and real networks highlight advantages and potential issues for each algorithm.