You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Ethereum is one of the leading proof-of-stake blockchains.
3
+
Ethereum is one of the leading Proof-of-Stake blockchains.
4
4
However, it is still vulnerable to attacks.
5
5
One such attack is the de-anonymization attack by Heimbach et al.~where an adversary could get validator IP addresses and then perform a denial-of-service attack on them.
6
6
To try and combat this attack, Ethereum has proposed the use of the Whisk protocol.
7
-
Whisk is a Single secret leader election protocol that uses a zero-knowledge proof called Curdleproofs that uses inner product arguments to prove the validity of a shuffle of validators.
8
-
This paper improves upon Curdleproofs' inner product arguments by introducing CAAUrdleproofs, which is a modified version of Curdleproofs with ideas from Springproofs as to overcome the limitations of Curdleproofs regarding the shuffle size.
7
+
Whisk is a Single Secret Leader Election protocol that uses a zero-knowledge proof called Curdleproofs that uses Inner Product Arguments to prove the validity of a shuffle of validators.
8
+
This paper improves upon Curdleproofs' Inner Product Arguments by introducing CAAUrdleproofs, which is a modified version of Curdleproofs with ideas from Springproofs as to overcome the limitations of Curdleproofs regarding the shuffle size.
9
9
We show that CAAUrdleproofs has similar proving and verifying times to Curdleproofs when the shuffle size is a power of two.
10
10
We also show that CAAUrdleproofs has a performance advantage for any shuffle size that is not a power of two, and that this advantage grows the lower the shuffle size is below a power of two.
11
11
After performing experiments, we also suggest a new shuffle size which is smaller than the current one used in Curdleproofs that would result in a smaller block overhead than the one created by the current Curdleproofs protocol.
Copy file name to clipboardExpand all lines: report/src/sections/01-introduction.tex
+6-6Lines changed: 6 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -3,27 +3,27 @@
3
3
\section{Introduction}\label{sec:introduction}
4
4
Ethereum is a decentralized blockchain platform that enables developers to build and deploy smart contracts and decentralized applications.
5
5
It is the second-largest blockchain platform by market capitalization and has a large and active developer community.
6
-
Currently working as a Proof-of-Stake protocol, block proposal opportunities are allocated to the community members willing to stake their ether cryptocurrency on entities called validators.
6
+
Currently working as a Proof-of-Stake protocol, block proposal opportunities are allocated to validators, which can be created by community members willing to stake their ether cryptocurrency.
7
7
Though, previous work from Heimbach et al., confirmed also by our previous study, shows that adversaries are able to gather validator IP addresses~\cite{heimbach2024deanonymizingethereumvalidatorsp2p,ouroldpaper}.
8
8
These can be used to perform a Denial-of-Service (DoS) attack on the validators, threatening the liveness of the blockchain~\cite{EthereumAttackDefense2024,ouroldpaper}.
9
9
10
-
In response to the potential threat, Ethereum has proposed a protocol, Whisk, which hides validators' identities making the DoS attack harder to perform~\cite{Whisk2024}.
10
+
In response to the potential threat, Ethereum has proposed a protocol, Whisk, which hides block proposers' identities making the DoS attack harder to perform~\cite{Whisk2024}.
11
11
Whisk is a Single Secret Leader Election (SSLE) protocol~\cite{10.1145/3419614.3423258}, where validators each publish a private tracker, which is used for proposer selection instead.
12
12
When proposing a block, the validator will then prove the ownership of the tracker.
13
13
To ensure that adversaries are unable to trace the tracker to specific validators, each block proposer shuffles the list of validator trackers while adding randomness to the trackers.
14
14
15
15
Making sure that this has been done correctly is essential to the protocol.
16
-
Hence, Whisk uses a proof protocol, called Curdleproofs, which is a Zero-Knowledge proof of shuffle~\cite{Curdleproofs}.
16
+
Hence, Whisk uses a proof protocol, called Curdleproofs, which is a Zero-Knowledge Proof of Shuffle~\cite{Curdleproofs}.
17
17
Therefore, the block proposer constructs such a proof, adds it to the block, after which other validators can verify the proof.
18
18
19
-
This introduces block size overhead to the blockchain.
19
+
This introduces a block size overhead to the blockchain.
20
20
Also, additional work is required for both provers and verifiers.
21
21
22
22
In this paper, we dive into the structure of Curdleproofs to understand, where the protocol can be optimized.
23
-
Specifically, we work with the concept of Inner Product Arguments (IPA) and how they generally only work for vector sizes that are powers of two.
23
+
Specifically, we work with the concept of Inner Product Arguments (IPAs) and how they generally only work for vector sizes that are powers of two.
24
24
25
25
Our protocol, CAAUrdleproofs, aims to improve on the rigid nature of Curdleproofs.
26
-
Following this, we also provide argumentation of in which conditions CAAUrdleproofs is still secure.
26
+
Following this, we also provide argumentation of the conditions in which CAAUrdleproofs is still secure.
27
27
28
28
Working with this led to the following contributions:
The proposer~\gls{dos} attack is a type of attack that targets the block proposers, making them unable to propose blocks.
92
92
An adversary can use the proposer~\gls{dos} attack to prevent a proposer from receiving rewards, gotten from proposing a block, and increase their own rewards~\cite{EthereumSSLE2024}.
93
+
The proposer~\gls{dos} is made possible by an attack on the Ethereum network that was discovered by Heimbach et al.~\cite{heimbach2024deanonymizingethereumvalidatorsp2p} in which they deanonymize validators and get their IP addresses.
94
+
In our preliminary work~\cite{ouroldpaper}, we show that the attack is still possible to perform on the Ethereum network.
93
95
As a response to the proposer~\gls{dos} attack, Ethereum proposed a new protocol called Whisk~\cite{Whisk2024} as an attempt to mitigate the attack.
94
-
An attack on the Ethereum network that was discovered by Heimbach et al.~\cite{heimbach2024deanonymizingethereumvalidatorsp2p} is the deanonymization attack on validators.
95
-
In our preliminary work~\cite{ouroldpaper}, we show that the attack is still possible to perform on the Ethereum network, and using the attack, a proposer~\gls{dos} can be performed.
96
-
97
96
98
97
Whisk is a~\gls{zk}~\gls{ssle} system that uses a~\gls{zk} argument called Curdleproofs~\cite{Curdleproofs} to verify the correctness of a shuffle with size $\ell$ without revealing the input or output~\cite{10.1145/3419614.3423258}.
99
-
Whisk works by selecting a list of 16,384 validator trackers and shuffles them over 8,192 slots ($\sim$1 day).
98
+
Whisk works by selecting a list of 16,384 validator trackers and then the following 8,192 block proposers shuffle them over 8,192 slots ($\sim$1 day).
100
99
Then 8,192 proposers are selected from the shuffled list to propose blocks for the next 8,192 slots while a new list is being shuffled.
101
-
This way a new list of proposers is created every day.
100
+
This way, a new list of proposers is created every day.
102
101
After each shuffle, Whisk uses a~\gls{zkp} to prove that the shuffle is correct.
103
-
This is so that the proposer can prove that they are the correct proposer for the slot without revealing their identity, thereby mitigating the proposer~\gls{dos} attack because of the identity of the upcoming proposers being hidden now.
102
+
As the specific shuffle is hidden to prevent adversarial tracking, this is done to ensure that the trackers are shuffled according to protocol specifications.
103
+
Whenever a proposer is chosen, they can prove that they are the correct proposer for the slot without revealing their identity.
104
+
Thereby, Whisk mitigates the proposer~\gls{dos} attack because of the identity of the upcoming proposers being hidden now.
104
105
105
-
Curdleproofs is a~\gls{zkp} system that allows a prover to prove knowledge of a shuffle without revealing how it shuffled the elements.
106
+
Curdleproofs is a~\gls{zkp} system, used by Whisk, that allows a prover to prove knowledge of a shuffle without revealing how it shuffled the elements.
106
107
It does so by using three different~\glspl{zkp}, with one of them relying on two more~\glspl{zkp}.
107
108
The overview can be seen in~\autoref{fig:curdleproof-protocol}.
The prover has proven the existence of the permutation.
173
-
Now, the goal of the~\gls{samemsm} argument is to prove that the output ciphertext set was constructed with the same permutation,$\sigma$, here called multiscalar $\mathbf{v}$\footnote{Denoted as $\mathbf{c}$ in the Curdleproofs paper but changed for readability}, committed to in commitment $A$.
174
-
Note, therefore, that $A$ in~\gls{sameperm} and~\gls{samemsm} is the same commitment, where $\mathbf{v}=\sigma(\mathbf{a})$
174
+
Now, the goal of the~\gls{samemsm} argument is to prove that the output ciphertext set was constructed with the same permutation,~$\sigma$, here called multiscalar $\mathbf{v}$\footnote{Denoted as $\mathbf{c}$ in the Curdleproofs paper but changed for readability}, committed to in commitment $A$.
175
+
Note, therefore, that commitment~$A$ in~\gls{sameperm} and~\gls{samemsm} is the same commitment, where $\mathbf{v}=\sigma(\mathbf{a})$.
175
176
As the multiscalar is a vector, this argument is an~\gls{ipa} by nature, contrary to the~\gls{sameperm} argument.
Therefore, the goal of the Same Scalar argument is to prove the existence of the scalar,~$k$, such that the commitment of the permuted set is equal to the commitment of the pre-permuted set multiplied by $k$.
182
183
183
184
184
-
In Chapter 6 of Curdleproofs~\cite{Curdleproofs} they explain that the proof has size~$18+10\log(\ell+4)\mathbb{G}$, $7\mathbb{F}$, where $\mathbb{G}$ is a cryptographic group point, and $\mathbb{F}$ is a field element.
185
+
In Chapter 6 of Curdleproofs~\cite{Curdleproofs} they explain that the proof has size~$(18+10\log(\ell+4))\mathbb{G}+7\mathbb{F}$, where $\mathbb{G}$ is a cryptographic group point, and $\mathbb{F}$ is a field element.
A big inspiration for the Curdleproofs protocol is bulletproofs~\cite{bunz2018bulletproofs}.
44
-
Bulletproofs is a type of range proof that uses inner product arguments to prove that a committed value is within a certain range without revealing the value itself.
45
-
Bulletproofs is in itself not a zero-knowledge proof system, but with the help of Fiat Shamir~\cite{bunz2018bulletproofs} it can be used to create a zero-knowledge proof.
46
-
Bulletproofs also has had a few iterations and improvements to increase the speed and reduce the size of the proof since it was used in curdleproofs.
47
-
48
-
One of these is Bulletproofs+~\cite{chung2022bulletproofs+} which uses a weighted inner product argument instead of the standard inner product argument to achieve a better performance.
49
-
Bulletproofs+ is also a zero-knowledge proof by itself unlike the original bulletproofs.
50
-
Trying to modify Curdleproofs with the weighted inner product argument introduces complications that would need larger modifications and is therefore not suitable.
43
+
A big inspiration for the Curdleproofs protocol is Bulletproofs~\cite{bunz2018bulletproofs}.
44
+
Bulletproofs is a type of range proof that uses~\glspl{ipa} to prove that a committed value is within a certain range without revealing the value itself.
45
+
Bulletproofs is in itself not a~\gls{zkp} system, but with the help of Fiat Shamir~\cite{bunz2018bulletproofs} it can be used to create a~\gls{zkp}.
46
+
Bulletproofs also has had a few iterations and improvements to increase the speed and reduce the size of the proof since it was used in Curdleproofs.
47
+
48
+
One of these is Bulletproofs+~\cite{chung2022bulletproofs+} which uses a~\gls{wipa} instead of the standard~\gls{ipa} to achieve a better performance.
49
+
Bulletproofs+ is also a~\gls{zkp} by itself unlike the original Bulletproofs.
50
+
Trying to modify Curdleproofs with the~\gls{wipa} introduces complications that would need larger modifications and is therefore not suitable.
51
51
This can be seen in Appendix~\ref{app:curdleproofs-weighted-inner-product-argument-modification-attempt}
52
52
53
53
A third version of the Bulletproofs protocol is Bulletproofs++~\cite{eagen2024bulletproofs++} which uses a new type of argument called the norm argument to achieve a better performance.
54
54
This comes from the prover only needing to commit to a single vector, rather than two.
55
-
Therefore, with the two vectors, $x$ and $y$ of a standard~\gls{ipa}, they need to assume$x=y$ for their protocol to work.
55
+
Therefore, with the two vectors, $x$ and $y$ of a standard~\gls{ipa}, they need to assume~$x=y$ for their protocol to work.
56
56
Then, along with the norm being weighted, which raises the same complications as with Bulletproofs+, this makes it unsuitable for Curdleproofs.
0 commit comments