# Panel: Least Authority's ProgPoW Audit (Devcon5)

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2020-10-09
- Duration: 41:29
- Topics: blockchain, smart contracts, distributed ledger, ethereum
- Watch: https://streameth.org/watch/yt-2jvRu8DxCoU
- YouTube: https://www.youtube.com/watch?v=2jvRu8DxCoU

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/5/least-authoritys-progpow-audit

Least Authority will present the results of the ProgPow security audit, including the auditing process used, the findings of the review and outstanding areas for further discussion. The goal of the presentation or panel would be to increase the transparency of the ProgPow audit that was performed on behalf of the Ethereum Cat Herders for the larger Ethereum community. The discussion could also extend into lessons learned by the community and how to most effectively incorporate security reviews into the development and governance processes in the Ethereum community.

Speaker(s): Tanya Karsou, Ramakrishnan Muthukrishnan, Liz Steininger
Skill level: Intermediate
Track: Security
Keywords: technical

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 5 was held in Osaka, Japan on Oct 8 - 11, 2019.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

[Applause] that's all right hi everyone I'm Vincent Jameson I work for the etherium foundation doing some DevOps core developer liaison work actually let's go I guess do intros real quick and then I'll get started on kind of an overview frog pound that will jump into some of the other stuff around it so that's my intro hi I'm Melina and I work as a programmer on the guillotine and I'm also the security lead for a foundation in regards to this very mean poster I had no authority I just Ina Garten all centralized authority all right so how many of you in here are familiar with Prague pal is that almost almost I've okay you got at least one person so I want to explain a bit so on your some other paper coming in so Prague Pal is stands for programmatic proof of work and basically in the etherium white paper it was mentioned that aetherium was designed to be Nasik resistant basically a special a specialized hardware chip that's meant to I guess in the cryptocurrency world - specific cryptocurrency algorithm so as supposed to be a resistance so there's this thing called T hash or at Nash people call it different things and it is the proof-of-work algorithm that is used in aetherium so what a 6 came online risa there in the last year I guess year and a half starting to get worried some people because they are was because Asics were originally not supposed to be on the network and there was some concerns from other cryptocurrency communities like Banaras the cash that Asics would join the network in a way that was not as altruistic as GPU mining pools or would attack the network or for the secret you know mining groups and the factor that it would push GPU miners out of the ecosystems GPU miners were pretty so that's kind of what pow-pow came from a group called infidels it was semi-anonymous created pronto the if and if death else was a crystal applying hand who's been the spokes person for prague town for this time the other developers have not been revealed since then there's been a lot of politics and some technical on Proc Palin general including some conspiracy theories some fun you know listen that back it's worth on Twitter a lot of research has been done on proc pow because of this I believe it was first made it like March of 2018 that your purse start being developed and we're here now and I guess it's November twenty hi to October and we're still talking about it so it's very I would say there's a contentious topic within the etherion community back when the core developers were deciding whether or not to implement product pal once it was at a point of being decided for implementation the core developers made the decision to implement it into a future hard fork but because there was all this noise around the development be a product how itself the back of January the etherium cat herders were assigned to have some audits done or basically to organize audits around product au and we selected at least Authority for the primarily software part of the ha audit and Bob brow as the person doing need more Hardware piece of the audit and those were completed months ago and yeah at least authority I used to talk about there and the deal and Martin has been helping with the get the pigmentation of it and also started a test net which he could talk about a little bit I think it's called Gangnam right just net for Prague how to make sure that it is viable for the network so we'll get into some discussion kind of around a little bit of the technicals a little bit of the politics and kind of like reach out to you all to see who is ask questions and where you want these topics to go so on Thrones at least Authority and then they can throw it to Martin and then we can go from there so you know we were selected basically to do this audit and we know that sometimes that what we knew we were aware this is a pretty contentious topic but we do see arable as auditors to just look and report on what we see so I'm aware we can't really offer too much in terms of what the community can do and how it should handle and everything but it was more about just reflecting on what we found with prop pal so we looked at it for I think a little bit over a month I think is about five weeks and then we produced her word got populist choice and of August or in September but it's public now so that report is out there for people to read some of the feedback that we've gotten report is that people understand it but kind of don't understand it that is just because it's really it's really we had to get into really technical stuff when doing the security on it it's really just like dig deep and try to figure out what exactly what's going on and you know we report things on a high level and then we also give suggestions of what should be potentially improved about prog Powell but I mean basically that we found that it achieves its goal of making a six basic we need to be like GPS and order to in order to work with it and so that really disadvantaged any kind of basic production to a basic advantage when they were produced so we also looked at what like the so knowing that we also wanted to really analyze what would happen the teacher in particular ways how that would be so impractical felt also that kind of extend the life of the audit information that we provide to the community so because you know there's only so much you can write about like hey this is just how it works I so we wanted to really look at that so we tried to capture some things in the report - that said if this specific hardware advancement happens in the future then this is the potential issue that might result in them more specifically that was around the light evaluation mining and then we also had some a dissertation or catch a function - and those two items seem to be the ones that are you know most up for discussion areas besides that we also did some other suggestions that are the word it's about the documentation and some of that - yeah so you all can read the report for more details we're also here to talk today if there's any specific questions about that [Music] oh really I can just mention that test them so there was a test that started a long time ago I can't accept to remember when it was it was based on in Paris apparently a ton on implementation which was later merged into the pair decline so it can be activated by a genesis for gif it was never merged into the client so they kept lines that participated intestine were basically based of guess a PR which by now is kind of staled as far as I know the Tesla is still operating and - running it they are also running it on dedicated GPU - and I don't know at this point how many folks it has transitioned through but it's quite a lot and as far as I know there's no problems with it great so yeah that's how I understood it as well so diving into the politics a little bit the latest on that I guess or actually maybe even a background so there has been some back-and-forth there's a kind of a hair that's all out there Christine might han is a very sort of magnetic figure like a controversial figure and the space because of her past affiliations and the way she's kind of handled communications and the back-and-forth that they've had with these and manufacturers which I should mention these if manufacturers at times have also been you know a little bit like us rowdy with their communication as far as being anti prog pal obviously because they're basic manufacturers they weren't going to want it so I don't really want to go in there like super detail about that but there's a lot of interesting articles and back and forth some Twitter conversations we dive into to get more information on that and I think that there are two sides to this obviously the technical and the political and the technical has been fleshed out using the audits and technical discussion and then the political side has not been fleshed out because there's a lot of very strong opinions from certain people because there's so many signs of the day it's even a debate as to whether the community is loud about it or whether it's just a few very vocal minority groups that are just really loud about it in general so it's really hard to parse that it goes out of that and as someone who's kind of community manager in the space this has been one of the hardest things to reason with is getting the signals from the community about whether or not Prague palace wanted or things like that we know the GP minors positions we know some individuals in the community their positions we for the most part of the core developers position you know the ones who have spoken out for prog pal a lot of it is kind of abstaining from an opinion as well which is a choice and is something that is important in being able to make that choice of that decision when you are deciding something so I think it is a really important discussion I think that front love you might want to do this for the panel we might want to just like have technical questions from the audience or something and discussion and then people want to throw in some politic discussion later which will probably have it because more people are more familiar with that side of it I think then that would be cool too so if anyone has questions on or the specifics that Liz mentioned or any technical questions feel free and add just if you don't mind come up to the microphone so it can be on the recording or whatever you not to show your face I'll just hit the microphone suddeniy one have any questions yet Jeff already attitude whatever so I know we can read the report from this is already but I think like one of the technical questions that I've seen coming up a couple times is this notion of like if if the creators of our cars these shadowy figures like what there's some secret basic ability you know I hear and I wonder if you could just kind of like summarize lately like basically the rough conclusion of the report on this idea of like is it possible that that the developers that would have a secret ASIC up their sleeves and on a higher level not that we can find I mean security audits aren't a perfect two thing we look if we spend a certain amount of time and we look as hard as we can also Bob spent months also who was looking at the hardware and he really liked I mean our team was communicating with him too and we really dug into some things and that's how we came up with even the weight evaluation from that one supply chain attack manufacturing side attacks if we can do certain things but experiment this project is concerned it cannot really affect anything [Music] effect anything more than that [Music] that is like currently we have cash from the cash so cash is a star like 30 and we just argued and disclosed and technicality damn this is much bigger like 4gb start with 1gb of something attempted crows or dime now what if you can evaluate the tag on the fly so currently the bag is pre and later before a period and then for the next period you pre calculate the tag and switch to it so that you don't suffer any delay since it's the new video so now what if you can calculate the tag on the fly from the cache so for that you need to store these and dev cash or check so right now the or cheapness Ram is very expensive or harder so it's very expensive I am right now you see the current cpus and gpus are a few kilobytes there is also the power memory much higher than the power to access the internal memory so there is a big advantage when things are in the internal ram so now according to Bob who is an expert in hardware after few years maybe four or five years down the line maybe 20 23 24 we may see higher and higher capacity as our cheapest trap or it will become cost-effective to put SRAM more and more as our disappeared or the die so that is probably point these attacks are the more practical so there are ways to mitigate that you can equal to increase the number of patterns that are going into the bag so the computation part of it dominates the memory part of it because if you're also doing some computation right to do FMV the values together and attach them so you could increase the number that are fetching blocks from the cache that's one way to mitigate that and also the size of the cache and the tyrosine so that would also be working against this hardware advances because on one side Hardware is advancing that it will become more and more feasible to put memory more and more memory to the die whereas it should increase the cache size for example say next iteration we are going to have say 200 MB it's a time they become more difficult to put that cost will work and yes you did I it's great at this okay do they have other technical questions so when you say that there's a light mining attack or convenience like my bio is repeated like an overview or was that was that pretty much sustained okay yeah that'd be perfect I guess basically what that means right now is that it's not possible right now that we think it could be possible in five four to five years but there is a mitigation strategy that can be implemented now and it also affects - not just brought about the key - to pull anyone else yeah sure I mean this might be too broad but like [Music] so Rob how is a variation of you - it wasn't it's implemented in Java it's been a few months of some of this may be a bit rusty remember from my memory but so first you need to get some seed values in your mixers from this dag and that's where the main memory access comes from and then a low goes up and you start asking 32 lanes in each one of those lanes there's like some 16 or 32 things that you do of math these parameters change all the time so I'm sure anything that goes wrong but with some of the numbers to do some math and to do that math you also take in each lane stuff from various parts of the dag all over the place to do that math and you do this some number of times you know there's more and there are math executions right now so you do this and each lane is entirely independent there's like supposed to be 32 lanes I think you're 16 so each independent ake its math from its mix take take some stuff from the deck do some math together and then send it to another lane and you knew this about 30 or 40 times you get that mixed date together so it's designed so that the computation is very recognizable especially in context of a GPU architecture and it saturates the whole GPU by using all of the functions of GPU might have except for floating point because floating point is kind of emerging across all the vendors integers is you know if you can't an integer math you should get out of computer science it's pretty simple pulling points is where things get weird so they love that out of the spec because it's not certain enough so you take all that stuff you catch it together at the end and take that final hash take your on a file to check hash against it and then that's what you that's the results of your of the hash that you get and then you do the regular old mining stuff where you check it against the difficulty see if it's successful enough if not it hits it back and if you're a miner out there you have a less difficult than the cult's you do to prove that you tried and failed so there's you know the regular old mining techniques that go on from that but that's a high-level overview of kind of what happens I have code so that's also how its implemented in go theremin parity when you implement this for a chip you there's also this internal period on the books I think you need a way to get you know and then okay okay for later for the for the next spec of work pot and yet one of the reasons there the gift program hasn't emerges that we're not sure if we should march the oh nine one or mine next anyway so the thing is on if you run from GPU what to do is that every 50 blocks you recompile the GPU program and you reprogram the GPU for the next 50 blocks and that's the kind of programmatic part and this sheet that you use can do but which makes it harder to implement this as a that's a specific server circuit amazing totally I mean please get the program apart so many many reasons but one of the interesting things that one of the implementations found is the actually found a bug in a GPU compiler when they were running the program and had a very simple fix by the thing about these programs as they are the it's not really random and pseudo-random and the seed is the block number of the period that's going on with it so you can totally run all your combinations up to you know 10 million 20 million blocks to make sure that your CPU can handle it so you know there's some can there were some concerned initially that this might break you know the CPU things are at our risk and any responsible minor what you know be running these programs out and they are tuned advanced to see it stuff blows up or you know they just have you just need to have one rig to test to make sure that your stuff works awesome answers alright any other questions [Music] I just wonder are all the is all the controversy non-technical are there any technical controversies and then I was curious about your description of the tests that it seemed to me you would you want to have a very rigorous test matter in such a realistic to understand first it's our second question first so in general we'll need to set up the test and tried a new hard work what we want is a very lively test then so that we can like for example for crops done and then we can execute transaction and see that the execution of transaction still happens the way they would the way they showed them that the variable sensors for profile that's hopefully not needed at all the only thing that we wanted to verify is the envelope of the blocks the proof of work and the verification and the mining of this work so we totally don't care anything at all about the content of the gloves so as long as it's what we wanted to do was to get maximum coverage of transitions because we realized that they are one one of the interesting points where things could break is an epoch transitions because that's when attack changes and if I recall correctly there was there is some minor tweak to improve power which made it interesting to just see that we would be able to manage moving across epochs and this whole thing about the clock period of 5050 works so that the main concern about the test nut is to have it running over long sequence of blocks and have GPU - mine them and then it doesn't really matter how many clients are and not even matters which kinds are only tested as long as at some point when we take apart implementation we check that yeah I can import block zero to two million and it's very priced correctly it doesn't need to do it in real time as the books come along I'll take some of the technical controversy questions that's what I was fairly new to a core development when paka was really getting its main push so I was drawn to that and I want to make sure that you know that there are any technical concerns of those that iron out too quick I'm one of the first poems that had is the spec was initially written was it really clean room implementable it was depending upon code blocks and test vectors that weren't very well SPECT out test wise so I went and I implemented in Java I had to use Powell's implementation to get some test vectors out of it severe point know Java has got some of its own issues it doesn't have unsigned integers which you know is where most of my bugs came from but from those I was able to create some some unit tests and some data tests for transition to prove that you can get the particular blocks in it there's so many different functions there's there's a test vector now for each of the functions and that's what was needed so I tighten up some of that and the bit I mentioned about the concern about compiler bugs was another technical controversy but that is you know basically how good are miners at their DevOps I mean this is their business the only thing is there's another thing that they might need to pay attention to but you know the good ones will know what's going on with it and you know these as long as your communication to each other like you know like a lot of them are it's just you know it's another thing you got to worry about that's it's totally within their own area of what they can handle so I think that covers most the technical content were you aware of any others I think someone said that nvidia gpus were faster than a MDGs and I think there was benchmarking done to prove that wrong remember it's like tweak or there was yeah there's something like that I think that's where the o9 3 spec came from can I drop some of the numbers to make sure and to say that the AMD's and the Nvidia is are stronger it's really you want it as for a particularly ambi modelers like Nvidia one is much lower than the other so the question is you know is that the Nvidia's are better detach or that Andy's worse and you know do we make it so it's you got the same sort of that adjustment and it's it's a lot more within ballpark now between those two - there's no architectural design decisions done that particularly favor Nvidia or AMD not that I know anything about how to do their architectures the big changes were to take a lot of stuff down at 32 bits and all GPUs nowadays or 32-bit GPS so if there was a 32-bit version of a particular algorithm that Sloan was preferred and that's why they went to could check at 800 is because it's 32-bit based and you put that through a GPU through the 32-bit integers those things are like optimized to know and in just blazes right through so that was part of the decisions of why they did a lot of their changes was to make it optimized for the general class of GPUs not one over the other and another technical I wouldn't say controversy per se but maybe questions still to be solved is if going from E - as moto to propound there is still the difficulty so there a theorem uses a difficulty formula which is totally dependent on the previous book and if the perfectly proper hashing engine is half as fast that means that it will take quite a bit longer find an elaborately difficult block so there will be very slow blocks unless maybe a housing or a modification to the difficult to formula difficult calculation at the point where switch is made so that's still something that can be elaborated with ensure that progress is nicely some take a picture of all of us before Martinez delete reading and then to be difficult happens sit down thanks everyone okay and yeah you got to make you next time over there longside o memory the Pokemon bubbly okay perfect all right any more technical otherwise we'll jump in the political I'll be fun there are some things you mention of the block jump if we did nothing and take about three or four hours to cut in half there's also a slight impact on the ice age and that impact there is if it only felt like two weeks to a month earlier because of the exponential nature of the ice age I think it was the third thing played it might have gone in but it's not too critical it's arrogance no worries the one happened when they when they thought the transaction rated at the beginning again it's you know we communicated another time I'll be fine or we went go ahead and do a difficulty cut combine that with a nice you know I think it'll be fine do you talk a little bit about the fvg resistance of Prague now and it's cost-effective actually try to run around FPGA I think the talked about three and the period the 50 blocks the random max period we need to recompile the program and kept a few blocks that block video is like too small to really be compiled PGA pro - and furthermore the power requirements in FPGA is a lot more that much harder looking at that so the a little bit today there exists FPGA accelerators that you can plug into the GPU to offload can change political track for bread yeah so to offer the cat's-eye calculation from the GPU to an FPGA and it so that works really well for a test that's I think two portions of catch a king so that so using one of these accelerators on it - tend to does it to make it more effective and on the pro pal it's not harder to get that kind of boost from fpga accelerator because the portion of power that is spent on that operation is a lot less okay so we have about 10 minutes left little by little less than that maybe seven so let's go into politics I guess something for the politics of it does anyone have any questions or comments I really can't real question you know what is it it's product that the last mining algorithm they beat one point ax wasn't the last algorithm so I've heard that they have a little like knobs in it you can might adjust to like make it harder yeah I don't understand it but you know for now that's a question for for the answers of that is we would even know the answer when 82.0 is happening and even then we need to know all the details which we're getting really close to having Melanie tell us about how each one point though is going to interface with either 2.0 and I believe the latest answer is it's going to be in an execution environment or an EE which will then I guess be decided if it will go indefinite for a while stills I understand it might phase out naturally or there might be a push to do everything from 1.0 2.0 where it'll be inside chard I've heard many different things as they what happening yeah so my answer to that would be most likely but it's really nice if we keep the freedom to say that hey we don't promise I think we might swap out praça we're from out with something really silly and that is trivial to implement and in a sec or we might do something totally different you never know just and realistically yeah I don't think I don't think I mean if you switch proper now I don't think it will be simple to do another switch later obvious I thought proper would be kind of controversial and pretty is the thing and most people would be like yeah whatever so anybody else anything else okay other questions yeah I just I didn't know if you know it's gonna turn me is a it's a four core contentious forward so I mean is there any evidence and I apologize I've read the report that eighty six bubble was a systemic risk to the system where there is something wrong that that poses to seventh graders is just a really appease the GPU miners and if this is you know a short term I think before we would approve a stake is all of this really needed to have one potential contentious for my personal opinions been developing over time on this and personally and this is not necessarily a community perspective but one of the most interesting I guess ideas behind this is the fact that right now the GP mining pulls the major ones we know them as then you can go to a chart of that one either scan or any of the other blog explorers and you can see it Sean pie chart it says like either mine and F to pool and spark pool and so we know them we know that spark pulls helped out in the community we know that F two pool has helped out a little bit and we know that ether mines help out a lot with the technical stuff so I guess either might would be more technical help smart pool would be both technical and community help with their initiatives to do stuff in the ecosystem when I was a co-working spaces in China and conferences educational sessions so we know they're all good actors the thing with that I always think back to this myth an era when suddenly there was a lot of hash rate that dropped off after the fork that we hadn't no idea who they were and they didn't know there was a Benares and it wasn't public so someone built an ease that they started mining on there and so they could basically do whatever they wanted to anonymously so as we know all the actors now if smart people tried to do a double spend or they tried to I used to think there might be a way that like they could mess up that's you point out a transition that is less likely now after talking to Danny Ryan but there are some things that an anonymous large percentage of hash power could do like double spending right before because they know that their investments about to drop off completely GPU miners can switch to other algorithms Asics they're stuck on ET cash nor they're stuck on product pal so it's more the only major what implemented prog pala then what do you what do they have to lose if you're anonymous and just want to do a double spend on an exchange because our conformation times are much lower so that's the best argument I've heard so far in favor of prog pound so that's kind of where I met as far as a good arguments ago and the fact that I knew shoot down the idea that we made a deal with GPU miners or that because of the issuance reduction that there was this implication that we would doing wrong pal because I know at the time there was some people saying that but I did a huge block reddit post that kind of dispelled that and included timestamps - core developer calls and things like that where we discussed not doing that so as far as this is there going to be a fork or not there's no way to know and it's going to depend on I guess my main opinion on a personal level is that there won't be because to have a successful court you need a dedicated team of developers who can at least code one client and there would be people maybe from PTC or other ports of aetherium that can pick that up but I don't see any of them speaking up right now maybe if it gets closer so most become and they'll say yeah we're ready to take on a work of this and we're married we're against this so much it's the principles of it that we're going to do it but I just haven't seen that yet so it's hard for me to believe people underestimated that with e.t.c we had never had that before again so I'm not saying it's impossible at all it's definitely possible but I don't know the percentage right now a possibility no I mean if that did happen I'd see that arising organically in that same point of e.t.c find a way yet is that there's a lot of people who can fork a repo can run continuous integration can tweak parameters may not have the ability to move them you know improve things for much beyond that that they can at least keep the network going they can do a simple and then hope together you know that I'll be behind that that's how I'd see yeah you know that contention happening they could happen it on the other direction there was actually code there was actually a developer who was on the discourse back in january/february who was about to do a prog how four can head code ready and Bates picked I don't know why he backed off they would be persuaded him the Bronco wasn't dead but he was very committed to make it happen so he actually had code in place and people in place and connections to actually or he was really good at bluffing it's hard to tell but that an actual work the other thing that happened is that there was another proposal which was sort of like okay let's maybe do one so we're not going to fool what sanitarium but what we're basically going to start from scratch we'll make a new Genesis yeah yeah that's like finding places another possibility so our time is up unfortunately I'll be in the hallway to talk we work and Martin asked right so yeah tell me on Twitter if we took a pic I'd love to see my face everywhere right so yeah thank you all for coming so much [Applause] you