Random numbers on the blockchain

[Music] so I everyone we're gonna speak about random numbers so first a small course about lactose quantum numbers should not be generated with a metal children at random and we've seen too much application just within the block cache or using multiple block cache why it's not secure when you are on classical computing you have your own computer you can use your time data in your computer most movements to get a random number I remember when I was creating my 12-inch an address they asked me to move them out to type random stuff on the keyboard and usually entropy but the problem is if you want a random number in a serum which is basically the world in future you will each end up into a different phone locally why do we need those so the basic use case is counting we use improve work we need using complex but in systems probably Stefano's Mossad is in my opinion the state of the art in terminal but in system we use for doing jewels in the project I'm working on that's what we do we need for AI to visualize machine learning algorithms so imagine you have an errand blockchain with some academic personality if you were both she fix the initiation number you could treat the III into learning valued him bad decisions the first method which we use is trusted path so you have some mr. meehan where you could plug in a wrapper on it you can directly call or a kite but the problem isn't alive every single point of failure and in case trusted party is cheating you having a way to detect it within a lot of the person using block hash but that does not work so let's go back to basic walk the graphic function if you want to compute H of X it's easy but if you want to compute X that X of X is y so into a wok basically either you start with a new ones like zero and you a and it stores and target you for the block and if not you increment announced with n equal 1 2 3 up to the point you find or call someone happy so we could say ok at the end we have ash which is random no because when you get the final block you can choose not to publish it and even worse with smart contract you can bribe the miner trust Leslie into not publishing those blocks and you don't even lose the world box well because you published it as an uncle so ok only the miner can do this attack and the effect is just what just we're rolling the number so it does not allow you to fix it to a particular value but it tells you to pay a small cost when you want through some so on and get a new one I've seen applications we are saying okay the cost is is what I have a stake in each block in my application so I can rely on the block cash to get but no because the blockage is the same for everyone so perhaps if in my application it's not water attacking my name replication the attacking a new application that was attacking but perhaps you can do an attack on all the suite application at the same time and in this case you may be more than the attack 1 meter which is really useful when you don't have rate of parties is committee machines so the IDE you generate a number locally you publish it ash you had tons of party doing that they pay a deposit and in a second phase the Reavers numbers of course you verify that the ash corresponds and the result is the extra of all random numbers and interesting property of Excel if you excel something went down with whatever is always wonderful so you just need to have at one party inputting a random number the problem is that parties can choose not to reveal and if you party does not reveal the generation is stopped so yeah you pull the Misuari deposit of the party not revealing and in for example I want to flip a coin with you that's a really good method because it's only two of us we fix the coin and if I want to solve the flip I get timed up by dribbling and I was deposited and we assume that you want to flip so that works very well but now imagine you have one thousand users which are relying on the same number and you just have one not revealing to prevent generation so you will need each party twelve you deposit equal to what at stake for all the others so this scale quadratically to the number of policies so it made me practice okay is playing poker but for other person it won't work then you have special signatures so special signatures is a scenario which is where a lot of parties get part of the key and design part snatcher and if you get at least the threshold of passive nature you combine them and you get a signature one interesting property of the Senate regime is that no matter which party are signing as long as we get a threshold we get the same signature so if it's a Oba signing or DLC or no matter what we already get this is the same signature so that's really good if you are in the honest majority model because in this case I thought about you with all and everything goes right but the problem is if you can get attack a 50 percent with party proposing to revealed a design or you walls with parties we will collude to get to know the random number and they can sum sorry by making some cash attack the other method is second cell prostate so in classical proof of stage you always subtract second cell probe walk in the classical probe walk you can paralyze it so you get one computer having a known sequel hero one was 0.1 and the more computer you have the faster you get to find a block in this one it's not the case so you start with the block cache and you a and you a and you are initiated a a so at each step you need the result of the previous step so even if you get tons of hardware you won't be faster so what does it do you it's a time lock cryptography the goal is to ensure take some time to compute the random number such as this way if you are minor and you want to get bribed or you want no tribute for yourself at the point where you have your block if you wait to know this result someone else will already published one so okay you can some source on but you don't know what you sound so so it's still random but there is still some catch because if you want to compute some second shell - something like 1 million time and you do that to me smart contract you will run into the gas limit so to solve that you need to use interactive verification I guess some of you have been at true--but foundation so that's the same concept except here it's quite simpler because we just assumed country or complicated stuff just ashes so you let every party post the result a deposit and then you have a replication game which guarantee that each party wins honest so the Challenger of a fake number all the defender of the right one will always win the challenge and when someone puts fake numbers you will possibly deposit and give thought to challenges so one charge of litigation that's assumed here for the sake of the example that I should use this one don't use that as an ash at least for example you compute you get seventeen and some of the party said 35 which is a fake cancer so you ask at this party what is the value at the nine step and he says 27 so now you know that made mistake between 0 and 9 so you ask except for it says 4 4 is correct so you know it's mistake is between 4 & 9 you ask 6 he says 24 is incorrect you guys got five and now you show 5 plus 1 is 6 not 24 so you've proven that he admits a mistake in computation but there are still some some issue with that which is that a party can put tech numbers put some deposits and okay this party won't be able to change a number but this party will be able to delay the time this number will be available so also if we implement the incentive in the challenge naively you would challenge a number and the policies we put in effect numbers would challenge is own number and make sure to lose against itself in such a way that you don't win the part of the deposit and our goal is to design a system suggest if you have even a small deposit that you can use to challenge it make challenge compared to an attacker with a large budget making tons of fake numbers as you only say okay at the first one you are going to challenge one number you win and you get alpha by deposit now you have 1.5 deposit the second step you do it again now you get two deposits and now we get to deposit so you can challenge two numbers at the same time and next step you get really posit and so over and over and you deposit is increasing exponentially of course to the point where I will finish to disprove all the numbers so the author ID is the splinter reward between each party challenging no matter which challenge is winning but there is still a catch I receive an issue where the attacker can when you challenge one of this number keep a huge part of this budget to also challenge it such as this way you will get almost all the reward you will get peanuts and you will never be able to challenge multiple numbers in any one run of challenge so or to avoid that it's with committin reveal so you commit to challenge a particular number and in a second phase you really will that you are you want it to change this one an in such a way the attacker it does not know which of his number you're going to challenge so of who we can try to challenge number one only but if he's gonna challenge a number which you have been challenged it will either loose deposit as a challenger all remove the tech number so in both cases is losing of who's in the wall scale in the worst case you have a super look he attack her and each time is getting right in the number that you can a challenge but of course they'll just relax in the worst case so we can look at what would happen in the average case and in this way from all the strategy I such an attacker could have I have include anyone which will not allow to have the number by logarithmic amount of depth so that's still a conjecture you need to prove it because you need to prove that there is no strategy are going to do that and if someone is interested by having this proof or someone as insight in this proof I would be really happy to speak about that so for this seconds are full of work within the problem which is that it takes time so it's not suited for a real-time application if you want to bet that's not a good idea Wow Oh in the rotary okay but if you want to bet in real time that's a good idea if you can wait something like one day or I guess even less that should be really interesting a method to get our numbers the Brazilian nose that kind of attack which would be an adware if you managed to get an ad were able to compute ashes order of magnitude faster than the other way of hosers you could compute it super fast and know what the number will be and its way to a block cache attack so thanks everyone and if you have a other question or inside feel free to speak with me as well there or by email [Applause] you [Music]