Aleo的PoSW共识

1. 引言

Aleo系列，前序博客有：

• 欢迎关注Aleo
• 使用Zexe构建Aleo隐私应用——How Zero Knowledge is Rebalancing the Scales of the Internet
• Aleo系列博客——透明的代价
• Aleo系列博客——零知识密码学技术的未来
• Aleo 提供的zero knowledge primitives

Aleo采用Proof of Succinct Work共识。

Proof of Succinct Work为SNARK-based Proof of Work算法，旨在激励对SNARKs的硬件加速。

具体为：
Miner将pending交易打包，并计算a valid nonce来解决a Proof of Succinct Work puzzle。

puzzle的difficulty rate会动态调整，以反映Aleo上的miners在每秒贡献的proof数量。

• block time：是指网络生成有效区块所用的时间。基于网络的hashrate会变化。但是由blcok difficulty控制。
• block difficulty：根据最近的block times来调整，以维护整个网络的平均block time的稳定性。

解决该puzzle的miner address将的激励为：base block reward + 该区块所包含的交易的手续费。

2. Aleo中所用的曲线

Aleo中使用pairing-friendly 曲线来生成和验证proof：

*	Edwards BLS12	BLS12-377	Edwards BW6	BW6-761
Curve Type	Twisted Edwards	Barreto-Lynn-Scott	Twisted Edwards	Brezing–Weng
Scalar Field Size	251 bits	253 bits	374 bits	377 bits
Base Field Size	253 bits	377 bits	377 bits	761 bits
G1 Compressed Size*	32 bytes	48 bytes	48 bytes	96 bytes
G2 Compressed Size*	N/A	96 bytes	N/A	96 bytes

相关参数为：

• Edwards BLS12：

  • scalar field：$0x04aad957a68b2955982d1347970dec005293a3afc43c8afeb95aee9ac33fd9ff$
  • scalar field root of unity：$0x00b4b1d4c7e5e163b1af246173fdb411bdb82ac32901dcb9d289433ff2b7d5c9$
  • base field：$0x12ab655e9a2ca55660b44d1e5c37b00159aa76fed00000010a11800000000001$
  • base field root of unity：$0x0d1ba211c5cc349cd7aacc7c597248269a14cda3ec99772b3c3d3ca739381fb2$

• BLS12-377：

  • scalar field：$0x12ab655e9a2ca55660b44d1e5c37b00159aa76fed00000010a11800000000001$
  • scalar field root of unity：$0x0d1ba211c5cc349cd7aacc7c597248269a14cda3ec99772b3c3d3ca739381fb2$
  • base field：$0x01ae3a4617c510eac63b05c06ca1493b1a22d9f300f5138f1ef3622fba094800170b5d44300000008508c00000000001$
  • base field root of unity：$0x00f3c1414ef58c54f95564f4cbc1b61fee086c1fe367c33776da78169a7f3950f1bd15c3898dd1af1c104955744e6e0f$

• Edwards BW6：

  • scalar field：$0x0035c748c2f8a21d58c760b80d94292763445b3e601ea271e1d75fe7d6eeb84234066d10f5d893814103486497d95295$
  • scalar field root of unity：$0x0006ba8c867eaccf5f7e46bcdb07d0f4b2595092eedff5c5603102866827125373710874d7416d75a832273177b0e245$
  • base field：$0x01ae3a4617c510eac63b05c06ca1493b1a22d9f300f5138f1ef3622fba094800170b5d44300000008508c00000000001$
  • base field root of unity：$0x00f3c1414ef58c54f95564f4cbc1b61fee086c1fe367c33776da78169a7f3950f1bd15c3898dd1af1c104955744e6e0f$

• BW6-761：

  • scalar field：$0x01ae3a4617c510eac63b05c06ca1493b1a22d9f300f5138f1ef3622fba094800170b5d44300000008508c00000000001$
  • scalar field root of unity：$0x00f3c1414ef58c54f95564f4cbc1b61fee086c1fe367c33776da78169a7f3950f1bd15c3898dd1af1c104955744e6e0f$
  • base field：$0x0122e824fb83ce0ad187c94004faff3eb926186a81d14688528275ef8087be41707ba638e584e91903cebaff25b423048689c8ed12f9fd9071dcd3dc73ebff2e98a116c25667a8f8160cf8aeeaf0a437e6913e6870000082f49d00000000008b$
  • base field root of unity：$0x00d0f0a60a5be58cf9dfaa846595555f73a18e069ac04458d72c1d6f77d5f5c54d28be3a9f55c8155c81153f4906e9fec5a3614ac0b1d98484f3089e56574722be36179047832b0377738a6b6870f9598c391832e000739bf29a000000007ab6$

3. Proof of Succinct Work (PoSW)

PoSW为比特币SHA-based difficulty adjusting算法的变种，最关键的不同之处在于：

• 底层计算不是hash运算，而是proof of knowledge计算。

使得PoSW：

• 作为PoW来保证系统共识
• 提供verification of transaction inclusion in a given block

PoSW采用异步模式，假设大多数miners（Provers）是诚实的。

PoSW中对于relation $\mathcal{R}$ 的SNARK $(G,P,V)$ 流程为：

• 1）已知a set of (valid) transactions $T_i=t_1,...,t_n$ 和 当前state ${\text{state}}_i$：
  $\text{NewState}({\text{state}}_i,T_i)\leftarrow ({\text{state}}_{i+1},w_{i+1})$
  其中：

  • ${\text{state}}_i$：为第$i$个block的state
  • $w_{i+1}$：为auxiliary information attesting to the validity of ${\text{state}}_{i+1}$

• 2）Sample a random nonce $n$ 并计算：【$CRS$为$G$的public output】
  $P(CRS,[n,{\text{state}}_{i+1}],w_{i+1})\leftarrow {\pi }_n$

• 3）若$PRF({\pi }_n)<=d$，则设置$n_{i+1}=n$和${\pi }_{i+1}={\pi }_n$。否则返回步骤2）。【$PRF$为a pseudorandom function used to evaluate the difficulty condition。】
  $d$为难度系数，借鉴了Bitocoin和其他PoW链，会根据网络hashrate进行动态更新。It is iteratively updated based on the maximal and current targets every fixed number of blocks and guarantees constant block time.

4. PoSW共识security

PoSW设计为满足传统PoW guarantees，要求其具有a time-lock puzzle安全属性。

为了实现time-lock，要求PoSW满足：

• Amortization Resistance：即 不可摊销，不可batch操作。

4.1 Amortization Resistance（PoSW的不可batch性）

任何PoW系统的最重要特性是non-batchability，是指：

• computation of many instances of the problem should not provide substantial speed-ups to miners through the reuse of information。

Aleo采用的是Generic Group Model (GGM)，其中miners have access to an oracle $O$ performing a given hard computation in the random encoding of some group $G$。计算难度取决于miner访问oracle $O$的次数。

在setup时，定义了$ϵ$-amortization resistance 作为 the ratio of oracle queries performed by the optimal algorithm $A^O(P,n)$ computing $n=poly(n)$ proofs simultaneously versus the algorithm $A^O(P,1)$ computing each $n$ proof individually。其中$n$为proof size，$Queries(A^O)$为the number of queries $A^O$ makes to $O$，$x_i$为the (randomly sampled) $i$-th problem instance：
$ϵ\le 1-\frac{\mathsf{Q}\mathsf{u}\mathsf{e}\mathsf{r}\mathsf{i}\mathsf{e}\mathsf{s}({\mathcal{A}}_{\mathcal{P},\ell (n)}^{\mathcal{O}}(\{{\mathbf{x}}_{\mathbf{i}}{\}}_{i=1}^{\ell (n)}))}{{\sum }_{i=1}^{\ell (n)}\mathsf{Q}\mathsf{u}\mathsf{e}\mathsf{r}\mathsf{i}\mathsf{e}\mathsf{s}({\mathcal{A}}_{\mathcal{P},1}^{\mathcal{O}}({\mathbf{x}}_{\mathbf{i}}))}.$

$ϵ$为the advantage that a large miner receives due to the amortizability of the underlying puzzle。若$ϵ=0$，则没有算法可attain speedup from batching and the puzzle is perfectly amortizable。

4.2 Quantization Error & Forking Probability

与其它PoW scheme不同，PoSW底层计算可能solution (a single proof)所需时间要长于其它puzzles。因为NIZK生成proof是计算密集型的，若其与产块时间相当，会影响底层链的安全性。

4.2.1 Quantization Error

设置proof生成时间 为 a significant fraction of 产块时间，slow miner可在其finish current attempt之前 hear of a new solution，然后放弃当前其所计算的部分proof，直接开始mine新的区块。这种放弃的部分算力浪费对应为quantization error ${ϵ}_Q$：
${ϵ}_Q=1-\tau /(e^{\tau }-1)$
其中产块时间normalize为$1$，平均生成proof的时间设置为$\tau$。

注意$\tau \leftarrow 0$意味着${ϵ}_Q\leftarrow 0$。即意味着miner放弃的work趋近为0。生成proof的时间${\tau }_p$与产块时间${\tau }_b$之间的ratio $r={\tau }_p/{\tau }_b$应最小化。

4.2.2 Forking Probability

以上quantum effects将增加the number of observed collisions。若miner未同步，当收到一个区块时，会选择继续完成其当前effort。若所有miner都这么做，将影响整个网络同步。

一个mining round所期待的solution数量为一个随机变量$X\sim Po(\tau )$。

将分叉的概率上线表示为${ϵ}_F$：
${ϵ}_F<=(1-Poisson(1,\tau ))/(1-Poisson(0,\tau ))<=\tau /2$
其中，$f(q)=Possion(q,\tau )$为the PDF of $X$。

对于固定的block time，任何对proving time的改进（如硬件加速，或circuit size调整），都将降低分叉概率。

5. PoSW Predicate

PoSW circuit中的predicate用于验证the inclusion of transactions in a given block。

5.1 System State

Aleo中的system state定义为：

• a Merkle tree ${\text{Tree}}_G(h)$ of depth $h$ over a CRT function $G:\{0,1{\}}^{512}\to \{0,1{\}}^{k/2}$

其中$G$为SHA-256，$k=512$。

Aleo中的system state也可称为“state tree”，其每个leaf为the unique ID of a transaction to be processed，变量state为tree root。

PoSW circuit取 state tree中的 $q<=d$ subtree，然后计算a Merkle tree of depth $q$。 The leaves of the tree are the depth $q$ elements of the state tree ${\text{Tree}}_H(h)$, instantiated over $k$-bit leaves with a different CRT function $H:\{0,1{\}}^k\to \{0,1{\}}^{(k/2)}$ as a new PoSW tree ${\text{Tree}}_H(q)$. This layout is illustrated in the diagram on the left. For example, for KaTeX parse error: Expected '}', got '_' at position 16: G = \text{BLS12_̲377} we set $H$ as the 512-bit Pedersen CRH with output truncated to 256 bits.

对$H$的circuit implementation将mask the witness variables based on a pseudorandom seed，这将作为predicate statement的一部分。这需要满足non-amortization要求。Aleo中设置$q=3$。

5.2 Pedersen Primitives

$k$-bit Pedersen hash function over $G$ CRT hash函数定义为：
$H(G,x)={\prod }_{i=1}^k{G}_i^{x_i}$

其中$G_i$为$G$中的randomly sampled generator，$x_i$为input $x$的第$i$个bit。

该函数的CRT security可reduce为 the hardness of the DLP over group $G$。

5.2.1 Symmetric Pedersen Gadget

$k$-bit symmetric Pedersen hash定义为：
$H_{\text{sym}}(H,\rho )={\prod }_{i=1}^k{H}_i^{(1-2\cdot {\rho }_i)}$

定义$(F_{p^2}{)}^k$内的group variable $Q=(Q_x,Q_y),h_i=(h_x^i,h_y^i)$，check如下evaluations：

• 若${\rho }_i=0$，设$h_i=H_i$；否则若${\rho }_i=1$，则设$h_i=H_i^{-1}$。
• $Q_0$为identity 且 $Q_i=Q_{i-1}\ast h_i$

这需要$k$ Edwards multiplications (6 constraints each)，且需要a bit lookup for each of the $h_i$ in addition to $k$ booleanity checks。

具体见PedersenCRHGadget中的precomputed_base_symmetric_multiscalar_mul。

5.2.2 Masked Pedersen Gadget

$k$-length masked Pedersen hash function over $G$ 为 CRT hash function $H_{\text{mask}}:\{0,1{\}}^k\times \{0,1{\}}^k\times G\to G$：
$H_{\text{mask}}^{G,H}(\rho ,x,P)=P\ast {\prod }_{i=1}^k(1[x_i(+){\rho }_i=1]G_i^{2\ast x_i-1}{H}_i^{2\ast {\rho }_i-1}+1[x_i(+){\rho }_i=0]H_i^{2\ast {\rho }_i-1})$

其中$x_i$和${\rho }_i$分别为$x$和$\rho$的第$i$个bit，而$G_i$为randomly sampled generators of $G$，$(+)$为bitwise XOR operation。附加$P$变量来实现demasking操作。

定义$(F_{p^2}{)}^k$内的group variable $Q=(Q_x,Q_y),g_i=(g_x^i,g_y^i)$ 以及 $F_p^k$内布尔变量$z$，执行如下evaluations：

• 对于$2$-bit lookup，for $i\in [k]$，设置$g_i=$
  • $H_i^{-1}$ if ${\rho }_i=0$ and $x_i=0$
  • $H_i$ if ${\rho }_i=1$ and $x_i=1$
  • $G_i\ast H_i^{-1}$ if ${\rho }_i=1$ and $x_i=0$
  • $G_i^{-1}\ast H_i$ if ${\rho }_i=0$ and $x_i=1$
• $Q_0=P$ and $Q_i=Q_{i-1}\ast g_i$

这需要$k$ Edwards multiplications (6 constraints each)，且需要a $2$-bit lookup for each of the $g_i$ (2 constraints each) in addition to $k$ booleanity checks。

具体见PedersenCRHGadget中的precomputed_base_scalar_mul_masked。

5.2.3 Pedersen Hash Gadget

Aleo instantiate a circuit verifying $M$ evaluations of $H^G$ using circuit for $H_{\text{mask}}^{G,H}$ and $H_{{\text{sym}}^H}$ over $G$。注意，这些变量在$F_p$内，而$(z_x,z_y)$变量在$F_{p^2}$域，可解析为elliptic curve point in $G$。
假设$G$中的$G_i,H_i$已预计算，可作为constant被访问。

• 1）Inputs：
  $k$-length masked evaluation of $M$ Pedersen hashes的输入为：

  • for $i\in [M]$，布尔变量$x^i=\{x_1^i,\cdots ,x_k^i\}$
  • boolean seed $\rho \in \{0,1{\}}^k$为a subset of $F_p^k$

• 2）Evaluation：

  • 设置$z\leftarrow H_{\text{sym}}^H(\rho )$
  • for $i\in [M]$，设置$(o_x^i,o_y^i)=H_{\text{mask}}^{G,H}(\rho ,x^i,z)$

• 3）Output：
  The $k/2$ length set of variables $\{o_x^1,\cdots ,o_x^k\}$ in $(F_p{)}^k$ as the truncated outputs。

5.2.4 实例化

Aleo中的Pedersen Primitives采用BLS12-377作为底层group，相应的output length（point压缩格式）为$256+1=257$，Aleo 将其truncate为$256$ bits。基于的安全假设为ECDLP，相应的security level 为$\lambda \sim =128$ bits。
input length $k=512$ bits。

5.3 PoSW Circuit

PoSW tree ${\text{Tree}}_H(q)$的叶子为：subroots of the state tree’s $q$-depth nodes。
PoSW tree ${\text{Tree}}_H(q)$使用$k$-bit Pedersen hash gadget 和 seed $\rho$ 来计算root ${\text{state}}_i$。
seed 参数$\rho =PRF(stat{e}_i||n)$为伪随机函数$PRF$的输出，输入为nonce $n$ 和 tree root。

5.3.1 Seed Generation

在每个Predicate 生成seed的流程为：
1）已知输入：nonce $n\in \{0,1{\}}^{256}$ 和 ${\text{stae}}_i\in \{0,1{\}}^{256}$，输出${\rho }_0\in \{0,1{\}}^{256}$ as ${\rho }_0=BLAKE(n||{\text{state}}_i)$，其中$||$表示string拼接。
2）若${\rho }_0$的第$i$个bit ${\rho }_{0,i}$为$0$或$1$，设置$\rho$的第$(2i-1)$或第$2i$个bit分别为$10$或$01$。使得$\rho \in \{0,1{\}}^{512}$具有constant Hamming distance $256$。

这些都是在circuit之外完成的。且需要input format for every valid instance。

5.3.2 Circuit Size

5.3.2.1 Statement-Witness Definition

a valid statement $\varphi =<{\text{state}}_i,n>\in \{0,1{\}}^{512}$ 为 a subset of $F_p^{512}$，其中：
1）${\text{state}}_i\in \{0,1{\}}^{256}$ 为bitwise representation of the PoSW root node of the updated state variable。
2）$n\in \{0,1{\}}^{256}$ 为the bitwise representation of the nonce。

以上statement的witness $w$包含：

• 1）A boolean representation of $\rho \in \{0,1{\}}^{512}$
• 2）The subroot leaves $\{x_i{\}}_{i=1}^{2^q}\in \{0,1{\}}^{512}$ corresponding to ${\text{state}}_i$
• 3）Boolean representations of the intermediate node values of ${\text{Tree}}_H(q)$

5.3.2.2 Evaluations

对于root ${\text{state}}_i$和${\text{Tree}}_H(q)$的所有内部nodes，运行a computation of the $H$ gadget with the node value as output and its children as inputs。

PoSW circuit会验证${\text{Tree}}_H(q)$ 正确生成的。需要的计算量为$2^{q-1}+1$ instances of $H$。

6. Aleo的mining流程

PoSW共识中的mining算法为：modular exponentiation over some group $G$。
以$R$来表示代表PoSW circuit的relation，NIZK $(G,P,V)$，生成common reference string $CRS=G(R)$。
兴趣点在于为$P$定义一种算法，该算法具有a size $S$ precomputation string that minimizes the number of multiplications performed in $G$。

6.1 Modular Multiexponentiation

PoSW将PoW process reduce为 the hardness of exponentiation，需要计算$q$ instances of exponentiating $k$ random indices $x_{i,j}$ in $Z_p$，$(i,j)\in [q]\times [k]$ for prime $p$ of size $n=log(p)$ by some random bases $G_i$ in $G$：
$\text{MultiExp}(G_1,...,G_k,x_1,...,x_q)=({\prod }_{i=1..k}{G}_i^{x_{1,i}},...,{\prod }_{i=1..k}{G}_i^{x_{q,i}})$

算法$A=(A_1,A_2)$分为2个阶段：

• 1）$A_1$：precompute a string of $S$ group elements in $G$ from the common reference string $SRS=\{G_1,\cdots ,G_k\}$。
• 2）$A_2$：输入有$q$ sets of $k$ elements in $Z_p$，输出为$q$ outputs $\{{\pi }_1,\cdots ,{\pi }_q\}$。

对于每个bases $G_i$，计算$S/k$ exponents，并将其存入precomputation string中。这些exponents为the radix decomposition bases for $Z_p$ at the maximal permissible depth $c$。
平均来说，每个index最多需要$n/(3+log(S)-log(k)-log(n))$次multiplications for a total of $q\ast k\ast n/(log(S)-log(k)-log(n))$。这意味着the size of the precomputation string $s$ grows exponentially with a linear improvement in proving time。

6.2 Security & Miner Size

对于具有 $S=k\ast (n/c)\ast (2^c-1)$个group elements的precomputation table，每个exponentiation平均计算量为$n/c$次multiplication。但是，某些point a maximal $c^{\ast }$ is obtained that balances the communication cost of sending more precomputed elements with the cost of performing additional multiplications。因此，可假设miners work at around the level, and look at the security it implies。

Aleo评估了不同values of $c\in N_{+}$的proof生成时间。在constant block frequency场景下，可用于project what the minimal table size $S$ is for a predicate involving $k$ exponentiations to achieve sufficiently low quantization error and collision probability。

We fix $S$ and $k$ and investigate proof generation times for fixed table size. Proving times in the GM17 and Marlin provers alongside the corresponding quantization error and collision probabilities are provided below for a single-threaded desktop machine. Security is with respect to 1 minute blocks and a circuit with $k\approx 2^{13}$ exponentiations per proof.

Proof System	Proof Generation Time (s)	Quantization Error (%)	Collision Probability (%)
Marlin	4.65	3.82	3.87
GM17	0.91	0.758	0.76

6.2.1 Security Implications of Hardware Acceleartion

采用硬件加速的miner的proof生成时间将大幅缩短，因此，更多更快的miner将有助于降低quantization error和collision probabilities。也有助于网络更安全的运行。

7. PoSW 实例化

Aleo的PoSW中的proof system采用的Marlin架构。Marlin架构与non-interactive Random Oracle setting下的属性一致。

7.1 Simulation Extractability

simulation-extractable (SE) proof system 具有 a unique encoding for every valid instance-witness pair $⟨\varphi ,w⟩$。即意味着valid proofs cannot be rerandomized without explicit knowledge of a different witness for $\varphi$。否则an adversarial prover would be able to change the encoding of a proof after computation until it satisfies difficulty, which would violate the non-amortization requirement。

7.2 Reduction to an Average-Case Hard Problem

A non-amortizable prover should reduce in difficulty to a problem known (or postulated) to be non-batchable (or ‘hard’) on average。

由于当前大多数proof system采用的都是Kate commitment。因此Aleo中致力于 reduce proof computation to the problem of multi-exponentiation of a set of given (random) bases ${G_i}_{i=1}^m\in {\mathbb{G}}^m$ by a set of random indices ${x_i}_{i=1}^m\in {\mathbb{Z}}_p^m$。此时，hardness is measured in the number of queries to a multiplication oracle ${\mathcal{O}}_m$ in the given group’s encoding。
尽管该问题在unbounded space下并 non-amortizable的，但是，miners具有fixed size precomputation string，可认为其是non-amortizable的。

7.3 Predicate Design

predicate的选择对于确保以上security也至关重要。
$\mathcal{R}$ relation应满足如下属性：

• 1）Usefulness：The proof is a proof of knowledge for a statement providing inherent value to the protocol. We opt for a relation that verifies the inclusion of a set of transactions in the given block.
• 2）Computational Uniqueness：An adversary cannot find a new witness $w_2$ for $\varphi$ given knowledge of a valid instance-witness pair $⟨\varphi ,w⟩$. This ensures that the miner cannot resample witnesses for $\varphi$ to reduce computational burden.
• 3）Non-Amortization：Valid witnesses for $\mathcal{R}$ need to “look” sufficiently random to reduce to the average-case hardness of multiexponentiation. The chosen predicate achieves $ϵ=0$ (or perfect) non-amortization in this context.

7.4 Error Bounds

We set the desirable error bounds for quantization and forking error to $3\%$ and $1.5\%$ respectively. For a protocol with $1$-minute block times, this implies that average proof generation times need to be upper bounded by $\tau =1.8\approx 2$ seconds.

8. PoSW并行化

PoSW circuit支持并行化 in each of the bases that need to be exponentiated。即意味着使用并行硬件可降低proving time，也意味着更高的chain security。但是带来的问题是需要能支持large parallel computing instances的larger miners。
若底层circuit computation为inherently sequential的，则可实现Verifiable Delay Function(VDF)。

8.1 Recursion

Recursion computation可将PoSW circuit转换为sequential computation。将circuit切分为sequential proofs that ‘pass’ an intermediate set of witnesses through many sub-circuit：
每个仅需运行一小部分计算。

通过recursion，每个proof都是下一proof的输入，让subcircuit足够小，将保证最终生成的proof为几乎sequential。

8.2 Towards a VDF Construction

尽管当前的设计倾向于non-parallelizabilit，这将带来high efficiency costs due to the requirement for recursive computation。

但是，需要设计a parallelizable instance，使得可开发相应的硬件，来提供有意义的security guarantee（low collision probability due to lower proof generation times）。
随着硬件和密码学优化，recursive composition就足够了，整个协议可简单过渡为a state where the underlying proof generation is inherently sequential。

参考资料

[1] Aloe Proof of Succinct Work
[2] Incentivized Testnet Announcement
[3] Aleo 共识
[4] Aleo Mining Process
[5] Aleo PoSW并行化