Special thanks to Justin Drake and Jinglan Wang for feedback In 2014, I made a and a with a list of hard problems in math, computer science and economics that I thought were important for the cryptocurrency space (as I then called it) to be able to reach maturity. In the last five years, much has changed. But exactly how much progress on what we thought then was important has been achieved? Where have we succeeded, where have we failed, and where have we changed our minds about what is important? In this post, I'll go through the 16 problems from 2014 one by one, and see just where we are today on each one. In the end, I'll include my new picks for the hard problems of 2019. post presentation The problems are broken down into three categories: cryptographic, and hence expected to be solvable with purely mathematical techniques if they are to be solvable at all, consensus theory, largely improvements to proof of work and proof of stake, and economic, and hence having to do with creating structures involving incentives given to different participants, and often involving the application layer more than the protocol layer We see significant progress in all categories, though some more than others. Cryptographic problems Blockchain Scalability One of the largest problems facing the cryptocurrency space today is the issue of scalability ... The main concern with [oversized blockchains] is trust: if there are only a few entities capable of running full nodes, then those entities can conspire and agree to give themselves a large number of additional bitcoins, and there would be no way for other users to see for themselves that a block is invalid without processing an entire block themselves. create a blockchain design that maintains Bitcoin-like security guarantees, but where the maximum size of the most powerful node that needs to exist for the network to keep functioning is substantially sublinear in the number of transactions. Problem: Status: Great theoretical progress, pending more real-world evaluation. Scalability is one technical problem that we have had a huge amount of progress on theoretically. Five years ago, almost no one was thinking about sharding; now, sharding designs are commonplace. Aside from , we have , , , and research papers . In my own view, further progress at this point is incremental. Fundamentally, we already have a number of techniques that allow groups of validators to securely come to a consensus on much more data than an individual validator can process, as well as techniques that allow clients to indirectly verify the full validity and availability of blocks even under 51% attack conditions. ethereum 2.0 OmniLedger LazyLedger Zilliqa seemingly coming out every month These are probably the most important technologies: , allowing a small randomly selected committee to statistically stand in for the full validator set: Random sampling https://github.com/ethereum/wiki/wiki/Sharding-FAQ#how-can-we-solve-the-single-shard-takeover-attack-in-an-uncoordinated-majority-model , allowing individual nodes that learn of an error to broadcast its presence to everyone else: Fraud proofs https://bitcoin.stackexchange.com/questions/49647/what-is-a-fraud-proof , allowing validators to probabilistically prove that they individually downloaded and verified some piece of data: Proofs of custody https://ethresear.ch/t/1-bit-aggregation-friendly-custody-bonds/2236 , allowing clients to detect when the bodies of blocks that they have headers for are unavailable: . See also the newer coded Merkle trees proposal. Data availability proofs https://arxiv.org/abs/1809.09044 There are also other smaller developments like as well as "constant-factor" enhancements such as BLS signature aggregation. Cross-shard communication via receipts That said, fully sharded blockchains have still not been seen in live operation (the partially sharded Zilliqa has recently started running). On the theoretical side, there are mainly disputes about details remaining, along with challenges having to do with stability of sharded networking, developer experience and mitigating risks of centralization; fundamental technical possibility no longer seems in doubt. But the challenges that remain are challenges that cannot be solved by just thinking about them; only developing the system and seeing ethereum 2.0 or some similar chain running live will suffice. do Timestamping create a distributed incentive-compatible system, whether it is an overlay on top of a blockchain or its own blockchain, which maintains the current time to high accuracy. All legitimate users have clocks in a normal distribution around some "real" time with standard deviation 20 seconds ... no two nodes are more than 20 seconds apart. Problem: The solution is allowed to rely on an existing concept of "N nodes"; this would in practice be enforced with proof-of-stake or non-sybil tokens (see #9). The system should continuously provide a time that is within 120s (or less if possible) of the internal clock of >99% of honestly participating nodes. External systems may end up relying on this system; hence, it should remain secure against attackers controlling < 25% of nodes regardless of incentives. Status: Some progress. Ethereum has actually survived just fine with a 13-second block time and no particularly advanced timestamping technology; it uses a simple technique where a client does not accept a block whose stated timestamp is earlier than the client's local time. That said, this has not been tested under serious attacks. The recent proposal tries to improve on the status quo by allowing the client to determine the consensus on the time in the case where the client does not locally know the current time to high accuracy; this has not yet been tested. network-adjusted timestamps But in general, timestamping is not currently at the foreground of perceived research challenges; perhaps this will change once more proof of stake chains (including Ethereum 2.0 but also others) come online as real live systems and we see what the issues are. Arbitrary Proof of Computation create programs and such that runs program on input and returns the program output and a proof-of-computation and takes , and and outputs whether or not and were legitimately produced by the algorithm using . Problem: POC_PROVE(P,I) -> (O,Q) POC_VERIFY(P,O,Q) -> { 0, 1 } POC_PROVE P I O Q POC_VERIFY P O Q Q O POC_PROVE P Status: Great theoretical and practical progress. This is basically saying, build a SNARK (or STARK, or SHARK, or...). And ! SNARKs are now increasingly well understood, and are even already being used in multiple blockchains today (including on Ethereum). And SNARKs are extremely useful, both as a privacy technology (see Zcash and tornado.cash) and as a scalability technology (see , and ). we've done it tornado.cash ZK Rollup STARKDEX STARKing erasure coded data roots There are still challenges with efficiency; making arithmetization-friendly hash functions (see and for bounties for breaking proposed candidates) is a big one, and efficiently proving random memory accesses is another. Furthermore, there's the unsolved question of whether the O(n * log(n)) blowup in prover time is a fundamental limitation or if there is some way to make a succinct proof with only linear overhead as in (which unfortunately take linear time to verify). There are also ever-present risks that the existing schemes have bugs. In general, the problems are in the details rather than the fundamentals. here here bulletproofs Code Obfuscation The holy grail is to create an obfuscator O, such that given any program P the obfuscator can produce a second program O(P) = Q such that P and Q return the same output if given the same input and, importantly, Q reveals no information whatsoever about the internals of P. One can hide inside of Q a password, a secret encryption key, or one can simply use Q to hide the proprietary workings of the algorithm itself. Status: Slow progress. In plain English, the problem is saying that we want to come up with a way to "encrypt" a program so that the encrypted program would still give the same outputs for the same inputs, but the "internals" of the program would be hidden. An example use case for obfuscation is a program containing a private key where the program only allows the private key to sign certain messages. A solution to code obfuscation would be very useful to blockchain protocols. The use cases are subtle, because one must deal with the possibility that an on-chain obfuscated program will be copied and run in an environment different from the chain itself, but there are many possibilities. One that personally interests me is the ability to remove the centralized operator from by replacing the operator with an obfuscated program that contains some proof of work, making it very expensive to run more than once with different inputs as part of an attempt to determine individual participants' actions. collusion-resistance gadgets Unfortunately this continues to be a hard problem. There is continuing ongoing work in attacking the problem, one side making constructions (eg. ) that try to reduce the number of assumptions on mathematical objects that we do not know practically exist (eg. general cryptographic multilinear maps) and another side trying to make practical implementations of the desired mathematical objects. However, all of these paths are still quite far from creating something viable and known to be secure. See for a more general overview to the problem. this https://eprint.iacr.org/2019/463.pdf Hash-Based Cryptography create a signature algorithm relying on no security assumption but the random oracle property of hashes that maintains 160 bits of security against classical computers (ie. 80 vs. quantum due to Grover's algorithm) with optimal size and other properties. Problem: Status: Some progress. There have been two strands of progress on this since 2014. , a "stateless" (meaning, using it multiple times does not require remembering information like a nonce) signature scheme, was released soon after this "hard problems" list was published, and provides a purely hash-based signature scheme of size around 41 kB. Additionally, have been developed, and one can create signatures of similar size based on them. The fact that not just signatures, but also general-purpose zero knowledge proofs, are possible with just hashes was definitely something I did not expect five years ago; I am very happy that this is the case. That said, size continues to be an issue, and ongoing progress (eg. see the very recent ) is continuing to reduce the size of proofs, though it looks like further progress will be incremental. SPHINCS STARKs DEEP FRI The main not-yet-solved problem with hash-based cryptography is aggregate signatures, similar to what makes possible. It's known that we can just make a STARK over many Lamport signatures, but this is inefficient; a more efficient scheme would be welcome. (In case you're wondering if hash-based is possible, the answer is, no, you can't do anything with ) BLS aggregation public key encryption more than a quadratic attack cost Consensus theory problems ASIC-Resistant Proof of Work One approach at solving the problem is creating a proof-of-work algorithm based on a type of computation that is very difficult to specialize ... For a more in-depth discussion on ASIC-resistant hardware, see . https://blog.ethereum.org/2014/06/19/mining/ Status: Solved as far as we can. About six months after the "hard problems" list was posted, Ethereum settled on its ASIC-resistant proof of work algorithm: . Ethash is known as a memory-hard algorithm. The theory is that random-access memory in regular computers is well-optimized already and hence difficult to improve on for specialized applications. Ethash aims to achieve ASIC resistance by making memory access the dominant part of running the PoW computation. Ethash Ethash was not the first memory-hard algorithm, but it did add one innovation: it uses pseudorandom lookups over a two-level DAG, allowing for two ways of evaluating the function. First, one could compute it quickly if one has the entire (~2 GB) DAG; this is the memory-hard "fast path". Second, one can compute it much more slowly (still fast enough to check a single provided solution quickly) if one only has the top level of the DAG; this is used for block verification. Ethash has proven remarkably successful at ASIC resistance; after three years and billions of dollars of block rewards, ASICs do exist but are at best than GPUs. has been proposed as an alternative, but there is a growing consensus that ASIC-resistant algorithms will inevitably have a limited lifespan, and that ASIC resistance because it makes 51% attacks cheaper (eg. see the ). 2-5 times more power and cost-efficient ProgPoW has downsides 51% attack on Ethereum Classic Useful Proof of Work making the proof of work function something which is simultaneously useful; a common candidate is something like Folding@home, an existing program where users can download software onto their computers to simulate protein folding and provide researchers with a large supply of data to help them cure diseases. Status: Probably not feasible, with one exception. The challenge with useful proof of work is that a proof of work algorithm requires many properties: Hard to compute Easy to verify Does not depend on large amounts of external data Can be efficiently computed in small "bite-sized" chunks Unfortunately, there are not many computations that are useful that preserve all of these properties, and most computations that have all of those properties and are "useful" are only "useful" for far too short a time to build a cryptocurrency around them. do However, there is one possible exception: zero-knowledge-proof generation. Zero knowledge proofs of aspects of blockchain validity (eg. for a simple example) are difficult to compute, and easy to verify. Furthermore, they are durably difficult to compute; if proofs of "highly structured" computation become too easy, one can simply switch to verifying a blockchain's entire state transition, which becomes extremely expensive due to the need to model the virtual machine and random memory accesses. data availability roots Zero-knowledge proofs of blockchain validity provide great value to users of the blockchain, as they can substitute the need to verify the chain directly; is doing this already, albeit with a simplified blockchain design that is heavily optimized for provability. Such proofs can significantly assist in improving the blockchain's safety and scalability. That said, the total amount of computation that realistically needs to be done is still much less than the amount that's currently done by proof of work miners, so this would at best be an add-on for proof of stake blockchains, not a full-on consensus algorithm. Coda Proof of Stake Another approach to solving the mining centralization problem is to abolish mining entirely, and move to some other mechanism for counting the weight of each node in the consensus. The most popular alternative under discussion to date is "proof of stake" - that is to say, instead of treating the consensus model as "one unit of CPU power, one vote" it becomes "one currency unit, one vote". Status: Great theoretical progress, pending more real-world evaluation. Near the end of 2014, it became clear to the proof of stake community that some form of "weak subjectivity" . To maintain economic security, nodes need to obtain a recent checkpoint extra-protocol when they sync for the first time, and again if they go offline for more than a few months. This was a difficult pill to swallow; many PoW advocates still cling to PoW precisely because in a PoW chain the "head" of the chain can be discovered with the only data coming from a trusted source being the blockchain client software itself. PoS advocates, however, were willing to swallow the pill, seeing the added trust requirements as not being large. From there the path to proof of stake through long-duration security deposits became clear. is unavoidable Most interesting consensus algorithms today are fundamentally similar to , but replace the fixed set of validators with a dynamic list that anyone can join by sending tokens into a system-level smart contract with time-locked withdrawals (eg. a withdrawal might in some cases take up to 4 months to complete). In many cases (including ethereum 2.0), these algorithms achieve "economic finality" by penalizing validators that are caught performing actions that violate the protocol in certain ways (see for a philosophical view on what proof of stake accomplishes). PBFT here As of today, we have (among many other algorithms): Casper FFG: https://arxiv.org/abs/1710.09437 Tendermint: https://tendermint.com/docs/spec/consensus/consensus.html HotStuff: https://arxiv.org/abs/1803.05069 Casper CBC: https://vitalik.ca/general/2018/12/05/cbc_casper.html There continues to be ongoing refinement (eg. and ) . Eth2 phase 0, the chain that will implement FFG, is currently under implementation and enormous progress has been made. Additionally, Tendermint has been running, in the form of the for several months. Remaining arguments about proof of stake, in my view, have to do with optimizing the economic incentives, and further formalizing the . Additionally, the could still use concrete efficiency improvements. here here Cosmos chain strategy for responding to 51% attacks Casper CBC spec Proof of Storage A third approach to the problem is to use a scarce computational resource other than computational power or currency. In this regard, the two main alternatives that have been proposed are storage and bandwidth. There is no way in principle to provide an after-the-fact cryptographic proof that bandwidth was given or used, so proof of bandwidth should most accurately be considered a subset of social proof, discussed in later problems, but proof of storage is something that certainly can be done computationally. An advantage of proof-of-storage is that it is completely ASIC-resistant; the kind of storage that we have in hard drives is already close to optimal. Status: A lot of theoretical progress, though still a lot to go, as well as more real-world evaluation. There are a number of , including and . That said, these algorithms have not been tested in the wild. My own main concern is centralization: will these algorithms actually be dominated by smaller users using spare storage capacity, or will they be dominated by large mining farms? blockchains planning to use proof of storage protocols Chia Filecoin Economics Stable-value cryptoassets One of the main problems with Bitcoin is the issue of price volatility ... Problem: construct a cryptographic asset with a stable price. Status: Some progress. is now live, and has been holding stable for nearly two years. It has survived a 93% drop in the value of its underlying collateral asset (ETH), and there is now more than $100 million in DAI issued. It has become a mainstay of the Ethereum ecosystem, and many Ethereum projects have or are integrating with it. Other synthetic token projects, such as , are rapidly gaining steam as well. MakerDAO UMA However, while the MakerDAO system has survived tough economic conditions in 2019, the conditions were by no means the toughest that could happen. In the past, Bitcoin has over the course of two days; the same may happen to ether or any other collateral asset some day. Attacks on the underlying blockchain are an even larger untested risk, especially if compounded by price decreases at the same time. fallen by 75% Another major challenge, and arguably the larger one, is that the stability of MakerDAO-like systems is dependent on some underlying oracle scheme. Different attempts at oracle systems do exist (see #16), but the jury is still out on how well they can hold up under large amounts of economic stress. So far, the collateral controlled by MakerDAO has been lower than the value of the MKR token; if this relationship reverses MKR holders may have a collective incentive to try to "loot" the MakerDAO system. There are ways to try to protect against such attacks, but they have not been tested in real life. Decentralized Public Goods Incentivization One of the challenges in economic systems in general is the problem of "public goods". For example, suppose that there is a scientific research project which will cost $1 million to complete, and it is known that if it is completed the resulting research will save one million people $5 each. In total, the social benefit is clear ... [but] from the point of view of each individual person contributing does not make sense ... So far, most problems to public goods have involved centralization Additional Assumptions And Requirements: A fully trustworthy oracle exists for determining whether or not a certain public good task has been completed (in reality this is false, but this is the domain of another problem) Status: Some progress. The problem of funding public goods is generally understood to be split into two problems: the funding problem (where to get funding for public goods from) and the preference aggregation problem (how to determine what is a genuine public good, rather than some single individual's pet project, in the first place). This problem focuses specifically on the former, assuming the latter is solved (see the for work on that problem). "decentralized contribution metrics" section below In general, there haven't been large new breakthroughs here. There's two major categories of solutions. First, we can try to elicit individual contributions, giving people social rewards for doing so. My own proposal for is one example of this; another is the anti-malaria donation badges on . Second, we can collect funds from applications that have network effects. Within blockchain land there are several options for doing this: charity through marginal price discrimination Peepeth Issuing coins Taking a portion of transaction fees at protocol level (eg. through ) EIP 1559 Taking a portion of transaction fees from some layer-2 application (eg. Uniswap, or some scaling solution, or even state rent in an execution environment in ethereum 2.0) Taking a portion of other kinds of fees (eg. ENS registration) Outside of blockchain land, this is just the age-old question of how to collect taxes if you're a government, and charge fees if you're a business or other organization. Reputation systems design a formalized reputation system, including a score rep(A,B) -> V where V is the reputation of B from the point of view of A, a mechanism for determining the probability that one party can be trusted by another, and a mechanism for updating the reputation given a record of a particular open or finalized interaction. Problem: Status: Slow progress. There hasn't really been much work on reputation systems since 2014. Perhaps the best is the use of token curated registries to create curated lists of trustable entities/objects; the (yes, that's a of legitimate ERC20 tokens) is one example, and there is even an alternative interface to Uniswap ( ) that uses it as the backend to get the list of tokens and ticker symbols and logos from. Kleros ERC20 TCR token-curated registry http://uniswap.ninja Reputation systems of the subjective variety have not really been tried, perhaps because there is just not enough information about the "social graph" of people's connections to each other that has already been published to chain in some form. If such information starts to exist for other reasons, then subjective reputation systems may become more popular. Proof of excellence One interesting, and largely unexplored, solution to the problem of [token] distribution specifically (there are reasons why it cannot be so easily used for mining) is using tasks that are socially useful but require original human-driven creative effort and talent. For example, one can come up with a "proof of proof" currency that rewards players for coming up with mathematical proofs of certain theorems Status: No progress, problem is largely forgotten. The main alternative approach to token distribution that has instead become popular is ; typically, tokens are distributed at launch either proportionately to existing holdings of some other token, or based on some other metric (eg. as in the ). Verifying human creativity directly has not really been attempted, and with recent progress on AI the problem of creating a task that only humans can do but computers can verify may well be too difficult. airdrops Handshake airdrop Anti-Sybil systems A problem that is somewhat related to the issue of a reputation system is the challenge of creating a "unique identity system" - a system for generating tokens that prove that an identity is not part of a Sybil attack ... However, we would like to have a system that has nicer and more egalitarian features than "one-dollar-one-vote"; arguably, one-person-one-vote would be ideal. Status: Some progress. There have been quite a few attempts at solving the unique-human problem. Attempts that come to mind include (incomplete list!): HumanityDAO: https://www.humanitydao.org/ Pseudonym parties: https://bford.info/pub/net/sybil.pdf POAP ("proof of attendance protocol"): https://www.poap.xyz/ BrightID: https://www.brightid.org/ With the growing interest in techniques like and , the need for some kind of human-based anti-sybil system continues to grow. Hopefully, ongoing development of these techniques and new ones can come to meet it. quadratic voting quadratic funding Decentralized contribution metrics Incentivizing the production of public goods is, unfortunately, not the only problem that centralization solves. The other problem is determining, first, which public goods are worth producing in the first place and, second, determining to what extent a particular effort actually accomplished the production of the public good. This challenge deals with the latter issue. Status: Some progress, some change in focus. More recent work on determining value of public-good contributions does not try to separate determining tasks and determining quality of completion; the reason is that in practice the two are difficult to separate. Work done by specific teams tends to be non-fungible and subjective enough that the most reasonable approach is to look at relevance of task and quality of performance as a single package, and use the same technique to evaluate both. Fortunately, there has been great progress on this, particularly with the discovery of . Quadratic funding is a mechanism where individuals can make donations to projects, and then based on the number of people who donated and how much they donated, a formula is used to calculate how much they would have donated if they were perfectly coordinated with each other (ie. took each other's interests into account and did not fall prey to the tragedy of the commons). quadratic funding The difference between the amount would-have-donated and the amount actually donated for any given project is given to that project as a subsidy from some central pool (see #11 for where the central pool funding could come from). Note that this mechanism focuses on satisfying the values of some community, not on satisfying some given goal regardless of whether or not anyone cares about it. Because of the problem, this approach is likely to be much more robust to unknown unknowns. complexity of values Quadratic funding has even been tried in real life with considerable success in the . There has also been some incremental progress on improving quadratic funding and similar mechanisms; particularly, funding to mitigate collusion. There has also been work done on specification and implementation of voting technology, preventing users from proving to third parties who they voted for; this prevents many kinds of collusion and bribe attacks. recent gitcoin quadratic funding round pairwise-bounded quadratic bribe-resistant Decentralized success metrics Problem: come up with and implement a decentralized method for measuring numerical real-world variables ... the system should be able to measure anything that humans can currently reach a rough consensus on (eg. price of an asset, temperature, global CO2 concentration) Status: Some progress. This is now generally just called "the oracle problem". The largest known instance of a decentralized oracle running is , which has processed outcomes for millions of dollars of bets. such as the are another example. However, these systems still have not seen a real-world test of the forking mechanism (search for "subjectivocracy" ) either due to a highly controversial question or due to an attempted 51% attack. There is also research on the oracle problem happening outside of the blockchain space in the form of the " " literature; see for a very recent advancement in the space. Augur Token curated registries Kleros TCR for tokens here peer prediction here Another looming challenge is that people want to rely on these systems to guide transfers of quantities of assets larger than the economic value of the system's native token. In these conditions, token holders in theory have the incentive to collude to give wrong answers to steal the funds. In such a case, the system would fork and the original system token would likely become valueless, but the original system token holders would still get away with the returns from whatever asset transfer they misdirected. Stablecoins (see ) are a particularly egregious case of this. One approach to solving this would be a system that assumes that altruistically honest data providers do exist, and creating a mechanism to identify them, and only allowing them to churn slowly so that if malicious ones start getting voted in the users of systems that rely on the oracle can first complete an orderly exit. In any case, more development of oracle tech is very much an important problem. #10 New problems If I were to write the hard problems list again in 2019, some would be a continuation of the above problems, but there would be significant changes in emphasis, as well as significant new problems. Here are a few picks: same as above Cryptographic obfuscation: #4 both hash-based as well as based on post-quantum-secure "structured" mathematical objects, eg. elliptic curve isogenies, lattices... Ongoing work on post-quantum cryptography: ongoing work and refinement of , including adding privacy against the operator, adding multi-party computation in a maximally practical way, etc. Anti-collusion infrastructure: https://ethresear.ch/t/minimal-anti-collusion-infrastructure/5413 same as above, but removing the emphasis on "success metrics" and focusing on the general "get real-world data" problem Oracles: #16 same as what was written as above, but with an emphasis on a less "absolute" solution: it should be much harder to get two identities than one, but making it impossible to get multiple identities is both impossible and potentially harmful even if we do succeed Unique-human identities (or, more realistically, semi-unique-human identities): #15 : ongoing improvements are still required for practicality Homomorphic encryption and multi-party computation : DAOs are cool, but current DAOs are still very primitive; we can do better Decentralized governance mechanisms : ongoing work and refinement of Fully formalizing responses to PoS 51% attacks https://ethresear.ch/t/responding-to-51-attacks-in-casper-ffg/6363 the ideal is to charge for congestible resources inside of systems that have network effects (eg. transaction fees), but doing so in decentralized systems requires public legitimacy; hence this is a social problem along with the technical one of finding possible sources More sources of public goods funding: same as #12 above Reputation systems: In general, base-layer problems are slowly but surely decreasing, but application-layer problems are only just getting started. This article was originally published as “ “ Hard Problems in Cryptocurrency: Five Years Later
