diff --git a/chapters/1_intro.md.txt b/chapters/1_intro.md.txt index e3f6e7265639bbcdb00c9a830ec05a400a472cee..536c04d63568c83240a8c8ebeff87a8e89241426 100644 --- a/chapters/1_intro.md.txt +++ b/chapters/1_intro.md.txt @@ -30,4 +30,4 @@ Thus, Duniter project will associate a human to a digital identity. It will use Duniter is based on a decentralized Blockchain. This technical choice allows irreversibility of transaction and uncensorability of trades and identities. While inspired by Bitcoin, Duniter uses a Web of Trust and the Proof of Work to secure the computation network, thus making obsolete the power race model used in Bitcoin. -The first currency created through Duniter is Ğ1 (say "June"). It was created on the 8th. March 2017. This whitepaper uses Ğ1 parameters as examples ; however, one can create another libre currency with custom parameters while still using Duniter software. +The first currency created through Duniter is Ğ1, pronounced "June". It was created on the 8th. March 2017. This whitepaper uses Ğ1 parameters as examples ; however, one can create another libre currency with custom parameters while still using Duniter software. diff --git a/chapters/2_looking_at_Bitcoin.md.txt b/chapters/2_looking_at_Bitcoin.md.txt index 1a9906932e14f5353f572fa1b691425598b3659c..6ee28f6f928990bb6ee975f49e043776eb9cdfee 100644 --- a/chapters/2_looking_at_Bitcoin.md.txt +++ b/chapters/2_looking_at_Bitcoin.md.txt @@ -5,7 +5,7 @@ <!-- source : https://duniter.org/en/theoretical/ --> Duniter uses the crypto-currency concept introduced by Bitcoin[^BTC_whitepaper], which is -to use cryptographic tools such as *signatures* to create digital +to use cryptographic tools such as signatures to create digital currencies. Duniter fits this definition, but it has completely different principles than Bitcoin : the Web of Trust and the Universal Dividend . These differences are on both monetary and technical aspects. @@ -23,20 +23,20 @@ Bitcoin as an example to understand why. #### 1.1.1. Spatial asymmetry {#spatial-asymmetry} -When new Bitcoins are created, *only some Bitcoin users* (the miners) -are given new Bitcoins, while everyone else get nothing. **We believe -this is the *first* injustice.** However, some might say: +When new Bitcoins are created, only some Bitcoin users (the miners) +are given new Bitcoins, while everyone else get nothing. We believe +this is the first injustice. However, some might say: -> \"Miners used their *electricity and time* to get it!\" +> \"Miners used their electricity and time to get it!\" -\... we would answer that this work *shouldn\'t have been rewarded by -newly created Bitcoins*. New Bitcoins should be distributed to the whole -Bitcoin community. Miners should be rewared another way, but not by -money issuance. Of course, Bitcoin can\'t create money through Basic -Income since *Bitcoin users are not strongly identified*, and one might -benefit from money creation multiple times if he owned several wallets. -Duniter gets rid of this problem completely by identifying its users and -giving *the same amount of Basic Income to everyone*. +\... we would answer that this work should not have been rewarded by +newly created Bitcoins. New units should be distributed to the whole +community. Miners should be rewared another way, but not by +money issuance. Of course, Bitcoin cannot create money through Basic +Income since Bitcoin users are not strongly identified, and one might +benefit from money creation multiple times if they owned several wallets. +Duniter gets rid of this problem by identifying its users and +creating the same amount of Basic Income to everyone. #### 1.1.2. Temporal-asymmetry {#temporal-asymmetry} @@ -45,36 +45,41 @@ which means ever fewer bitcoins will be created over time until no new BTC are being generated. So, once the first adopters have mined every bitcoin, how will future joiners get Bitcoins? Just like Euros or Dollars: to get money, they will have to work for the ones who already own it. -**We believe this is the *second* injustice.** Every member of a + +We believe this is the second injustice. Every member of a monetary community should be equal concerning monetary creation, and get -the same relative amount of money over time, *even if they are a late -adopter*. Duniter aims to fix this by making the Universal Dividend -(a.k.a. *UD*) *grow by the time* (S.Laborde, 2010) according to precise rules, thus making +the same relative amount of money over time, even if they are a late +adopter. Duniter aims to fix this by making the Universal Dividend +(a.k.a. UD) grow by the time[^RTM] according to precise rules, thus making members equal toward money issuance on a half-lifespan. +Most currencies present one of these two asymmetries, including metal currencies +and mutual credit, as exposed in the RTM. + #### 1.1.3. A solution {#a-solution} -Bitcoin has taught us that *it is possible* to create a currency system +Bitcoin has taught us that it is possible to create a currency system allowing one to both create digital money and to exchange it without a -central authority. What we need to change is *the way money is issued* -so we finally have a symmetrical system. We need Bitcoin *+ Universal -Dividend*. But Universal Dividend *implies* that the community consists +central authority. What we need to change is the way money is issued +so we finally have a symmetrical system. We need **Bitcoin + Universal +Dividend**. But Universal Dividend implies that the community consists of only identified people. This is where the Web of Trust (WoT) comes -into place. This concept, introduced by cryptography with the -OpenPGP format[^OpenPGP], -allows us to identify people in a *decentralized* manner. It works as -follows: each person creates *a personal identity* that is linked to its +into place. + +This concept, introduced by cryptography with the OpenPGP format[^OpenPGP], +allows us to identify people in a decentralized manner. It works as +follows: each person creates a personal identity that is linked to its cyptographic certificate. The identity must be confirmed by others -members who use their own cryptographic key. It is that simple: **people +members who use their own cryptographic key. It is that simple: people choose who is part of the community and who is not, not a central -authority.** +authority. [^OpenPGP]: OpenPGP protocol defines standard formats for encrypted messages, signatures, private keys, and certificates for exchanging public keys. The GNU Privacy Handbook, M.Ashley, 1999 : [www.gnupg.org/gph/en/manual.html#AEN335](https://www.gnupg.org/gph/en/manual.html#AEN335) -> Duniter however won\'t use OpenPGP for its cryptographic features: -> Elliptic Curves[^Elliptic] will be used instead for the conciseness of its -> generated keys and its pratical advantages. Duniter has its own Web -> of Trust principles, that shall be exposed later. +However, Duniter will not use OpenPGP for its cryptographic features: +Elliptic Curves[^Elliptic] will be used instead for the conciseness of its +generated keys and its pratical advantages. Duniter has its own Web +of Trust principles, that will be exposed later. [^Elliptic]: High-speed high-security signatures, D.J.Bernstein, N.Duif, T.Lange, P.Schwabe, B-Y.Yang. Journal of Cryptographic Engineering 2 (2012), 77–89. [cr.yp.to/papers.html#ed25519](https://cr.yp.to/papers.html#ed25519). @@ -84,7 +89,8 @@ In Bitcoin Model, the calculation and incentive principles cause a power race : new Bitcoins are created for the owners of the most numerous, powerful (and energy-consuming) computers. This leads to a power race an places the control over the currency in the hands of the richest hardware owners. We want to make Duniter blockchain validation much less energy and hardware consuming while -keeping a strong level of security. This will be further explained later. A consequence of this choice is the participation of low-end hardware in the Duniter network, +keeping a strong level of security. This will be further explained later. A consequence of +this choice is the participation of low-end hardware in the Duniter network, leading to a better decentralization of forging operations. #### 1.2.1 What about Proof of Stake ? {#what-about-proof-of-stake} @@ -93,6 +99,6 @@ Proof of stake consensus algorythm was first introduced in 2012[^PPCoin]. The ba [^PPCoin]: PPCoin: Peer-to-Peer Crypto-Currency with Proof-of-Stake, S.King & S.Nadal, 2012 : [archive.org/details/PPCoinPaper](https://archive.org/details/PPCoinPaper) -When conceiving Duniter, the PoS algorythms had not been tested enough to be used as a fundamental base. +At the time of conceiving Duniter, the PoS algorythms had not been tested enough to be used as a fundamental base. Moreover, the principle of allowing owners of large amounts of money to validate transaction can only lead to placing power over the currency in the richests hands : this is contrary to the symmetical principles of a libre currency. diff --git a/chapters/3_blockchain.md.txt b/chapters/3_blockchain.md.txt index dfba638ae2239be0f400f465d8e3843b6285d0dd..0827c8c32283683d2145b5b2734b70d6bed30b02 100644 --- a/chapters/3_blockchain.md.txt +++ b/chapters/3_blockchain.md.txt @@ -8,19 +8,30 @@ Duniters Blockchain follows the basic principles of Bitcoins. This is essential for synchronization between peers, as to prevent double-spend attacks. However, Duniters Blockchain will store different informations than Bitcoins. -The basic use of Blockchain will be registering transactions. For this part, we use the same principles as Bitcoin : transactions have inputs (spending accounts) and outputs (receiving accounts). But contrary to Bitcoin, no *generation transaction* exists : monetary creation happens only through UD. So, in Duniters Blockchain, Inputs can be either: +The basic use of Blockchain will be registering transactions. For this part, we use the same principles as Bitcoin : transactions have inputs (spending accounts) and outputs (receiving accounts). But contrary to Bitcoin, no generation transaction exists : monetary creation happens only through UD. So, in Duniters Blockchain, Inputs can be either: * a former transaction (as in Bitcoin) * a Universal Dividend (specific to Duniter). -Duniters Web of Trust is also written in the Blockchain. The identity of each member gets registered much like transactions are, with a strong link to the time reference. Thus, the Blockchain is a representation of a space-time frame of reference, where "space" are members of the WoT and "time" the basic blockchain units : the blocks. On each point of time, one can determine which account is legitimate to create the UD, only with a blockchain analysis. +Duniters Web of Trust is also written in the Blockchain. The identity of each +member gets registered much like transactions are, with a strong link to the +time reference. Thus, the Blockchain is a representation of a space-time frame +of reference, where "space" are members of the WoT and "time" the basic blockchain +units : the blocks. On each point of time, one can determine which account is +legitimate to create the UD, only with a blockchain analysis. ### 2.1. Spam countermeasures {#spam-countermeasures} XXX These measures do not seem sufficient to me. Are there any others (in the protocol, not in the nodes) ? IP block is not an answer since one could use TOR. Peer block ? The attacker could switch its peering document regularly. XXX -An issue of most cryptocurrency projects is to prevent the common ledger from growing too much. This would require nodes to have a lot of storage and computing power to be usable. In particular, we don't want an attacker to be able to make the Blockchain grow too fast. Most projects implement transaction fees as a way to prevent this, making the attacker lose money. We don't want to introduce this mean since a currency with automatic fees on transactions is no more neutral. Several countermeasuers against such spam attacks are implemented. +An issue of most cryptocurrency projects is to prevent the common ledger from +growing too much. This would require nodes to have a lot of storage and computing +power to be usable. In particular, we don't want an attacker to be able to make the +Blockchain grow too fast. Most projects implement transaction fees as a way to prevent +this, making the attacker lose money. We don't want to introduce this mean since a +currency with automatic fees on transactions is no more neutral. Several +countermeasuers against such spam attacks are implemented. <!-- see : https://forum.duniter.org/t/sans-frais-de-transaction-comment-resister-aux-attaques/3846/25 (implemented ?)--> @@ -34,11 +45,7 @@ Fixing a minimal output amount reduces the power of an attack. Duniter deals wit The block size is always limited. While the protocol allows this limit to evolve to address scaling issues, an attacker cannot register as many transaction as they wish. -With the same goal to prevent too many transactions to get registered, while transactions can be "chained" (refer to another transaction in the same block), the chainability of transactions is limited to 5. This leaves enough space for clients to process change transactions while preventing - -#### 2.1.3. Output amounts tresholds {#output-amounts-tresholds} - -XXX This has been discussed in a [forum post](https://forum.duniter.org/t/sans-frais-de-transaction-comment-resister-aux-attaques/3846/25), but does not seem tobe implemented. Is it still on the roadmap ? XXX +With the same goal to prevent too many transactions to get registered, while transactions can be "chained" (refer to another transaction in the same block), the chainability of transactions is limited to 5. ### 2.2. Scaling {#scaling} @@ -46,15 +53,16 @@ XXX This has been discussed in a [forum post](https://forum.duniter.org/t/sans-f Most of the time, the scaling issue rises for distributed systems that should work on a very large scale. This is not the case of Duniter, for multiple reasons : * Ğ1 is the first libre currency, and is still experimental on the monetary creation principle. We don't want it to reach the whole world, we only want it to work, to validate or invalidate the RTM. Moreover, the rules chosen for the Ğ1 WoT limits its size to around 16 million members. -* Duniter's aim is to be used to create *multiple* libre currencies, that would fit local or regional economies. As a consequence, it would deal with less transactions than if it was a world-scale system. The RTM proposes a formula to calculate the exchange rate between two currencies, that could be used to create automatic exchanges for a member travelling away from their community. +* Duniter's aim is to be used to create multiple libre currencies, that would fit local or regional economies. As a consequence, it would deal with less transactions than if it was a world-scale system. The RTM proposes a formula to calculate the exchange rate between two currencies, that could be used to create automatic exchanges for a member travelling away from their community. -However, Duniter has two assets that might be used if the number of users grow. +However, Duniter has assets that will help if the number of users and transactions grow. #### 2.2.1 Dynamic block size {#dynamic-block-size} While Bitcoin has a fixed block size, Duniters blocks size can evolve. On low use of the blockchain, the maximal block size is 500 bytes. -On high use of the blockchain, the maximal block size would be 110% of the average size of the current window blocks( *current window* will be described in the PoW part). +On high use of the blockchain, the maximal block size would be 110% of the +average size of the current window blocks(see "personalised difficulty" part for more information). This way, the blocks are bounded in size, but can slowly grow if a massive and legitimate use of the blockchain needs it. The block size (in bytes) is limited as so : :::{highlight} @@ -74,7 +82,7 @@ While not available yet, this payment channel might get implemented when needed. #### 2.2.3. Unit base {#unit-base} -As the Universal Dividend grows exponentially, with time Duniter nodes would have had to deal with always largest amounts, eventually reaching the BIGINT limit. To avoid this, the amounts are expressed with a unit base in base 10. We want the UD amount te always fit in 4 digits. To manage it, the `unitbase` is updated each time the UD value reaches 100.00 : it goes from `99.99*10^(unitbase)` to `10.00*10^(unitbase+1)`. All the unit amounts are thus divided by 10. While this might seem strange, this process has already hapened in state currencies. Moreover, the amounts expressed in UD will not change. +As the Universal Dividend grows exponentially, with time Duniter nodes would have had to deal with always largest amounts, eventually reaching the BIGINT limit. To avoid this, the amounts are expressed with a unit base in base 10. We want the UD amount to always fit in 4 digits. To manage it, the `unitbase` is updated each time the UD value reaches 100.00 : it goes from `99.99*10^(unitbase)` to `10.00*10^(unitbase+1)`. All the unit amounts are thus divided by 10. While this might seem strange, this process has already hapened in state currencies. Moreover, the amounts expressed in UD will not change. With a monetary growth of 10% each year and a stable population, such a change of unit base would happen each 25 years. diff --git a/chapters/5_individualized_difficulty.md.txt b/chapters/5_individualized_difficulty.md.txt index 85360c318d8ee99e258fe8bfbd68a2f2971c8b92..3c688cd1f228497ef3c74a1f27d7e1f6240d72d7 100644 --- a/chapters/5_individualized_difficulty.md.txt +++ b/chapters/5_individualized_difficulty.md.txt @@ -39,7 +39,7 @@ ensuring the unicity of a block's creator. takes a certain amount of time, which depends on the calculating power of the whole network. This provides a common ground for defining the needed time reference. A block time is set (ie: 1 block = 5 min) and -Duniter adapts the challenge difficulty to get an *average* duration +Duniter adapts the challenge difficulty to get an average duration corresponding to this block time. ### 4.2. Only members can "mine" {#only-members-can-mine} @@ -47,7 +47,7 @@ corresponding to this block time. One of Duniter's major differences with other PoW-based cryptocurrencies is that only members are allowed to author blocks. Each block is signed with the member's private key, allowing the algorithm to determine a -*personalised difficulty*. +personalised difficulty. This personalised difficulty eliminates the rat-race for the most sophisticated and powerful mining equipment. Another benefit is the fact @@ -69,7 +69,7 @@ Example of a valid hash: ::: As you can see this hash starts with five zeros which was very hard to -achieve and took a lot of *work* for someone's computer. Hence the term +achieve and took a lot of work for someone's computer. Hence the term "proof of work". #### 4.3.2. The common difficulty {#common-difficulty} @@ -93,23 +93,23 @@ of a block is its sha256 hexadecimal hash. To understand the difficulty, we make a euclidiean division of the difficulty by 16. -Here's an example with a difficulty value of `70` : 70 // 16 = **4** with a -remainder of **6**. The valid hashes are the ones starting with four +Here's an example with a difficulty value of 70 : + +::: {.highlight} + `70 // 16 = 4` with a remainder of 6. +::: + +The valid hashes are the ones starting with four zeros and with the fifth character less than or equal to 9 (6 in hexadecimal notation). The valid hashes are then written as starting with : `0000[0-9]`. This is a bit different from Bitcoin, where the difficulty is only ruled by the number of zeroes. -> Fine, but the hash of a mined block will never change and there's no -> reason it should start with a given sequence of numbers. So how then -> can we make sure a block hash starts with exactly the sequence -> needed? +##### 4.3.2.2. The Nonce {#the-nonce} -Enter the nonce, short for "number once". When a member is forging a new +When a member is forging a new block, his computer freezes the block's content and changes the Nonce -until the hash reaches the required number of zeroes. - -##### 4.3.2.2. The Nonce {#the-nonce} +until the hash reaches the required number of zeroes. The nonce allows us to mine a new block by finding a hash. The hash value allows us to determine the difficulty level of the @@ -147,7 +147,7 @@ number of cores for the resulting PoW. Earlier in this article, we explained that the personalised difficulty is the new and key concept that sets Duniter apart from other -*PoW-based* cryptocurrencies. +PoW-based cryptocurrencies. Here is how this personalised difficulty is calculated and assigned: diff --git a/whitepaper.html b/whitepaper.html index 2514e517608accfacc8af31f92c9dba3dd632711..5e10200ec4a6852df9f6e588e123b49ed3806765 100644 --- a/whitepaper.html +++ b/whitepaper.html @@ -17,34 +17,35 @@ <p>UD(t+1) = UD(t) + c² * ( M(t) / N(t) )</p> </blockquote> <p>Duniter is based on a decentralized Blockchain. This technical choice allows irreversibility of transaction and uncensorability of trades and identities. While inspired by Bitcoin, Duniter uses a Web of Trust and the Proof of Work to secure the computation network, thus making obsolete the power race model used in Bitcoin.</p> -<p>The first currency created through Duniter is Ğ1 (say “June”). It was created on the 8th. March 2017. This whitepaper uses Ğ1 parameters as examples ; however, one can create another libre currency with custom parameters while still using Duniter software.</p> +<p>The first currency created through Duniter is Ğ1, pronounced “June”. It was created on the 8th. March 2017. This whitepaper uses Ğ1 parameters as examples ; however, one can create another libre currency with custom parameters while still using Duniter software.</p> <h2 id="state-of-the-art-bitcoin-case">1. State of the art : Bitcoin case</h2> <!-- source : https://duniter.org/en/theoretical/ --> -<p>Duniter uses the crypto-currency concept introduced by Bitcoin<a href="#fn1" class="footnote-ref" id="fnref1"><sup>1</sup></a>, which is to use cryptographic tools such as <em>signatures</em> to create digital currencies. Duniter fits this definition, but it has completely different principles than Bitcoin : the Web of Trust and the Universal Dividend . These differences are on both monetary and technical aspects.</p> +<p>Duniter uses the crypto-currency concept introduced by Bitcoin<a href="#fn1" class="footnote-ref" id="fnref1"><sup>1</sup></a>, which is to use cryptographic tools such as signatures to create digital currencies. Duniter fits this definition, but it has completely different principles than Bitcoin : the Web of Trust and the Universal Dividend . These differences are on both monetary and technical aspects.</p> <h3 id="monetary-creation-a-space-time-asymmetry">1.1. Monetary creation of Bitcoin : a space-time asymmetry</h3> <p>Space-time asymmetry refers to the relative access of individuals to newly created money<a href="#fn2" class="footnote-ref" id="fnref2"><sup>2</sup></a>. Concretely, most existing currencies (c. 2020) are both spatially and temporally asymmetrical for their users. Let's take Bitcoin as an example to understand why.</p> <h4 id="spatial-asymmetry">1.1.1. Spatial asymmetry</h4> -<p>When new Bitcoins are created, <em>only some Bitcoin users</em> (the miners) are given new Bitcoins, while everyone else get nothing. <strong>We believe this is the <em>first</em> injustice.</strong> However, some might say:</p> +<p>When new Bitcoins are created, only some Bitcoin users (the miners) are given new Bitcoins, while everyone else get nothing. We believe this is the first injustice. However, some might say:</p> <blockquote> -<p>"Miners used their <em>electricity and time</em> to get it!"</p> +<p>"Miners used their electricity and time to get it!"</p> </blockquote> -<p>... we would answer that this work <em>shouldn't have been rewarded by newly created Bitcoins</em>. New Bitcoins should be distributed to the whole Bitcoin community. Miners should be rewared another way, but not by money issuance. Of course, Bitcoin can't create money through Basic Income since <em>Bitcoin users are not strongly identified</em>, and one might benefit from money creation multiple times if he owned several wallets. Duniter gets rid of this problem completely by identifying its users and giving <em>the same amount of Basic Income to everyone</em>.</p> +<p>... we would answer that this work should not have been rewarded by newly created Bitcoins. New units should be distributed to the whole community. Miners should be rewared another way, but not by money issuance. Of course, Bitcoin cannot create money through Basic Income since Bitcoin users are not strongly identified, and one might benefit from money creation multiple times if they owned several wallets. Duniter gets rid of this problem by identifying its users and creating the same amount of Basic Income to everyone.</p> <h4 id="temporal-asymmetry">1.1.2. Temporal-asymmetry</h4> -<p>Bitcoin has an absolute limit of 21 million BTC (its unit of currency), which means ever fewer bitcoins will be created over time until no new BTC are being generated. So, once the first adopters have mined every bitcoin, how will future joiners get Bitcoins? Just like Euros or Dollars: to get money, they will have to work for the ones who already own it. <strong>We believe this is the <em>second</em> injustice.</strong> Every member of a monetary community should be equal concerning monetary creation, and get the same relative amount of money over time, <em>even if they are a late adopter</em>. Duniter aims to fix this by making the Universal Dividend (a.k.a. <em>UD</em>) <em>grow by the time</em> (S.Laborde, 2010) according to precise rules, thus making members equal toward money issuance on a half-lifespan.</p> +<p>Bitcoin has an absolute limit of 21 million BTC (its unit of currency), which means ever fewer bitcoins will be created over time until no new BTC are being generated. So, once the first adopters have mined every bitcoin, how will future joiners get Bitcoins? Just like Euros or Dollars: to get money, they will have to work for the ones who already own it.</p> +<p>We believe this is the second injustice. Every member of a monetary community should be equal concerning monetary creation, and get the same relative amount of money over time, even if they are a late adopter. Duniter aims to fix this by making the Universal Dividend (a.k.a. UD) grow by the time<a href="#fn3" class="footnote-ref" id="fnref3"><sup>3</sup></a> according to precise rules, thus making members equal toward money issuance on a half-lifespan.</p> +<p>Most currencies present one of these two asymmetries, including metal currencies and mutual credit, as exposed in the RTM.</p> <h4 id="a-solution">1.1.3. A solution</h4> -<p>Bitcoin has taught us that <em>it is possible</em> to create a currency system allowing one to both create digital money and to exchange it without a central authority. What we need to change is <em>the way money is issued</em> so we finally have a symmetrical system. We need Bitcoin <em>+ Universal Dividend</em>. But Universal Dividend <em>implies</em> that the community consists of only identified people. This is where the Web of Trust (WoT) comes into place. This concept, introduced by cryptography with the OpenPGP format<a href="#fn3" class="footnote-ref" id="fnref3"><sup>3</sup></a>, allows us to identify people in a <em>decentralized</em> manner. It works as follows: each person creates <em>a personal identity</em> that is linked to its cyptographic certificate. The identity must be confirmed by others members who use their own cryptographic key. It is that simple: <strong>people choose who is part of the community and who is not, not a central authority.</strong></p> -<blockquote> -<p>Duniter however won't use OpenPGP for its cryptographic features: Elliptic Curves<a href="#fn4" class="footnote-ref" id="fnref4"><sup>4</sup></a> will be used instead for the conciseness of its generated keys and its pratical advantages. Duniter has its own Web of Trust principles, that shall be exposed later.</p> -</blockquote> +<p>Bitcoin has taught us that it is possible to create a currency system allowing one to both create digital money and to exchange it without a central authority. What we need to change is the way money is issued so we finally have a symmetrical system. We need <strong>Bitcoin + Universal Dividend</strong>. But Universal Dividend implies that the community consists of only identified people. This is where the Web of Trust (WoT) comes into place.</p> +<p>This concept, introduced by cryptography with the OpenPGP format<a href="#fn4" class="footnote-ref" id="fnref4"><sup>4</sup></a>, allows us to identify people in a decentralized manner. It works as follows: each person creates a personal identity that is linked to its cyptographic certificate. The identity must be confirmed by others members who use their own cryptographic key. It is that simple: people choose who is part of the community and who is not, not a central authority.</p> +<p>However, Duniter will not use OpenPGP for its cryptographic features: Elliptic Curves<a href="#fn5" class="footnote-ref" id="fnref5"><sup>5</sup></a> will be used instead for the conciseness of its generated keys and its pratical advantages. Duniter has its own Web of Trust principles, that will be exposed later.</p> <h3 id="proof-of-work-mining-a-power-race">1.2. Proof-of-Work mining : a power race</h3> <p>In Bitcoin Model, the calculation and incentive principles cause a power race : new Bitcoins are created for the owners of the most numerous, powerful (and energy-consuming) computers. This leads to a power race an places the control over the currency in the hands of the richest hardware owners. We want to make Duniter blockchain validation much less energy and hardware consuming while keeping a strong level of security. This will be further explained later. A consequence of this choice is the participation of low-end hardware in the Duniter network, leading to a better decentralization of forging operations.</p> <h4 id="what-about-proof-of-stake">1.2.1 What about Proof of Stake ?</h4> -<p>Proof of stake consensus algorythm was first introduced in 2012<a href="#fn5" class="footnote-ref" id="fnref5"><sup>5</sup></a>. The basic principle is to allow the richest wallets to issue blocks, putting their coin balance as a “stake” they would lose in case of cheat.</p> -<p>When conceiving Duniter, the PoS algorythms had not been tested enough to be used as a fundamental base. Moreover, the principle of allowing owners of large amounts of money to validate transaction can only lead to placing power over the currency in the richests hands : this is contrary to the symmetical principles of a libre currency.</p> +<p>Proof of stake consensus algorythm was first introduced in 2012<a href="#fn6" class="footnote-ref" id="fnref6"><sup>6</sup></a>. The basic principle is to allow the richest wallets to issue blocks, putting their coin balance as a “stake” they would lose in case of cheat.</p> +<p>At the time of conceiving Duniter, the PoS algorythms had not been tested enough to be used as a fundamental base. Moreover, the principle of allowing owners of large amounts of money to validate transaction can only lead to placing power over the currency in the richests hands : this is contrary to the symmetical principles of a libre currency.</p> <h2 id="duniters-blockchain">2. Duniters Blockchain</h2> <!-- source : https://duniter.org/en/theoretical/ --> <p>Duniters Blockchain follows the basic principles of Bitcoins. This is essential for synchronization between peers, as to prevent double-spend attacks. However, Duniters Blockchain will store different informations than Bitcoins.</p> -<p>The basic use of Blockchain will be registering transactions. For this part, we use the same principles as Bitcoin : transactions have inputs (spending accounts) and outputs (receiving accounts). But contrary to Bitcoin, no <em>generation transaction</em> exists : monetary creation happens only through UD. So, in Duniters Blockchain, Inputs can be either:</p> +<p>The basic use of Blockchain will be registering transactions. For this part, we use the same principles as Bitcoin : transactions have inputs (spending accounts) and outputs (receiving accounts). But contrary to Bitcoin, no generation transaction exists : monetary creation happens only through UD. So, in Duniters Blockchain, Inputs can be either:</p> <ul> <li>a former transaction (as in Bitcoin)</li> <li>a Universal Dividend (specific to Duniter).</li> @@ -59,25 +60,23 @@ <p>Fixing a minimal output amount reduces the power of an attack. Duniter deals with cents of Ğ1 or 1/1000 of the first UD. An attacker could create thousand accounts with only 1 UD. To prevent this, a valid transaction must have output amounts of minimum 1Ğ1. This reduces the power an attack by 100.</p> <h4 id="limited-block-size-and-chainability">2.1.2. Limited block size and chainability</h4> <p>The block size is always limited. While the protocol allows this limit to evolve to address scaling issues, an attacker cannot register as many transaction as they wish.</p> -<p>With the same goal to prevent too many transactions to get registered, while transactions can be “chained” (refer to another transaction in the same block), the chainability of transactions is limited to 5. This leaves enough space for clients to process change transactions while preventing</p> -<h4 id="output-amounts-tresholds">2.1.3. Output amounts tresholds</h4> -<p>XXX This has been discussed in a <a href="https://forum.duniter.org/t/sans-frais-de-transaction-comment-resister-aux-attaques/3846/25">forum post</a>, but does not seem tobe implemented. Is it still on the roadmap ? XXX</p> +<p>With the same goal to prevent too many transactions to get registered, while transactions can be “chained” (refer to another transaction in the same block), the chainability of transactions is limited to 5.</p> <h3 id="scaling">2.2. Scaling</h3> <p>Most of the time, the scaling issue rises for distributed systems that should work on a very large scale. This is not the case of Duniter, for multiple reasons :</p> <ul> <li>Ğ1 is the first libre currency, and is still experimental on the monetary creation principle. We don’t want it to reach the whole world, we only want it to work, to validate or invalidate the RTM. Moreover, the rules chosen for the Ğ1 WoT limits its size to around 16 million members.</li> -<li>Duniter’s aim is to be used to create <em>multiple</em> libre currencies, that would fit local or regional economies. As a consequence, it would deal with less transactions than if it was a world-scale system. The RTM proposes a formula to calculate the exchange rate between two currencies, that could be used to create automatic exchanges for a member travelling away from their community.</li> +<li>Duniter’s aim is to be used to create multiple libre currencies, that would fit local or regional economies. As a consequence, it would deal with less transactions than if it was a world-scale system. The RTM proposes a formula to calculate the exchange rate between two currencies, that could be used to create automatic exchanges for a member travelling away from their community.</li> </ul> -<p>However, Duniter has two assets that might be used if the number of users grow.</p> +<p>However, Duniter has assets that will help if the number of users and transactions grow.</p> <h4 id="dynamic-block-size">2.2.1 Dynamic block size</h4> -<p>While Bitcoin has a fixed block size, Duniters blocks size can evolve. On low use of the blockchain, the maximal block size is 500 bytes. On high use of the blockchain, the maximal block size would be 110% of the average size of the current window blocks( <em>current window</em> will be described in the PoW part). This way, the blocks are bounded in size, but can slowly grow if a massive and legitimate use of the blockchain needs it. The block size (in bytes) is limited as so :</p> +<p>While Bitcoin has a fixed block size, Duniters blocks size can evolve. On low use of the blockchain, the maximal block size is 500 bytes. On high use of the blockchain, the maximal block size would be 110% of the average size of the current window blocks(see “personalised difficulty” part for more information). This way, the blocks are bounded in size, but can slowly grow if a massive and legitimate use of the blockchain needs it. The block size (in bytes) is limited as so :</p> <div class="{highlight}"> <p>block_size < max(500 ; CEIL(1.10 * (average block size))</p> </div> <h4 id="lightning-networks">2.2.2. Lightning Networks</h4> -<p>The Lightning Networks<a href="#fn6" class="footnote-ref" id="fnref6"><sup>6</sup></a> allow almost instant and off-chain transactions. They were first implemented on Lightcoin, and are now on Bitcoin. One of their benefits is to make the blockchain store a lot of transactions at once, thus reducing the groth of the blockchain. The Duniter protocol allows XHX() and CSV() unlock conditions that are necessary to implement Lightning Networks. While not available yet, this payment channel might get implemented when needed.</p> +<p>The Lightning Networks<a href="#fn7" class="footnote-ref" id="fnref7"><sup>7</sup></a> allow almost instant and off-chain transactions. They were first implemented on Lightcoin, and are now on Bitcoin. One of their benefits is to make the blockchain store a lot of transactions at once, thus reducing the groth of the blockchain. The Duniter protocol allows XHX() and CSV() unlock conditions that are necessary to implement Lightning Networks. While not available yet, this payment channel might get implemented when needed.</p> <h4 id="unit-base">2.2.3. Unit base</h4> -<p>As the Universal Dividend grows exponentially, with time Duniter nodes would have had to deal with always largest amounts, eventually reaching the BIGINT limit. To avoid this, the amounts are expressed with a unit base in base 10. We want the UD amount te always fit in 4 digits. To manage it, the <code>unitbase</code> is updated each time the UD value reaches 100.00 : it goes from <code>99.99*10^(unitbase)</code> to <code>10.00*10^(unitbase+1)</code>. All the unit amounts are thus divided by 10. While this might seem strange, this process has already hapened in state currencies. Moreover, the amounts expressed in UD will not change.</p> +<p>As the Universal Dividend grows exponentially, with time Duniter nodes would have had to deal with always largest amounts, eventually reaching the BIGINT limit. To avoid this, the amounts are expressed with a unit base in base 10. We want the UD amount to always fit in 4 digits. To manage it, the <code>unitbase</code> is updated each time the UD value reaches 100.00 : it goes from <code>99.99*10^(unitbase)</code> to <code>10.00*10^(unitbase+1)</code>. All the unit amounts are thus divided by 10. While this might seem strange, this process has already hapened in state currencies. Moreover, the amounts expressed in UD will not change.</p> <p>With a monetary growth of 10% each year and a stable population, such a change of unit base would happen each 25 years.</p> <h2 id="duniter-web-of-trust">3. Duniter Web of Trust</h2> <p>XXX Besoin de références en théorie des graphes ? XXX</p> @@ -95,7 +94,7 @@ <li>Law if the licence has not been respected.</li> </ul> <p>Note that non-members accounts can use the currency, but cannot create money. Non-members accounts can be used by individuals as secondary wallets, or by institutions.</p> -<p>We were inspired by the OpenPGP Trust system<a href="#fn7" class="footnote-ref" id="fnref7"><sup>7</sup></a>. However, the OpenPGP trust principles aim at defining trust from a particular point of view while Duniter needs to identify humans for the whole community. To achieve this goal, while OpenPGP allows each user to tweak its trust parameters individually, Duniter sets rules in the “genesis” block for the whole community.</p> +<p>We were inspired by the OpenPGP Trust system<a href="#fn8" class="footnote-ref" id="fnref8"><sup>8</sup></a>. However, the OpenPGP trust principles aim at defining trust from a particular point of view while Duniter needs to identify humans for the whole community. To achieve this goal, while OpenPGP allows each user to tweak its trust parameters individually, Duniter sets rules in the “genesis” block for the whole community.</p> <h3 id="why-do-we-need-a-web-of-trust">3.2. Why do we need a Web of Trust ?</h3> <p>There are two reasons we need it :</p> <ol type="1"> @@ -106,7 +105,7 @@ <p><strong>Monetary parameter</strong> : Each currency that use Duniter has its own blockchain whose behaviour is dictated by a set of ‘parameters’ defined in block zero - the so-called genesis block - that can be tweaked to achieve the desired results. At the time of writing the Whitepaper, the Duniter Blockchain Protocol (DUBP) has a total of 21 parameters of which 10 are for the WoT alone. We’ll focus on these 10.</p> <p>Suffice to say that in the Ğ1’s case, the DU is created every 24 hours - 86 400 seconds. This interval is set through the time derivative <code>dt</code> parameter and can have a different value in other implementations of the protocol.</p> </blockquote> -<p>We want to make sure that each member can only have one account. As we all know, achieving zero-risk isn’t possible<a href="#fn8" class="footnote-ref" id="fnref8"><sup>8</sup></a>. Our goal is therefore not to create a WoT within which fraud would be absolutely impossible, but instead to discourage it. Here is a rewording of our goal in 4 smaller ones :</p> +<p>We want to make sure that each member can only have one account. As we all know, achieving zero-risk isn’t possible<a href="#fn9" class="footnote-ref" id="fnref9"><sup>9</sup></a>. Our goal is therefore not to create a WoT within which fraud would be absolutely impossible, but instead to discourage it. Here is a rewording of our goal in 4 smaller ones :</p> <ol type="1"> <li>Make the certification process lengthy enough that all members exercise due diligence and are wary of risks.</li> <li>Make fraudulent acts as hard as we can to the extent that they become pointless.</li> @@ -218,7 +217,7 @@ Sybil region <div class="highlight"> <pre><code>WoTmax = (sigStock)*L^(stepMax-1)</code></pre> </div> -<p>However we know for a fact that members will never use all of their available certifications. Many studies have proven that we all know a maximum average of fifty people<a href="#fn9" class="footnote-ref" id="fnref9"><sup>9</sup></a>, let’s then replace sigStock by fifty:</p> +<p>However we know for a fact that members will never use all of their available certifications. Many studies have proven that we all know a maximum average of fifty people<a href="#fn10" class="footnote-ref" id="fnref10"><sup>10</sup></a>, let’s then replace sigStock by fifty:</p> <div class="highlight"> <pre><code>WoTavg= (50)*(sigQty/50)^(stepMax-1)</code></pre> </div> @@ -261,11 +260,11 @@ size the WoT according to sigPeriod and stepAttackers <p>To achieve this, identities with pending membership approval and the corresponding certifications have to remain the shortest time possible in the pool while still having a chance of making it into the blockchain.</p> <p>For the Ğ1, our opinion was that two months would be enough for all potential certifiers to agree on a specific identity to certify. We also wanted a time period that would be easy enough to remember by all. We settled on two months, and gave this value to all three parameters <code>idtyWindow</code>, <code>sigWindow</code> and <code>msWindow</code>.</p> <h4 id="avoiding-single-members-from-knowing-too-many-people-sigstock">3.8.5. Avoiding single members from ‘knowing too many people’ (<code>sigStock</code>)</h4> -<p>Many sociology studies<a href="#fn10" class="footnote-ref" id="fnref10"><sup>10</sup></a> have shown that we all know an average of fifty people. This of course is an average, some of us know more than fifty people, others much less. Once again we went for a number that would be easy to remember. Although <code>sigStock</code>’s impact on the size of a Sybil region is fairly limited, its value nonetheless has to be kept reasonable. We settled on hundred.</p> +<p>Many sociology studies<a href="#fn11" class="footnote-ref" id="fnref11"><sup>11</sup></a> have shown that we all know an average of fifty people. This of course is an average, some of us know more than fifty people, others much less. Once again we went for a number that would be easy to remember. Although <code>sigStock</code>’s impact on the size of a Sybil region is fairly limited, its value nonetheless has to be kept reasonable. We settled on hundred.</p> <h4 id="avoiding-locking-minorities-xpercent">3.8.6. Avoiding locking minorities (<code>xpercent</code>)</h4> <p>It’s easy enough to become a referent member, one of the Sybil strategies could therefore be to create a region of referent members. Such a region would grow slower than otherwise but could confer a locking power to its members by using the distance rule. That’s why the distance rule cannot be calculated on 100% of the referent members. Hence the introduction of the <code>xpercent</code> parameter which defines the percentage of referent members needing to be less than five edges -steps- from each other.</p> <p>This percentage needs to be low enough to prevent the formation of a locking minority -referent Sybil members being too far from legitimate referent members-. On the other hand, it needs to be high enough so as to restrict the maximum size of the Sybil region through the distance rule. The <code>xpercent</code> parameter was one of the hardest to define, therefore we might decide to change its value during the Ğ1 experiment.</p> -<p>We were inspired by the Pareto principle<a href="#fn11" class="footnote-ref" id="fnref11"><sup>11</sup></a>: if at least 20% of members give good density to the web, 80% of the referent members will be five or less steps from any other member -referent or not-. The maximum value for <code>xpercent</code> is therefore 80%, anything above that and the distance rule could be too restrictive for legitimate use cases. With security our top concern, we chose the maximum value of 80%.</p> +<p>We were inspired by the Pareto principle<a href="#fn12" class="footnote-ref" id="fnref12"><sup>12</sup></a>: if at least 20% of members give good density to the web, 80% of the referent members will be five or less steps from any other member -referent or not-. The maximum value for <code>xpercent</code> is therefore 80%, anything above that and the distance rule could be too restrictive for legitimate use cases. With security our top concern, we chose the maximum value of 80%.</p> <h4 id="spam-protection-with-msperiod">3.8.7. Spam protection with (<code>msPeriod</code>)</h4> <p>This parameter stands out a bit on its own, as it was added after the genesis block. It is there to protect the Duniter P2P infrastructure against ‘spam’ attacks. We had to think of a strategy against attacks such as high-frequency membership renewal requests -i.e: in every block, every five minutes- or worse still, hundreds of these requests per minute to flood the Duniter nodes. Without such limits, nodes are supposed to address all renewal requests, even in cases where they were last published five minutes ago! The <code>msPeriod</code> parameter was given the same value as <code>idtyWindow</code>, <code>sigWindow</code> and <code>msWindow</code>, i.e. two months.</p> <h2 id="proof-of-work-with-personalized-difficulty">4. Proof of Work with personal difficulty</h2> @@ -279,10 +278,10 @@ size the WoT according to sigPeriod and stepAttackers <p>Proof-of-work provides a clever solution to both problems:</p> <ol type="1"> <li><p>Any machine can write into the blockchain (create a new block) but is only authorised to do so if it has previously solved a mathematical equation that require a certain amount of work. The challenge has to be hard enough to prevent two machines to solve it at the same time, ensuring the unicity of a block’s creator.</p></li> -<li><p>Solving this challenge takes a certain amount of time, which depends on the calculating power of the whole network. This provides a common ground for defining the needed time reference. A block time is set (ie: 1 block = 5 min) and Duniter adapts the challenge difficulty to get an <em>average</em> duration corresponding to this block time.</p></li> +<li><p>Solving this challenge takes a certain amount of time, which depends on the calculating power of the whole network. This provides a common ground for defining the needed time reference. A block time is set (ie: 1 block = 5 min) and Duniter adapts the challenge difficulty to get an average duration corresponding to this block time.</p></li> </ol> <h3 id="only-members-can-mine">4.2. Only members can “mine”</h3> -<p>One of Duniter’s major differences with other PoW-based cryptocurrencies is that only members are allowed to author blocks. Each block is signed with the member’s private key, allowing the algorithm to determine a <em>personalised difficulty</em>.</p> +<p>One of Duniter’s major differences with other PoW-based cryptocurrencies is that only members are allowed to author blocks. Each block is signed with the member’s private key, allowing the algorithm to determine a personalised difficulty.</p> <p>This personalised difficulty eliminates the rat-race for the most sophisticated and powerful mining equipment. Another benefit is the fact that no “supercomputer” can take control of the blockchain. Lastly, Duniter implements a rotation in forging members thanks to this personalized difficulty.</p> <p>This lightweight PoW is much less energy-consuming than other PoW cryptocurrencies. Members can mine with anything from a raspberry pi to a privacy-first internet cube.</p> <h3 id="how-does-duniter-pow-work">4.3. How does it work ?</h3> @@ -291,19 +290,20 @@ size the WoT according to sigPeriod and stepAttackers <div class="highlight"> <pre><code>00000276902793AA44601A9D43099E7B63DBF9EBB55BCCFD6AE20C729B54C653</code></pre> </div> -<p>As you can see this hash starts with five zeros which was very hard to achieve and took a lot of <em>work</em> for someone’s computer. Hence the term “proof of work”.</p> +<p>As you can see this hash starts with five zeros which was very hard to achieve and took a lot of work for someone’s computer. Hence the term “proof of work”.</p> <h4 id="common-difficulty">4.3.2. The common difficulty</h4> <p>A common difficulty is needed to settle on a yardstick for our time reference. Its role is to make sure the blockchain moves forward at a steady pace - one block every <code>avgGenTime</code> seconds, <code>avgGenTime</code> being one of the 20 parameters behind the Duniter protocol-.</p> <p>This difficulty’s initial value can be set to any arbitrary value (<code>70</code> in Duniter <code>v1.5.x</code>) and then acts as a spring, regulating blocktime creation by increasing itself if the creation interval drops under <code>avgGenTime</code> and vice-versa.</p> <h5 id="how-is-difficulty-applied">4.3.2.1. How is difficulty applied ?</h5> <p>The numeric value of difficulty is taken from an array of possible hashes out of all possible hashes. In DUBPv13 the hash of a block is its sha256 hexadecimal hash.</p> <p>To understand the difficulty, we make a euclidiean division of the difficulty by 16.</p> -<p>Here’s an example with a difficulty value of <code>70</code> : 70 // 16 = <strong>4</strong> with a remainder of <strong>6</strong>. The valid hashes are the ones starting with four zeros and with the fifth character less than or equal to 9 (6 in hexadecimal notation). The valid hashes are then written as starting with : <code>0000[0-9]</code>. This is a bit different from Bitcoin, where the difficulty is only ruled by the number of zeroes.</p> -<blockquote> -<p>Fine, but the hash of a mined block will never change and there’s no reason it should start with a given sequence of numbers. So how then can we make sure a block hash starts with exactly the sequence needed?</p> -</blockquote> -<p>Enter the nonce, short for “number once”. When a member is forging a new block, his computer freezes the block’s content and changes the Nonce until the hash reaches the required number of zeroes.</p> +<p>Here’s an example with a difficulty value of 70 :</p> +<div class="highlight"> +<pre><code>`70 // 16 = 4` with a remainder of 6. </code></pre> +</div> +<p>The valid hashes are the ones starting with four zeros and with the fifth character less than or equal to 9 (6 in hexadecimal notation). The valid hashes are then written as starting with : <code>0000[0-9]</code>. This is a bit different from Bitcoin, where the difficulty is only ruled by the number of zeroes.</p> <h5 id="the-nonce">4.3.2.2. The Nonce</h5> +<p>When a member is forging a new block, his computer freezes the block’s content and changes the Nonce until the hash reaches the required number of zeroes.</p> <p>The nonce allows us to mine a new block by finding a hash. The hash value allows us to determine the difficulty level of the proof-of-work performed. Examples of possible Nonce values:</p> <ul> <li>10100000112275</li> @@ -319,7 +319,7 @@ size the WoT according to sigPeriod and stepAttackers </ul> <p>The rest of the Nonce, the part that follows after the XYY, is the numerical space for this individual node and is unique to each of the CPU’s core. This space is comprised of eleven digits (<code>00000000000</code>). For the sake of accuracy, we use the term CPU in the wider sense, it can be understood as a bi-CPU for example. We take into consideration the number of cores for the resulting PoW.</p> <h3 id="personalised-difficulty">4.4. Personalised difficulty</h3> -<p>Earlier in this article, we explained that the personalised difficulty is the new and key concept that sets Duniter apart from other <em>PoW-based</em> cryptocurrencies.</p> +<p>Earlier in this article, we explained that the personalised difficulty is the new and key concept that sets Duniter apart from other PoW-based cryptocurrencies.</p> <p>Here is how this personalised difficulty is calculated and assigned:</p> <p>It is determined by a combination of two different constraints with complimentary roles: the <strong>exclusion factor</strong> and the <strong>handicap</strong>.</p> <p>Let <code>powMin</code> be the common difficulty, <code>exFact</code> a member’s exclusion factor and <code>handicap</code> their handicap. This member’s personalised difficulty <code>diff</code> is:</p> @@ -454,14 +454,15 @@ size the WoT according to sigPeriod and stepAttackers <ol> <li id="fn1"><p>Bitcoin Whitepaper, S.Nakamoto, 2008: <a href="https://bitcoin.org/bitcoin.pdf">bitcoin.org/bitcoin.pdf</a><a href="#fnref1" class="footnote-back">↩</a></p></li> <li id="fn2"><p>Relative Theory of Money, S.Laborde, 2010: <a href="http://en.trm.creationmonetaire.info/">en.trm.creationmonetaire.info/</a><a href="#fnref2" class="footnote-back">↩</a></p></li> -<li id="fn3"><p>OpenPGP protocol defines standard formats for encrypted messages, signatures, private keys, and certificates for exchanging public keys. The GNU Privacy Handbook, M.Ashley, 1999 : <a href="https://www.gnupg.org/gph/en/manual.html#AEN335">www.gnupg.org/gph/en/manual.html#AEN335</a><a href="#fnref3" class="footnote-back">↩</a></p></li> -<li id="fn4"><p>High-speed high-security signatures, D.J.Bernstein, N.Duif, T.Lange, P.Schwabe, B-Y.Yang. Journal of Cryptographic Engineering 2 (2012), 77–89. <a href="https://cr.yp.to/papers.html#ed25519">cr.yp.to/papers.html#ed25519</a>.<a href="#fnref4" class="footnote-back">↩</a></p></li> -<li id="fn5"><p>PPCoin: Peer-to-Peer Crypto-Currency with Proof-of-Stake, S.King & S.Nadal, 2012 : <a href="https://archive.org/details/PPCoinPaper">archive.org/details/PPCoinPaper</a><a href="#fnref5" class="footnote-back">↩</a></p></li> -<li id="fn6"><p>The Bitcoin Lightning Network, J.Poon & T.Dryja, 2016 : <a href="http://lightning.network/lightning-network-paper.pdf">lightning.network/lightning-network-paper.pdf</a><a href="#fnref6" class="footnote-back">↩</a></p></li> -<li id="fn7"><p>Public key validation on GnuPG manual, M.Ashley, 1999 : <a href="https://www.gnupg.org/gph/en/manual.html#AEN335">www.gnupg.org/gph/en/manual.html#AEN335</a><a href="#fnref7" class="footnote-back">↩</a></p></li> -<li id="fn8"><p>The Sibyl Attack, J.R.Douceur: <a href="https://www.microsoft.com/en-us/research/wp-content/uploads/2002/01/IPTPS2002.pdf">www.microsoft.com/en-us/research/wp-content/uploads/2002/01/IPTPS2002.pdf</a><a href="#fnref8" class="footnote-back">↩</a></p></li> -<li id="fn9"><p>XXX WHICH ONES STATE THAT WE KNO AN AVERAGE OF 50 PEOPLES ? GALUEL ? I NEED ONLY ONE. XXX<a href="#fnref9" class="footnote-back">↩</a></p></li> -<li id="fn10"><p>XXX WHICH STUDIES ? XXX<a href="#fnref10" class="footnote-back">↩</a></p></li> -<li id="fn11"><p>Pareto principle : <a href="https://en.wikipedia.org/wiki/Pareto_principle">en.wikipedia.org/wiki/Pareto_principle</a><a href="#fnref11" class="footnote-back">↩</a></p></li> +<li id="fn3"><p>Relative Theory of Money, S.Laborde, 2010: <a href="http://en.trm.creationmonetaire.info/">en.trm.creationmonetaire.info/</a><a href="#fnref3" class="footnote-back">↩</a></p></li> +<li id="fn4"><p>OpenPGP protocol defines standard formats for encrypted messages, signatures, private keys, and certificates for exchanging public keys. The GNU Privacy Handbook, M.Ashley, 1999 : <a href="https://www.gnupg.org/gph/en/manual.html#AEN335">www.gnupg.org/gph/en/manual.html#AEN335</a><a href="#fnref4" class="footnote-back">↩</a></p></li> +<li id="fn5"><p>High-speed high-security signatures, D.J.Bernstein, N.Duif, T.Lange, P.Schwabe, B-Y.Yang. Journal of Cryptographic Engineering 2 (2012), 77–89. <a href="https://cr.yp.to/papers.html#ed25519">cr.yp.to/papers.html#ed25519</a>.<a href="#fnref5" class="footnote-back">↩</a></p></li> +<li id="fn6"><p>PPCoin: Peer-to-Peer Crypto-Currency with Proof-of-Stake, S.King & S.Nadal, 2012 : <a href="https://archive.org/details/PPCoinPaper">archive.org/details/PPCoinPaper</a><a href="#fnref6" class="footnote-back">↩</a></p></li> +<li id="fn7"><p>The Bitcoin Lightning Network, J.Poon & T.Dryja, 2016 : <a href="http://lightning.network/lightning-network-paper.pdf">lightning.network/lightning-network-paper.pdf</a><a href="#fnref7" class="footnote-back">↩</a></p></li> +<li id="fn8"><p>Public key validation on GnuPG manual, M.Ashley, 1999 : <a href="https://www.gnupg.org/gph/en/manual.html#AEN335">www.gnupg.org/gph/en/manual.html#AEN335</a><a href="#fnref8" class="footnote-back">↩</a></p></li> +<li id="fn9"><p>The Sibyl Attack, J.R.Douceur: <a href="https://www.microsoft.com/en-us/research/wp-content/uploads/2002/01/IPTPS2002.pdf">www.microsoft.com/en-us/research/wp-content/uploads/2002/01/IPTPS2002.pdf</a><a href="#fnref9" class="footnote-back">↩</a></p></li> +<li id="fn10"><p>XXX WHICH ONES STATE THAT WE KNO AN AVERAGE OF 50 PEOPLES ? GALUEL ? I NEED ONLY ONE. XXX<a href="#fnref10" class="footnote-back">↩</a></p></li> +<li id="fn11"><p>XXX WHICH STUDIES ? XXX<a href="#fnref11" class="footnote-back">↩</a></p></li> +<li id="fn12"><p>Pareto principle : <a href="https://en.wikipedia.org/wiki/Pareto_principle">en.wikipedia.org/wiki/Pareto_principle</a><a href="#fnref12" class="footnote-back">↩</a></p></li> </ol> </section> diff --git a/whitepaper.md b/whitepaper.md index 53beb9ac64e960bada9e060ca8c41bfc541d4981..ed970f16be2b25d875fe778314108fc0762ddc23 100644 --- a/whitepaper.md +++ b/whitepaper.md @@ -30,7 +30,7 @@ Thus, Duniter project will associate a human to a digital identity. It will use Duniter is based on a decentralized Blockchain. This technical choice allows irreversibility of transaction and uncensorability of trades and identities. While inspired by Bitcoin, Duniter uses a Web of Trust and the Proof of Work to secure the computation network, thus making obsolete the power race model used in Bitcoin. -The first currency created through Duniter is Ğ1 (say "June"). It was created on the 8th. March 2017. This whitepaper uses Ğ1 parameters as examples ; however, one can create another libre currency with custom parameters while still using Duniter software. +The first currency created through Duniter is Ğ1, pronounced "June". It was created on the 8th. March 2017. This whitepaper uses Ğ1 parameters as examples ; however, one can create another libre currency with custom parameters while still using Duniter software. ## 1. State of the art : Bitcoin case {#state-of-the-art-bitcoin-case} @@ -38,7 +38,7 @@ The first currency created through Duniter is Ğ1 (say "June"). It was created o <!-- source : https://duniter.org/en/theoretical/ --> Duniter uses the crypto-currency concept introduced by Bitcoin[^BTC_whitepaper], which is -to use cryptographic tools such as *signatures* to create digital +to use cryptographic tools such as signatures to create digital currencies. Duniter fits this definition, but it has completely different principles than Bitcoin : the Web of Trust and the Universal Dividend . These differences are on both monetary and technical aspects. @@ -56,20 +56,20 @@ Bitcoin as an example to understand why. #### 1.1.1. Spatial asymmetry {#spatial-asymmetry} -When new Bitcoins are created, *only some Bitcoin users* (the miners) -are given new Bitcoins, while everyone else get nothing. **We believe -this is the *first* injustice.** However, some might say: +When new Bitcoins are created, only some Bitcoin users (the miners) +are given new Bitcoins, while everyone else get nothing. We believe +this is the first injustice. However, some might say: -> \"Miners used their *electricity and time* to get it!\" +> \"Miners used their electricity and time to get it!\" -\... we would answer that this work *shouldn\'t have been rewarded by -newly created Bitcoins*. New Bitcoins should be distributed to the whole -Bitcoin community. Miners should be rewared another way, but not by -money issuance. Of course, Bitcoin can\'t create money through Basic -Income since *Bitcoin users are not strongly identified*, and one might -benefit from money creation multiple times if he owned several wallets. -Duniter gets rid of this problem completely by identifying its users and -giving *the same amount of Basic Income to everyone*. +\... we would answer that this work should not have been rewarded by +newly created Bitcoins. New units should be distributed to the whole +community. Miners should be rewared another way, but not by +money issuance. Of course, Bitcoin cannot create money through Basic +Income since Bitcoin users are not strongly identified, and one might +benefit from money creation multiple times if they owned several wallets. +Duniter gets rid of this problem by identifying its users and +creating the same amount of Basic Income to everyone. #### 1.1.2. Temporal-asymmetry {#temporal-asymmetry} @@ -78,36 +78,41 @@ which means ever fewer bitcoins will be created over time until no new BTC are being generated. So, once the first adopters have mined every bitcoin, how will future joiners get Bitcoins? Just like Euros or Dollars: to get money, they will have to work for the ones who already own it. -**We believe this is the *second* injustice.** Every member of a + +We believe this is the second injustice. Every member of a monetary community should be equal concerning monetary creation, and get -the same relative amount of money over time, *even if they are a late -adopter*. Duniter aims to fix this by making the Universal Dividend -(a.k.a. *UD*) *grow by the time* (S.Laborde, 2010) according to precise rules, thus making +the same relative amount of money over time, even if they are a late +adopter. Duniter aims to fix this by making the Universal Dividend +(a.k.a. UD) grow by the time[^RTM] according to precise rules, thus making members equal toward money issuance on a half-lifespan. +Most currencies present one of these two asymmetries, including metal currencies +and mutual credit, as exposed in the RTM. + #### 1.1.3. A solution {#a-solution} -Bitcoin has taught us that *it is possible* to create a currency system +Bitcoin has taught us that it is possible to create a currency system allowing one to both create digital money and to exchange it without a -central authority. What we need to change is *the way money is issued* -so we finally have a symmetrical system. We need Bitcoin *+ Universal -Dividend*. But Universal Dividend *implies* that the community consists +central authority. What we need to change is the way money is issued +so we finally have a symmetrical system. We need **Bitcoin + Universal +Dividend**. But Universal Dividend implies that the community consists of only identified people. This is where the Web of Trust (WoT) comes -into place. This concept, introduced by cryptography with the -OpenPGP format[^OpenPGP], -allows us to identify people in a *decentralized* manner. It works as -follows: each person creates *a personal identity* that is linked to its +into place. + +This concept, introduced by cryptography with the OpenPGP format[^OpenPGP], +allows us to identify people in a decentralized manner. It works as +follows: each person creates a personal identity that is linked to its cyptographic certificate. The identity must be confirmed by others -members who use their own cryptographic key. It is that simple: **people +members who use their own cryptographic key. It is that simple: people choose who is part of the community and who is not, not a central -authority.** +authority. [^OpenPGP]: OpenPGP protocol defines standard formats for encrypted messages, signatures, private keys, and certificates for exchanging public keys. The GNU Privacy Handbook, M.Ashley, 1999 : [www.gnupg.org/gph/en/manual.html#AEN335](https://www.gnupg.org/gph/en/manual.html#AEN335) -> Duniter however won\'t use OpenPGP for its cryptographic features: -> Elliptic Curves[^Elliptic] will be used instead for the conciseness of its -> generated keys and its pratical advantages. Duniter has its own Web -> of Trust principles, that shall be exposed later. +However, Duniter will not use OpenPGP for its cryptographic features: +Elliptic Curves[^Elliptic] will be used instead for the conciseness of its +generated keys and its pratical advantages. Duniter has its own Web +of Trust principles, that will be exposed later. [^Elliptic]: High-speed high-security signatures, D.J.Bernstein, N.Duif, T.Lange, P.Schwabe, B-Y.Yang. Journal of Cryptographic Engineering 2 (2012), 77–89. [cr.yp.to/papers.html#ed25519](https://cr.yp.to/papers.html#ed25519). @@ -117,7 +122,8 @@ In Bitcoin Model, the calculation and incentive principles cause a power race : new Bitcoins are created for the owners of the most numerous, powerful (and energy-consuming) computers. This leads to a power race an places the control over the currency in the hands of the richest hardware owners. We want to make Duniter blockchain validation much less energy and hardware consuming while -keeping a strong level of security. This will be further explained later. A consequence of this choice is the participation of low-end hardware in the Duniter network, +keeping a strong level of security. This will be further explained later. A consequence of +this choice is the participation of low-end hardware in the Duniter network, leading to a better decentralization of forging operations. #### 1.2.1 What about Proof of Stake ? {#what-about-proof-of-stake} @@ -126,7 +132,7 @@ Proof of stake consensus algorythm was first introduced in 2012[^PPCoin]. The ba [^PPCoin]: PPCoin: Peer-to-Peer Crypto-Currency with Proof-of-Stake, S.King & S.Nadal, 2012 : [archive.org/details/PPCoinPaper](https://archive.org/details/PPCoinPaper) -When conceiving Duniter, the PoS algorythms had not been tested enough to be used as a fundamental base. +At the time of conceiving Duniter, the PoS algorythms had not been tested enough to be used as a fundamental base. Moreover, the principle of allowing owners of large amounts of money to validate transaction can only lead to placing power over the currency in the richests hands : this is contrary to the symmetical principles of a libre currency. @@ -139,19 +145,30 @@ Duniters Blockchain follows the basic principles of Bitcoins. This is essential for synchronization between peers, as to prevent double-spend attacks. However, Duniters Blockchain will store different informations than Bitcoins. -The basic use of Blockchain will be registering transactions. For this part, we use the same principles as Bitcoin : transactions have inputs (spending accounts) and outputs (receiving accounts). But contrary to Bitcoin, no *generation transaction* exists : monetary creation happens only through UD. So, in Duniters Blockchain, Inputs can be either: +The basic use of Blockchain will be registering transactions. For this part, we use the same principles as Bitcoin : transactions have inputs (spending accounts) and outputs (receiving accounts). But contrary to Bitcoin, no generation transaction exists : monetary creation happens only through UD. So, in Duniters Blockchain, Inputs can be either: * a former transaction (as in Bitcoin) * a Universal Dividend (specific to Duniter). -Duniters Web of Trust is also written in the Blockchain. The identity of each member gets registered much like transactions are, with a strong link to the time reference. Thus, the Blockchain is a representation of a space-time frame of reference, where "space" are members of the WoT and "time" the basic blockchain units : the blocks. On each point of time, one can determine which account is legitimate to create the UD, only with a blockchain analysis. +Duniters Web of Trust is also written in the Blockchain. The identity of each +member gets registered much like transactions are, with a strong link to the +time reference. Thus, the Blockchain is a representation of a space-time frame +of reference, where "space" are members of the WoT and "time" the basic blockchain +units : the blocks. On each point of time, one can determine which account is +legitimate to create the UD, only with a blockchain analysis. ### 2.1. Spam countermeasures {#spam-countermeasures} XXX These measures do not seem sufficient to me. Are there any others (in the protocol, not in the nodes) ? IP block is not an answer since one could use TOR. Peer block ? The attacker could switch its peering document regularly. XXX -An issue of most cryptocurrency projects is to prevent the common ledger from growing too much. This would require nodes to have a lot of storage and computing power to be usable. In particular, we don't want an attacker to be able to make the Blockchain grow too fast. Most projects implement transaction fees as a way to prevent this, making the attacker lose money. We don't want to introduce this mean since a currency with automatic fees on transactions is no more neutral. Several countermeasuers against such spam attacks are implemented. +An issue of most cryptocurrency projects is to prevent the common ledger from +growing too much. This would require nodes to have a lot of storage and computing +power to be usable. In particular, we don't want an attacker to be able to make the +Blockchain grow too fast. Most projects implement transaction fees as a way to prevent +this, making the attacker lose money. We don't want to introduce this mean since a +currency with automatic fees on transactions is no more neutral. Several +countermeasuers against such spam attacks are implemented. <!-- see : https://forum.duniter.org/t/sans-frais-de-transaction-comment-resister-aux-attaques/3846/25 (implemented ?)--> @@ -165,11 +182,7 @@ Fixing a minimal output amount reduces the power of an attack. Duniter deals wit The block size is always limited. While the protocol allows this limit to evolve to address scaling issues, an attacker cannot register as many transaction as they wish. -With the same goal to prevent too many transactions to get registered, while transactions can be "chained" (refer to another transaction in the same block), the chainability of transactions is limited to 5. This leaves enough space for clients to process change transactions while preventing - -#### 2.1.3. Output amounts tresholds {#output-amounts-tresholds} - -XXX This has been discussed in a [forum post](https://forum.duniter.org/t/sans-frais-de-transaction-comment-resister-aux-attaques/3846/25), but does not seem tobe implemented. Is it still on the roadmap ? XXX +With the same goal to prevent too many transactions to get registered, while transactions can be "chained" (refer to another transaction in the same block), the chainability of transactions is limited to 5. ### 2.2. Scaling {#scaling} @@ -177,15 +190,16 @@ XXX This has been discussed in a [forum post](https://forum.duniter.org/t/sans-f Most of the time, the scaling issue rises for distributed systems that should work on a very large scale. This is not the case of Duniter, for multiple reasons : * Ğ1 is the first libre currency, and is still experimental on the monetary creation principle. We don't want it to reach the whole world, we only want it to work, to validate or invalidate the RTM. Moreover, the rules chosen for the Ğ1 WoT limits its size to around 16 million members. -* Duniter's aim is to be used to create *multiple* libre currencies, that would fit local or regional economies. As a consequence, it would deal with less transactions than if it was a world-scale system. The RTM proposes a formula to calculate the exchange rate between two currencies, that could be used to create automatic exchanges for a member travelling away from their community. +* Duniter's aim is to be used to create multiple libre currencies, that would fit local or regional economies. As a consequence, it would deal with less transactions than if it was a world-scale system. The RTM proposes a formula to calculate the exchange rate between two currencies, that could be used to create automatic exchanges for a member travelling away from their community. -However, Duniter has two assets that might be used if the number of users grow. +However, Duniter has assets that will help if the number of users and transactions grow. #### 2.2.1 Dynamic block size {#dynamic-block-size} While Bitcoin has a fixed block size, Duniters blocks size can evolve. On low use of the blockchain, the maximal block size is 500 bytes. -On high use of the blockchain, the maximal block size would be 110% of the average size of the current window blocks( *current window* will be described in the PoW part). +On high use of the blockchain, the maximal block size would be 110% of the +average size of the current window blocks(see "personalised difficulty" part for more information). This way, the blocks are bounded in size, but can slowly grow if a massive and legitimate use of the blockchain needs it. The block size (in bytes) is limited as so : :::{highlight} @@ -205,7 +219,7 @@ While not available yet, this payment channel might get implemented when needed. #### 2.2.3. Unit base {#unit-base} -As the Universal Dividend grows exponentially, with time Duniter nodes would have had to deal with always largest amounts, eventually reaching the BIGINT limit. To avoid this, the amounts are expressed with a unit base in base 10. We want the UD amount te always fit in 4 digits. To manage it, the `unitbase` is updated each time the UD value reaches 100.00 : it goes from `99.99*10^(unitbase)` to `10.00*10^(unitbase+1)`. All the unit amounts are thus divided by 10. While this might seem strange, this process has already hapened in state currencies. Moreover, the amounts expressed in UD will not change. +As the Universal Dividend grows exponentially, with time Duniter nodes would have had to deal with always largest amounts, eventually reaching the BIGINT limit. To avoid this, the amounts are expressed with a unit base in base 10. We want the UD amount to always fit in 4 digits. To manage it, the `unitbase` is updated each time the UD value reaches 100.00 : it goes from `99.99*10^(unitbase)` to `10.00*10^(unitbase+1)`. All the unit amounts are thus divided by 10. While this might seem strange, this process has already hapened in state currencies. Moreover, the amounts expressed in UD will not change. With a monetary growth of 10% each year and a stable population, such a change of unit base would happen each 25 years. @@ -816,7 +830,7 @@ ensuring the unicity of a block's creator. takes a certain amount of time, which depends on the calculating power of the whole network. This provides a common ground for defining the needed time reference. A block time is set (ie: 1 block = 5 min) and -Duniter adapts the challenge difficulty to get an *average* duration +Duniter adapts the challenge difficulty to get an average duration corresponding to this block time. ### 4.2. Only members can "mine" {#only-members-can-mine} @@ -824,7 +838,7 @@ corresponding to this block time. One of Duniter's major differences with other PoW-based cryptocurrencies is that only members are allowed to author blocks. Each block is signed with the member's private key, allowing the algorithm to determine a -*personalised difficulty*. +personalised difficulty. This personalised difficulty eliminates the rat-race for the most sophisticated and powerful mining equipment. Another benefit is the fact @@ -846,7 +860,7 @@ Example of a valid hash: ::: As you can see this hash starts with five zeros which was very hard to -achieve and took a lot of *work* for someone's computer. Hence the term +achieve and took a lot of work for someone's computer. Hence the term "proof of work". #### 4.3.2. The common difficulty {#common-difficulty} @@ -870,23 +884,23 @@ of a block is its sha256 hexadecimal hash. To understand the difficulty, we make a euclidiean division of the difficulty by 16. -Here's an example with a difficulty value of `70` : 70 // 16 = **4** with a -remainder of **6**. The valid hashes are the ones starting with four +Here's an example with a difficulty value of 70 : + +::: {.highlight} + `70 // 16 = 4` with a remainder of 6. +::: + +The valid hashes are the ones starting with four zeros and with the fifth character less than or equal to 9 (6 in hexadecimal notation). The valid hashes are then written as starting with : `0000[0-9]`. This is a bit different from Bitcoin, where the difficulty is only ruled by the number of zeroes. -> Fine, but the hash of a mined block will never change and there's no -> reason it should start with a given sequence of numbers. So how then -> can we make sure a block hash starts with exactly the sequence -> needed? +##### 4.3.2.2. The Nonce {#the-nonce} -Enter the nonce, short for "number once". When a member is forging a new +When a member is forging a new block, his computer freezes the block's content and changes the Nonce -until the hash reaches the required number of zeroes. - -##### 4.3.2.2. The Nonce {#the-nonce} +until the hash reaches the required number of zeroes. The nonce allows us to mine a new block by finding a hash. The hash value allows us to determine the difficulty level of the @@ -924,7 +938,7 @@ number of cores for the resulting PoW. Earlier in this article, we explained that the personalised difficulty is the new and key concept that sets Duniter apart from other -*PoW-based* cryptocurrencies. +PoW-based cryptocurrencies. Here is how this personalised difficulty is calculated and assigned: