Zarif Bey

@Walrus 🦭/acc

Network and adversarial assumptions. Walrus runs in epochs, each with a static set of storage nodes. Walrus is a delegated Proof-of-Stake protocol. In the duration of an epoch stakeholders delegate stake to candidate storage nodes. At the end of the epoch n = 3f + 1 storage shards are assigned proportionally to storage nodes. The set of storage nodes that holds at least one shard is considered the storage committee of the epoch.
We consider an asynchronous network of storage nodes where a malicious adversary can control up to f storage shards, i.e., control any subset of storage nodes such that at most f shards are corrupted. For simplicity in the rest of the paper we assume each shard generates a separate storage node identity such that there are n storage nodes and at most f storage nodes are corrupted.
The corrupted nodes can deviate arbitrarily from the protocol. The remaining nodes are honest and strictly adhere to the protocol. If a node controlled by the adversary at epoch e is not a part of the storage node set at epoch e + 1 then the adversary can adapt and compromise a different node at epoch e + 1 after the epoch change has completed.
We assume every pair of honest nodes have access to a reliable and authenticated channel. The net- work is asynchronous, so the adversary can arbitrarily delay or reorder messages between honest nodes, but must eventually deliver every message unless the epoch ends first. If the epoch ends then the messages can be dropped.
Although we provide an analysis on incentives, we do not consider rational nodes with utility func- tions. This is left for future work.
Erasure codes. As part of Walrus, we propose Asynchronous Complete Data Storage (ACDS) that uses a linear erasure coding scheme. While not necessary for the core parts of the protocol, we also assume that the encoding scheme is systematic for some of our optimizations, meaning that the source symbols of the encoding scheme also appear as part of its output symbols.
Let Encode(B, t, n) be the encoding algorithm. Its output is n symbols such that any t can be used
to reconstruct B with overwhelming probability. This happens by first splitting B into s ≤ t symbols
of size O(|B|) which are called source symbols. These are then expanded by generating n − s repair s
symbols for a total of n output symbols. On the decoding side, anyone can call Decode(T, t, n) where T is a set of at least s correctly encoded symbols, and it returns the blob B. This decoding is probabilistic but as the size of T increases the probability of successfully decoding the blob quickly approaches one. We assume that the difference between the threshold t to decode with overwhelming probability and the number of source symbols s is a small constant, which holds for practical erasure coding schemes (such as RaptorQ which we use in our implementation). For simplicity, we therefore often assume that s = t, unless the distinction is relevant.
This is generally safe to assume, since the first t symbols can be easily computed based on the first s symbols and we can just consider these t symbols to be the source symbols, i.e., the only effect of this assumption is a tiny increase in symbol size.
Blockchain substrate. Walrus uses an external blockchain as a black box for all control operations that happen on Walrus. A blockchain protocol can be abstracted as a computational black box that accepts a concurrent set of transactions, each with an input message Tx(M) and outputs a total order of updates to be applied on the state Res(seq, U ). We assume that the blockchain does not deviate from this abstract and does not censor Tx(M) indefinitely. Any high-performance modern SMR protocol satisfies these requirements, in our implementation we use Sui and have implemented critical Walrus coordination protocols in the Move smart contract language

#walrus #WalrusFinance #WAL #Binance #writetoearn

$WAL

@Walrus 🦭/acc

In recent years, interest in data storage solutions in the Web3 world has increased, and Walrus Finance (WAL) stands out as one of the projects offering a decentralized approach to this need. Specifically providing solutions for securely storing large volumes of files on the blockchain, Walrus positions itself not only as a data storage tool but also as an economic protocol empowered by tokenomic incentives. Built on the Sui blockchain, the project aims to build a scalable and sustainable infrastructure by integrating off-chain data management with on-chain verification processes.
One unique feature of Red Stuff is its ability to work in an asychronous network while supporting storage challenges, making it the first of its kind. This is only possible thanks to the two-dimensional encoding that allows for different encoding thresholds per dimension. The low-threshold di- mension can be used from nodes that did not get the symbols during the write flow to recover what they missed, whereas the high-threshold dimension can be used for the read flow to prevent the adversary from slowing down honest nodes during challenge periods and collecting sufficient information to reply to challenges.
One final challenge for Walrus, and in general, any encoding-based decentralized storage system is operating se- curely across epochs each managed by a different committee of storage nodes. This is challenging because we want to ensure uninterrupted availability to both read and write blobs during the naturally occurring churn of a permissionless system, but if we keep writing data in the nodes about to depart, they keep needing to transfer them to the nodes that are replacing them. This creates a race for the resources of those nodes, which will either stop accepting writes or fail to ever transfer responsibility. Walrus deals with this through its novel multi-stage epoch change protocol that naturally fits the principles of decentralized storage systems.
Red Stuff
The encoding protocol above achieves the objective of a low overhead factor with very high assurance, but is still not suitable for a long-lasting deployment. The main challenge is that in a long-running large-scale system, storage nodes routinely experience faults, lose their slivers, and have to be replaced. Additionally, in a permissionless system, there is
5There may be an extra O(logn) cost depending on the commitment scheme.
S11
S21
S31
S41
some natural churn of storage nodes even when they are well incentivized to participate.
Both of these cases would result in enormous amounts of data being transferred over the network, equal to the total size of data being stored in order to recover the slivers for new storage nodes. This is prohibitively expensive. We would instead want the system to be self-healing such that the cost of recovery under churn is proportional only to the data that needs to be recovered, and scale inversely with n.
To achieve this, Red Stuff encodes blobs in two dimen- sions (2D-encoding). The primary dimension is equivalent to the RS-encoding used in prior systems. However, in order to allow efficient recovery of slivers of B we also encode on a secondary dimension. Red Stuff is based on linear erasure coding (see section II) and the Twin-code framework, which provides erasure coded storage with efficient recovery in a crash-tolerant setting with trusted writers. We adapt this framework to make it suitable in the byzantine fault tolerant setting with a single set of storage nodes, and we add additional optimizations that we describe further below.
Encoding: Our starting point is the second strawman design that splits the blobs into f +1 slivers. Instead of simply encoding repair slivers, we first add one more dimension to the splitting process: the original blob is split into f + 1 primary slivers (vertical in the figure) into 2f + 1 secondary slivers (horizontal in the figure). Figure 2 illustrates this process. As a result, the file is now split into (f + 1)(2f + 1) symbols that can be visualized in an [f + 1, 2f + 1] matrix.

#Walrus $WAL

@Dusk

The Dusk Network And Blockchain Architecture
WEB3 Symposium, April 2018, Amsterdam, The Netherlands
The probability for obtaining k selections out of n extractions nk n−k
• bc is the tuple of the pre-block candidate hash H(block) and the transaction list txblock
• bdefault isthedefaultpre-blockpropagatedbytheappro- priate Provisioner’s committee
Algorithm 4 Verify and propagate pre-blocks
followsthebinomialdistributionPr(k;n,p)= k p (1−p)
where the sum of all probabilities Ínk=0 Pr(k;n,p) is naturally 1.
The set representing all possible probability values [0, 1) gets split
into adjacent intervals Ij = [Íj Pr(k;n,p),Íj+1 Pr(k;n,p)) for k=0 k=0
j ∈ 0,1,...,n. If hash/2len(hash) falls in the intervals Ij, then j is the priority of the node’s sortition and it is verifiable by knowing the VRF’s output hash (proven by π ) and the amount n. While in BA⋆ n is the information about a node’s entire balance, in SBA⋆ this amount is instead encrypted by the node and shared among the Verifiers using the NIVSS algorithm and kept verifiable solely by a threshold t of the n members of the Verifier Committee.
Differently from BA⋆, in SBA⋆ the probability of obtaining a total amount of Θ positive extractions is 1 only if all nodes partici- pate to the sortition with their whole balance. This is seldom the case and therefore the probability that no candidate gets selected to propose a block is greater than zero. To obviate to this eventual- ity and still produce a block in case a dishonest Block Generator gets caught, Provisioners run their own parallel Block Generator sortition as a fallback scenario for those cases. Also, to mitigate the potentially reduced probability to generate a successful sortition with multiple candidates, Θ is chosen to be substantially higher than the τ parameter of BA⋆.
3.6 Verification — Pre-Block Propagation
During the gossip procedure, each node relays solely the pre-block with the claimed highest priority (Provisioners will also gossip the default pre-block to the other Provisioners), while dropping all other pre-block proposals. In SBA⋆, protection from Sybil attacks is granted by the time-locked payment made by the Block Generator candidate which is not in clear. Therefore nodes and Provisioners other than Verifiers could only perform validation on the VRF result hash and the proposed pre-block. They do not engage in priority validation, which is entirely demanded to the Verifiers. This has the positive side-effect to perceivably decrease network latency during gossip operations.

Verifiers run the VerifyBlockProposerSortition in order to recon- struct the view-key and the time-locked transaction propagated by the Block Generator candidate and be able to validate the claimed priority. Depending on the outcome, they either sign and propagate the candidate’s pre-block or the default pre-block. This does not really require consensus since the propagated pre-block is a mere result of the validation operation, which gets further audited by the different Voter Committees. As such the probability for propagating mismatching pre-blocks is negligible. In the future we will explore the possibility to use Probabilistic Checkable Non-Interactive Zero Knowledge Proofs to propagate a very efficient proof of validation without revealing the candidate’s view-key any further than the Verifiers.

#Dusk $DUSK

@Dusk
The Dusk network makes use of a decentralized and privacy-oriented digital currency that evolves the CryptoNote protocol[12] through the groundbreaking discoveries in the field of Byzantine consensus and pseudo-random functions of world renown cryptographers such as Silvio Micali, Michael Rabin, Alexander Yampolskiy and Evgeniy Dodis. Dusk radically departs from any other blockchain by employing an adaptive consensus mechanism, called Segregated Byzantine Agreement (or SBA⋆), which does not require the com- putational intensity of proof-of-work and is a fairer alternative to proof-of-stake. Built on such consensus algorithm, Dusk is poised to be the first to simultaneously achieve previously conflicting goals of guaranteeing transaction untraceability and unlinkability, safeguarding user privacy, reaching transactional "finality" after a bound number of rounds within a single block election and achiev- ing virtually unbounded user scalability without any significant performance degradation.
The Dusk network requires a heightened security setup designed specifically to:
(1) Obfuscate IP addresses of the communicating peers (2) Prevent linkability and traceability of accounts
(3) Guarantee network performance
(4)
The Dusk Network And Blockchain Architecture
Scalable consensus and low-latency data transmissions for privacy-driven cryptosystems
Emanuele Francioni Dusk Foundation Amsterdam, The Netherlands emanuele@Dusk.network
Fulvio Venturelli Dusk Foundation Amsterdam, The Netherlands fulvio@Dusk.network
Implement efficient payment mechanism for high QoS appli- cations such as secure and anonymous voice calls
In order to satisfy a broad set of data transfer scenario, the Dusk network adds an additional layer of security to the IP protocol suite (used mostly in a peer-to-peer fashion). Through the adop- tion of a mix of established strategies and novel techniques, the Dusk network has been conceived specifically to protect the pri- vacy of the communicating peers from any form of eavesdropping while satisfying a variety of challenging use cases varying from fast communication (e.g. voice calls) to large data transfer (e.g. file transmission). Dusk circumvents the notorious unreliability of crowd-sourced infrastructures by embedding economic incentives into the core mechanism of the network itself. Such incentives are designed to encourage peers to partake in the network in a permission-less, anonymous and private fashion.
KEYWORDS
Dusk, blockchain, cryptocurrency, privacy, consensus, segregated byzantine agreement
1 INTRODUCTION
The Dusk network makes use of a decentralized and privacy-oriented digital currency that evolves the CryptoNote protocol[12] through the groundbreaking discoveries in the field of Byzantine consensus and pseudo-random functions of world renown cryptographers such as Silvio Micali, Michael Rabin, Alexander Yampolskiy and Evgeniy Dodis. Dusk radically departs from any other blockchain by employing an adaptive consensus mechanism, called Segregated Byzantine Agreement (or SBA⋆), which does not require the com- putational intensity of proof-of-work and is a fairer alternative to proof-of-stake. Built on such consensus algorithm, Dusk is poised to be the first to simultaneously achieve previously conflicting goals of guaranteeing transaction untraceability and unlinkability, safeguarding user privacy, reaching transactional "finality" after a bound number of rounds within a single block election and achiev- ing virtually unbounded user scalability without any significant performance degradation.
The Dusk network requires a heightened security setup designed specifically to:
(1) Obfuscate IP addresses of the communicating peers (2) Prevent linkability and traceability of accounts
(3) Guarantee network performance
This paper is published under the MIT International license. Authors reserve their rights to disseminate the work on their personal and corporate Web sites with the appropriate attribution.
WEB3 Symposium, April 2018, Amsterdam, The Netherlands
© 2018 Stichting Dusk Foundation, published under MIT License.
An
not make use of proof-of-work mining and therefore drops com- pletely CryptoNight and deviates substantially from the hashing algorithms therein adopted. In particular, Dusk uses what we call Segregated Byzantine Agreement (SBA⋆) protocol which enhances classic BA⋆ by implementing specific measures to protect peer privacy. SBA⋆ has been developed specifically to power the Dusk Blockchain and help meeting the aforementioned requirements. These efforts do not solely relate to the application layer but extend to the networking layer as well. This is why the Dusk protocol makes use of:
• Stealthaddresses:toprotecttransactionrecipientanonymity
• RingCT signature: to protect transaction sender’s identity
• Anonymous Network Layer: to protect the IP address of
the network peers; to provide secure data transfer mecha- nism; to implement off-line data retrieval strategy; to power the anonymous gossip network for transaction propagation and verification
• Non-Interactive Verifiable Secret Sharing Scheme: to conceal all but highest priority time-locked transactions from the participants to the Block Generation sortition
• Cryptographically Committed Provisioners: to protect the information about stake; to implement a division of re- sponsibilities between Block Generators and the electable Block Voters and Verifiers; to boost network efficiency by acting as state channel guarantors; to incentivise participa- tion to the network; to protect the balance information of transacting nodes; to prepare SBA⋆ for future expansion with non-balance and non-payment related weights such as storage contributed to the network (as in proof-of-storage), availability expressed in elapsed time since joining the net- work (as in proof-of-idle), etc.
2 PRELIMINARIES
2.1 Diffie-Hellman Hardness Assumption
In any group, a discrete logarithm loдb a is a number x ∈ Z such thatbx=a.
Most of the cryptographic building blocks related to this work are linked to the Diffie-Hellman assumption which uses the hard- ness of discrete logarithms in cyclic groups [13]. Considering a multiplicative cyclic group G of order p and generator [2] д, we can formulate the following assumption: given дa and дb for uni- formly and independently chosen a ,b ∈ Zp then дab performs like a random element in G of order p.

#Dusk $DUSK

@Dusk

The idea of digital currencies deployed in a distributed network secured via cryptographically and game-theoretically sound primitives rather than trust has been a point of discussion in limited circles of enthusiasts for decades before being formalized for the first time by David Chaum [Cha82]. Between then and the introduction of Bitcoin [Nak08] in 2008, numerous researchers [Cha82; LSS96; Wei98; VCS03; Sza05] in the field attempted to propose a viable digital currency protocol with mainstream acclaim.
The first mainstream breakthrough happened with release of the Bitcoin whitepaper [Nak08], which ushered a new era of research and enthusiasm. Built on top of a novel digital ledger called ”blockchain” and secured via a Proof-of-Work consensus protocol, inspired by [DGN04] and [Bac02], Bitcoin became the first truly decentralized digital currency, inspiring the work on other decentralized applications, such as decentralized DNS [Nam11] and distributed state machine [Woo19]. Soon after the release of Bitcoin, researchers started discovering numerous issues previously unbeknownst to the creator/s of Bitcoin. [KCW13; ES18; GKL15; SSZ17; PSS17; Bon16] have discovered deficiencies in the assumptions outlined in the Bitcoin whitepaper with regards to the consensus protocol and the economic model. Also, the paper [RS12] published by Ron and Shamir has been the first of many to demonstrate the ease of transaction analysis and the lack of anonymity that the Bitcoin users maintain.
The issue of excessive energy consumption required to retain the security guarantees of the data stored in the ledger has been another point of contention for the Bitcoin protocol. Throughout the years, multiple researchers have tackled the issue with various solutions, the majority of which revolved around a concept of ”one-vote-per-share” instead of ”one-vote-per-CPU”. The idea of Proof-of-Stake was first formalized in the Peercoin whitepaper [KN12], followed by [Ben+14; BG17]. A more formal approach was taken by [DPS16; Kia+17; Dav+18]. The protocols referenced above belong to a family of ”chain-based” Proof-of-Stake protocols, which essentially emulate the Proof-of-Work family of protocols while maintaining similar security assumptions. The downside of probabilistic finality of ”chain-based” was tackled by Algorand [Mic16], which utilized various novel techniques to guarantee instant finality while retaining the ”permission-lessness” of the underlying protocol. Unfortunately, the protocol came with it’s own disadvantages, mainly revolving around the security assumptions (67% of the circulating supply is required to be honest and participate in the consensus execution) as well as the committee (2000+) and certificate sizes.

Understanding the importance of anonymity, researchers began working on techniques to convert Bitcoin into an anonymity-preserving protocol. The initial idea was to utilize mixers, trusted services which
3 combine the inputs and outputs of multiple users into a single transaction. The downsides of the service was the reliance on trust as well as the lack of obfuscation of the amounts involved. The initial resurgence of interest in anonymity-preserving digital currencies was followed by the publications of [Sab13; Hop+19; Max15; NMM16; Poe16; Fau+18; Bun+19], which took differing approaches to the problem with differing outcomes. The resulting rise of interest, has seen multiple projects, such as Monero and Zcash, surge to popularity with preservation of anonymity being the main selling point.
2 Our Contributions
Our contributions include the development of a novel Private Proof-of-Stake protocol (to be discussed more thoroughly in Section 5.3), a permission-less Proof-of-Stake protocol with statistical finality guarantees (Section 5), a quasi- Turing-complete Virtual Machine with zero-knowledge proof verification capa- bility (Section 6) and a confidentiality-preserving account-based transaction

#dusk $DUSK

@Walrus 🦭/acc

Son yıllarda Web3 dünyasında veri saklama çözümlerine yönelik ilgi artarken, Walrus Finance (WAL), bu ihtiyaca merkeziyetsiz bir yaklaşım sunan projelerden biri olarak öne çıkıyor. Özellikle blockchain üzerinde büyük hacimli dosyaların güvenli biçimde depolanması konusunda çözümler sunan Walrus, yalnızca bir veri saklama aracı değil, aynı zamanda tokenomik teşviklerle güçlendirilmiş bir ekonomik protokol olarak konumlanıyor. Sui blockchain üzerine inşa edilen proje, zincir dışı veri yönetimi ile zincir içi doğrulama süreçlerini entegre ederek ölçeklenebilir ve sürdürülebilir bir altyapı inşa etmeyi hedefliyor.
WAL token, bu sistemin temel taşı olarak işlev görüyor. Protokol, klasik bulut depolama sistemlerine alternatif sunarken, kullanıcıların hizmet bedellerini WAL ile ödemesi ve doğrulayıcıların bu tokenlar üzerinden ödüllendirilmesiyle kendi ekonomisini kuruyor. Bu yaklaşım sadece teknik bir yenilik değil, aynı zamanda merkezi hizmet sağlayıcıların baskın olduğu veri pazarına karşı ekonomik bir meydan okuma anlamına geliyor.

II. Models and Definitions Walrus relies on the following assumptions.
A. Cryptographic assumptions
Throughout the paper, we use hash() to denote a collision resistant hash function. We also assume the existence of secure digital signatures and binding commitments.
B. Network and adversarial assumptions
Walrus runs in epochs, each with a static set of storage nodes. At the end of the epoch n = 3f + 1 storage nodes are elected as part of the the storage committee of the epoch and each one controls a storage shard such that a malicious adversary can control up to f of them.
The corrupted nodes can deviate arbitrarily from the pro- tocol. The remaining nodes are honest and strictly adhere to the protocol. If a node controlled by the adversary at epoch e is not a part of the storage node set at epoch e+1 then the adversary can adapt and compromise a different node at epoch e + 1 after the epoch change has completed.
We assume every pair of honest nodes has access to a reliable and authenticated channel. The network is asyn- chronous, so the adversary can arbitrarily delay or reorder messages between honest nodes, but must eventually deliver every message unless the epoch ends first. If the epoch ends then the messages can be dropped.
Our goal is not only to provide a secure decentralized system but to also detect and punish any storage node that does not hold the data that it is assigned. This is a standard additional assumption for dencentralized storage system to make sure that honest parties cannot be covertly compromised forever.
However, an issue with erasure coding arises when a storage node goes offline, and needs to be replaced by another. Unlike fully replicated systems, where data can simply be copied from one node to another, RS-encoded systems require that all existing storage nodes send their slivers to the substitute node. The substitute can then recover the lost sliver, but this process results in O(|blob|) data
3The chance that all 25 storage nodes are adversarial and delete the file is 3−25 = 1.18 × 10−12.
being transmitted across the network. Frequent recoveries can erode the storage savings achieved through reduced replication, which means that these systems need a low churn of storage nodes and hence be less permisionless.
Regardless of the replication protocol, all existing de- centralized storage systems face an additional challenges: the need for a continuous stream of challenges to ensure that storage nodes are incentivized to retain the data and do not discard it. This is crucial in an open, decentralized system that offers payments for storage and goes beyond the honest/malicious setting. Current solutions always assume that the network is synchronous such that the adversary cannot read any missing data from honest nodes and reply to challenges in time.
#walrus $WAL

@Walrus 🦭/acc

Wir führen Walrus ein, einen dritten Ansatz für dezentrale Blob-Speicherung. Er kombiniert schnelle, linear decodierbare Fehlerkorrektur-Codes, die sich auf Hunderte von Speicherknoten skalieren lassen, um extrem hohe Robustheit bei geringem Speicheroverhead zu erreichen; und nutzt eine moderne Blockchain, Sui, für ihre Steuerungsebene – von der Lebenszyklusverwaltung der Speicherknoten bis hin zur Lebenszyklusverwaltung der Blobs, sowie für Wirtschaft und Anreize – wodurch der Bedarf an einer vollständig eigenen Blockchain-Protokoll entfällt.
Im Kern von Walrus liegt ein neues Kodierungsprotokoll namens Red Stuff, das einen neuartigen zweidimensionalen (2D) Kodierungsalgorithmus basierend auf Fountain-Codes verwendet.