WEBVTT

00:00:00.640 --> 00:00:02.980
The following content is
provided under a Creative

00:00:02.980 --> 00:00:04.370
Commons license.

00:00:04.370 --> 00:00:06.580
Your support will help
MIT OpenCourseWare

00:00:06.580 --> 00:00:10.670
continue to offer high quality
educational resources for free.

00:00:10.670 --> 00:00:13.240
To make a donation or to
view additional materials

00:00:13.240 --> 00:00:17.200
from hundreds of MIT courses,
visit MIT OpenCourseWare

00:00:17.200 --> 00:00:18.086
at ocw.mit.edu.

00:00:22.923 --> 00:00:23.590
TADGE DRYJA: OK.

00:00:23.590 --> 00:00:29.260
So today, Discreet Log
Contracts which is very linked

00:00:29.260 --> 00:00:30.260
to Lightning Networks.

00:00:30.260 --> 00:00:35.740
So if you didn't get
the last two lectures,

00:00:35.740 --> 00:00:37.730
this might not make
that much sense.

00:00:37.730 --> 00:00:39.730
So I hope-- but I think
everyone here is like up

00:00:39.730 --> 00:00:41.020
to date on these things.

00:00:41.020 --> 00:00:44.140
So today, I'm going to talk
about Discreet Log Contracts,

00:00:44.140 --> 00:00:46.860
which is a paper I
wrote last summer,

00:00:46.860 --> 00:00:48.610
but it's evolved out
of Lightning Network.

00:00:48.610 --> 00:00:51.500
And I'll try to sort
of explain how it--

00:00:51.500 --> 00:00:54.220
hopefully, you'll see the
connections and how you

00:00:54.220 --> 00:00:56.030
can get from one to the other.

00:00:56.030 --> 00:00:59.200
We'll talk about oracles, talk
about anticipated signatures,

00:00:59.200 --> 00:01:02.703
which has some fun
math things, and talk

00:01:02.703 --> 00:01:04.870
about building the Discreet
Log Contracts themselves

00:01:04.870 --> 00:01:07.410
and how that'll work.

00:01:07.410 --> 00:01:11.560
OK, so conditional
payments, I guess

00:01:11.560 --> 00:01:13.900
you could call this
smart contracts.

00:01:13.900 --> 00:01:16.840
Smart contracts is
a pretty vague term,

00:01:16.840 --> 00:01:21.260
and it's used a lot in this
sort of Bitcoin, blockchain,

00:01:21.260 --> 00:01:22.510
Ethereum world.

00:01:22.510 --> 00:01:24.460
And usually, it's pretty--

00:01:24.460 --> 00:01:27.300
like, a lot of times,
they use it as a buzzword

00:01:27.300 --> 00:01:31.170
and it's like, oh, I'll put my
land title in a smart contract

00:01:31.170 --> 00:01:33.910
and then I can buy a house.

00:01:33.910 --> 00:01:35.850
And a lot of times,
it's used in ways

00:01:35.850 --> 00:01:39.870
that make it seem as though you
don't need a government anymore

00:01:39.870 --> 00:01:42.600
or a judicial system anymore
to enforce these contracts.

00:01:42.600 --> 00:01:44.975
And in the case of something
like Discreet Log Contracts,

00:01:44.975 --> 00:01:46.560
that's kind of true.

00:01:46.560 --> 00:01:49.650
Because what
Bitcoin did and what

00:01:49.650 --> 00:01:51.780
made people pretty
impressed was that, hey,

00:01:51.780 --> 00:01:55.260
you don't need a
government to enforce

00:01:55.260 --> 00:01:59.702
the scarcity of the currency
that's being created.

00:01:59.702 --> 00:02:00.660
So that's kind of cool.

00:02:00.660 --> 00:02:03.570
But it doesn't mean that you can
now use blockchain technology

00:02:03.570 --> 00:02:06.300
to not need a government
to enforce, say, rights

00:02:06.300 --> 00:02:08.550
to property.

00:02:08.550 --> 00:02:10.842
If you say, hey, this
is my land and I've

00:02:10.842 --> 00:02:13.050
got a smart contract that
says my land is-- you know,

00:02:13.050 --> 00:02:15.120
this is my land
on the blockchain,

00:02:15.120 --> 00:02:18.777
and then an army comes and says,
well, we're taking your farm,

00:02:18.777 --> 00:02:20.610
and you're like, no,
it's on the blockchain,

00:02:20.610 --> 00:02:23.570
and they don't really care.

00:02:23.570 --> 00:02:25.830
So it's hard-- like,
another way to think

00:02:25.830 --> 00:02:28.890
about it is the only thing
the Bitcoin network can do

00:02:28.890 --> 00:02:30.660
is move Bitcoin,
and the only thing

00:02:30.660 --> 00:02:34.320
the Ethereum network can do is
move Ethereum, to some extent.

00:02:34.320 --> 00:02:37.500
It doesn't extend out
to like, you know,

00:02:37.500 --> 00:02:40.050
autonomous drones to
shoot you if you trespass

00:02:40.050 --> 00:02:43.090
or anything like that yet.

00:02:43.090 --> 00:02:45.060
OK, so the simplest
and, I think,

00:02:45.060 --> 00:02:47.940
most straightforward and
maybe the most useful type

00:02:47.940 --> 00:02:50.550
of smart contract is a
conditional payment where

00:02:50.550 --> 00:02:52.050
it's basically, I'm
going to pay you

00:02:52.050 --> 00:02:54.010
based on some external data.

00:02:54.010 --> 00:02:56.130
So I'm going to use the
example of Alice and Bob

00:02:56.130 --> 00:02:57.840
betting on tomorrow's weather.

00:02:57.840 --> 00:02:59.370
If it rains, Alice gets a coin.

00:02:59.370 --> 00:03:01.260
If it's sunny, Bob gets a coin.

00:03:01.260 --> 00:03:05.520
And we need some kind of
way to get this data, right.

00:03:05.520 --> 00:03:09.180
OP_WEATHER is not in Bitcoin.

00:03:09.180 --> 00:03:12.760
And I think, yeah,
bet is a word that--

00:03:12.760 --> 00:03:13.260
it's weird.

00:03:13.260 --> 00:03:16.620
Like, when I'll meet
with fancy rich people,

00:03:16.620 --> 00:03:20.512
like who are in companies
that come to the Media Lab--

00:03:20.512 --> 00:03:21.720
no, I still use the word bet.

00:03:21.720 --> 00:03:24.510
Like, to me, everything's
a bet, right?

00:03:24.510 --> 00:03:25.620
Insurance is a bet.

00:03:25.620 --> 00:03:30.520
Like, if I buy car insurance,
I'm betting GEICO or whatever.

00:03:30.520 --> 00:03:31.830
Bet I'm going to crash my car.

00:03:31.830 --> 00:03:33.010
And they're like,
I bet you won't.

00:03:33.010 --> 00:03:35.177
And then if I crash my car,
they're like, aw, shoot,

00:03:35.177 --> 00:03:37.030
and then they give
you the money.

00:03:37.030 --> 00:03:38.740
And if I get health
insurance, I'm like,

00:03:38.740 --> 00:03:39.640
I bet I'm going to get cancer.

00:03:39.640 --> 00:03:41.182
And then they're
like, bet you won't.

00:03:41.182 --> 00:03:43.140
And then if I get
cancer, I win and I

00:03:43.140 --> 00:03:46.000
get a whole bunch of money.

00:03:46.000 --> 00:03:46.500
Right.

00:03:46.500 --> 00:03:49.370
Well, so they're
offset by the fact

00:03:49.370 --> 00:03:51.120
that you don't actually
want to get cancer

00:03:51.120 --> 00:03:52.900
and you don't want
to crash your car.

00:03:52.900 --> 00:03:55.192
And so the fact that you're
betting that you will do it

00:03:55.192 --> 00:03:57.330
means that, in the case
that something bad happens,

00:03:57.330 --> 00:03:59.950
you get a bunch of money
to defer this cost.

00:03:59.950 --> 00:04:02.820
But fundamentally, from the
insurance company's perspective

00:04:02.820 --> 00:04:06.060
and your perspective in
this insurance contract,

00:04:06.060 --> 00:04:10.300
it's a bet about whether
you're going to do this or not.

00:04:10.300 --> 00:04:12.300
And like almost all the
financial contracts,

00:04:12.300 --> 00:04:15.930
you can look at as bets,
like derivatives and futures

00:04:15.930 --> 00:04:17.180
and all those kinds of things.

00:04:17.180 --> 00:04:19.630
OK, so to keep it
simple for the example,

00:04:19.630 --> 00:04:22.240
there's a very limited
set of outcomes.

00:04:22.240 --> 00:04:22.740
Right?

00:04:22.740 --> 00:04:24.510
It's either rainy
or sunny tomorrow,

00:04:24.510 --> 00:04:26.220
and we don't know that it's
going to-- what the weather is

00:04:26.220 --> 00:04:28.850
going to be tomorrow yet, and
we're going to bet the coin.

00:04:28.850 --> 00:04:29.460
OK.

00:04:29.460 --> 00:04:33.870
So yeah, we need oracles.

00:04:33.870 --> 00:04:36.420
And I would argue that
the Lightning Network

00:04:36.420 --> 00:04:38.690
script is essentially a
smart contract, right,

00:04:38.690 --> 00:04:43.860
the this key now or
this other key later.

00:04:43.860 --> 00:04:46.600
In Lightning, however, we
don't have external state.

00:04:46.600 --> 00:04:47.100
Right?

00:04:47.100 --> 00:04:50.098
There's no need to
query a third party.

00:04:50.098 --> 00:04:51.890
There's no need to
query the outside world.

00:04:51.890 --> 00:04:54.960
And all the data that
is used in the channel

00:04:54.960 --> 00:04:57.730
is generated by the participants
of the channel themselves.

00:04:57.730 --> 00:04:58.230
Right?

00:04:58.230 --> 00:05:00.660
They're making up random keys,
throwing them-- you know,

00:05:00.660 --> 00:05:04.290
sending them to each other just
so that they can negotiate over

00:05:04.290 --> 00:05:06.660
the balances in that channel.

00:05:06.660 --> 00:05:09.885
That said, they're probably
exchanging something outside

00:05:09.885 --> 00:05:11.010
of the scope of the system.

00:05:11.010 --> 00:05:11.510
Right?

00:05:11.510 --> 00:05:13.200
They're probably
trading, you know,

00:05:13.200 --> 00:05:15.930
I'll give you a little bit
of Bitcoin for some cookies,

00:05:15.930 --> 00:05:17.388
or something like
that, and there's

00:05:17.388 --> 00:05:21.420
some delivery of goods or
services that's not in Bitcoin.

00:05:21.420 --> 00:05:24.593
But for the state itself,
it's all internal.

00:05:24.593 --> 00:05:26.010
If we want external
state, we need

00:05:26.010 --> 00:05:29.400
some way to get that external
state into our system.

00:05:29.400 --> 00:05:32.160
Usually, this is
called an oracle.

00:05:32.160 --> 00:05:35.130
OK, so the simplest oracle
would be two of three multisig,

00:05:35.130 --> 00:05:36.690
and there are
places that do this.

00:05:36.690 --> 00:05:40.312
And it's not-- I don't want to
say it's like a stupid idea.

00:05:40.312 --> 00:05:41.520
It's actually quite powerful.

00:05:41.520 --> 00:05:45.030
And Bitcoin enables it in ways
that you couldn't necessarily

00:05:45.030 --> 00:05:47.490
do before, but there's
problems with it.

00:05:47.490 --> 00:05:49.890
OK, so if you just say
two of two multisig,

00:05:49.890 --> 00:05:52.150
where Alice and Bob both
put coins into a two--

00:05:52.150 --> 00:05:54.180
you know, into a
channel-like structure

00:05:54.180 --> 00:05:57.150
where they both need
to sign, and then

00:05:57.150 --> 00:06:01.470
they can say, OK, well, at the
end of the end of tomorrow,

00:06:01.470 --> 00:06:03.780
whether it's sunny or rainy,
we distribute the coins.

00:06:03.780 --> 00:06:08.020
The problem is, it gets
stuck if they disagree.

00:06:08.020 --> 00:06:08.520
Right?

00:06:08.520 --> 00:06:10.650
Also, rich players
are at an advantage.

00:06:10.650 --> 00:06:12.700
They can say, well,
I think I'm right.

00:06:12.700 --> 00:06:16.070
I'm fine not signing
to get these coins out.

00:06:16.070 --> 00:06:17.460
It works great
with friends, sort

00:06:17.460 --> 00:06:20.010
of gentlemen's agreement,
ladies' agreement, or shake

00:06:20.010 --> 00:06:20.550
hands.

00:06:20.550 --> 00:06:21.508
OK, yeah, you're right.

00:06:21.508 --> 00:06:22.950
It was sunny.

00:06:22.950 --> 00:06:25.680
But Bitcoin is the
currency of enemies,

00:06:25.680 --> 00:06:30.242
so you want a third party to
decide in the case of conflict.

00:06:30.242 --> 00:06:32.700
There's a lot of, actually,
interesting sort of game theory

00:06:32.700 --> 00:06:35.160
things here where
people have tried--

00:06:35.160 --> 00:06:36.680
I've seen reports--
like, I've been

00:06:36.680 --> 00:06:38.430
to talks where people
are like, "Yeah, you

00:06:38.430 --> 00:06:39.305
don't need an oracle.

00:06:39.305 --> 00:06:43.650
You just agree on it without
any outside influence."

00:06:43.650 --> 00:06:45.660
And there's some fun
things, some fun attacks,

00:06:45.660 --> 00:06:48.000
where you can basically
say, OK, Alice,

00:06:48.000 --> 00:06:52.368
it rains, you win, but I'm
not giving you the money.

00:06:52.368 --> 00:06:53.910
And I can't get my
money back either,

00:06:53.910 --> 00:06:55.020
but here's what I'll do.

00:06:55.020 --> 00:06:57.960
I'll sign a bunch of
time locked transactions,

00:06:57.960 --> 00:07:00.630
and if you want a little
bit of your money,

00:07:00.630 --> 00:07:01.980
you can take it right now.

00:07:01.980 --> 00:07:03.522
If you want more of
it, you just have

00:07:03.522 --> 00:07:06.000
to wait weeks, months, years.

00:07:06.000 --> 00:07:08.090
And then Bob can say,
OK, it's up to you.

00:07:08.090 --> 00:07:08.700
Right?

00:07:08.700 --> 00:07:10.617
Like, how much of your
money do you want back?

00:07:10.617 --> 00:07:11.440
You can wait.

00:07:11.440 --> 00:07:13.330
And so you're playing
off the time value

00:07:13.330 --> 00:07:14.580
of money, kind of thing.

00:07:14.580 --> 00:07:17.828
Anyway, so I have seen many
things where it's like,

00:07:17.828 --> 00:07:18.870
you don't need an oracle.

00:07:18.870 --> 00:07:20.287
Just have these
two parties agree.

00:07:20.287 --> 00:07:22.380
And like game theory, hand wave.

00:07:22.380 --> 00:07:24.480
But I have never been
convinced by them.

00:07:24.480 --> 00:07:27.270
Like ultimately,
if we're in a bet

00:07:27.270 --> 00:07:29.490
and we don't trust
each other, we

00:07:29.490 --> 00:07:33.190
need some arbitrator to
decide the outcome of the bet.

00:07:33.190 --> 00:07:35.070
OK, so you have a
third party, right.

00:07:35.070 --> 00:07:38.820
You say, hey, we're going
to bet on this weather,

00:07:38.820 --> 00:07:42.725
and if there's a dispute,
we nominate Jeff, over here,

00:07:42.725 --> 00:07:44.100
and he's going to
be the one that

00:07:44.100 --> 00:07:46.260
decides whether
it actually rained

00:07:46.260 --> 00:07:51.070
or was sunny in order to
determine who gets the money.

00:07:51.070 --> 00:07:55.040
OK, so you have
three keys, right?

00:07:55.040 --> 00:07:57.780
You've got Alice and Bob who
are in the bet and you've got--

00:07:57.780 --> 00:07:59.810
oh, well, that wasn't
how I thought--

00:07:59.810 --> 00:08:03.440
Olivia, who is the oracle.

00:08:03.440 --> 00:08:05.810
And if Alice and Bob are
chill, they both sign

00:08:05.810 --> 00:08:07.460
and they don't even
contact Olivia.

00:08:07.460 --> 00:08:09.085
Right, they're like,
yep, it was rainy.

00:08:09.085 --> 00:08:10.580
OK, you get the coins.

00:08:10.580 --> 00:08:11.850
Don't even involve Olivia.

00:08:11.850 --> 00:08:13.580
She doesn't have to
deal with anything.

00:08:13.580 --> 00:08:15.743
But if they fight and
they're saying, you know,

00:08:15.743 --> 00:08:16.910
this is totally not raining.

00:08:16.910 --> 00:08:18.980
This is like, right now,
this is not rain, right?

00:08:18.980 --> 00:08:19.920
This doesn't count.

00:08:19.920 --> 00:08:21.380
They're like, there's nothing.

00:08:21.380 --> 00:08:23.210
It's basically sunny.

00:08:23.210 --> 00:08:26.150
So if they fight about this,
they can ask Olivia to sign.

00:08:26.150 --> 00:08:29.480
Either of them can
contact Olivia and say,

00:08:29.480 --> 00:08:33.950
hey, my counterparty is either
unresponsive or uncooperative.

00:08:33.950 --> 00:08:34.669
Can you sign?

00:08:34.669 --> 00:08:37.127
And then sign off on the fact
that it is, in fact, raining.

00:08:37.127 --> 00:08:38.419
I get the coins.

00:08:38.419 --> 00:08:41.570
The problem is,
let's say it's sunny,

00:08:41.570 --> 00:08:44.090
and then Alice tells
Olivia, hey, it's out.

00:08:44.090 --> 00:08:45.890
Hey, it's Alice.

00:08:45.890 --> 00:08:48.910
Say it's raining, and
I'll give you 0.8 points.

00:08:48.910 --> 00:08:49.550
Right.

00:08:49.550 --> 00:08:53.210
I'm not supposed to get
anything, but give me 0.2,

00:08:53.210 --> 00:08:56.360
you get 0.8, win-win
for both of us.

00:08:56.360 --> 00:09:01.780
So the oracle can be
influenced and bribed.

00:09:01.780 --> 00:09:03.940
Right, so the problem here?

00:09:03.940 --> 00:09:07.180
You've got interaction between
the oracle and the participants

00:09:07.180 --> 00:09:08.380
in the bet.

00:09:08.380 --> 00:09:13.080
Two of three multi sig oracles,
they see every contract.

00:09:13.080 --> 00:09:13.580
Right?

00:09:13.580 --> 00:09:16.010
The contract itself
is essentially

00:09:16.010 --> 00:09:19.550
not a smart contract, really,
anymore because Olivia

00:09:19.550 --> 00:09:23.460
has to know like the legal-ish
looking terms of the contract,

00:09:23.460 --> 00:09:23.960
right?

00:09:23.960 --> 00:09:27.140
Olivia, the oracle, has to
say, OK, in what case do I

00:09:27.140 --> 00:09:27.817
side with Alice?

00:09:27.817 --> 00:09:29.150
In what case do I side with Bob?

00:09:29.150 --> 00:09:31.160
It could be programmatic,
but it could also just

00:09:31.160 --> 00:09:33.230
be a sheet of paper with
a bunch of text on it,

00:09:33.230 --> 00:09:36.040
and Olivia's an actual person
and determines based on that.

00:09:36.040 --> 00:09:39.920
Right, so this is just sort
of a custodian arbitrator

00:09:39.920 --> 00:09:41.160
kind of thing.

00:09:41.160 --> 00:09:44.750
It's not that cool, like
high-tech cryptography

00:09:44.750 --> 00:09:47.090
kind of thing, really.

00:09:47.090 --> 00:09:49.490
Yeah, and they also
decide individually,

00:09:49.490 --> 00:09:50.510
so they can equivocate.

00:09:50.510 --> 00:09:53.210
So if everyone's
betting on the weather,

00:09:53.210 --> 00:09:56.810
they don't have to sign
that it's sunny universally.

00:09:56.810 --> 00:10:00.050
They can sign to sunny on this
side and rainy on that side.

00:10:00.050 --> 00:10:03.050
There's nothing you
can do about that.

00:10:03.050 --> 00:10:04.940
So I think what led me
to think about these,

00:10:04.940 --> 00:10:07.273
it'd be better if the oracle
couldn't equivocate, right?

00:10:07.273 --> 00:10:08.960
They can't deter--
you know, they

00:10:08.960 --> 00:10:10.970
can't say two different things.

00:10:10.970 --> 00:10:14.060
And it's even better if they
never see the contracts,

00:10:14.060 --> 00:10:15.430
but how do we do that?

00:10:15.430 --> 00:10:17.990
OK, so any questions about the
general setup of what we're

00:10:17.990 --> 00:10:19.160
trying to accomplish here?

00:10:22.387 --> 00:10:23.526
Bets?

00:10:23.526 --> 00:10:25.276
And then you can have
multiple-- you know,

00:10:25.276 --> 00:10:26.750
lots of different types of bets.

00:10:26.750 --> 00:10:29.310
But anyway, this is
the essential problem.

00:10:29.310 --> 00:10:31.360
How do we do this?

00:10:31.360 --> 00:10:33.850
And like in Ethereum, most
of the time, everything's

00:10:33.850 --> 00:10:34.870
on chain, right.

00:10:34.870 --> 00:10:37.840
The data sources are published
on the Ethereum blockchain.

00:10:37.840 --> 00:10:40.270
So you sort of have
similar problems.

00:10:40.270 --> 00:10:43.300
There's ideas of, OK, let's
have a bunch of oracles,

00:10:43.300 --> 00:10:45.580
and then you sort of take
the average of all oracles.

00:10:45.580 --> 00:10:48.640
There's different
ways, but this thing

00:10:48.640 --> 00:10:51.470
is, OK, make the oracles
never see the contracts.

00:10:51.470 --> 00:10:52.030
But how?

00:10:52.030 --> 00:10:55.270
OK, and then how is going
to be kind of complicated.

00:10:55.270 --> 00:10:59.300
So remember these
from last time?

00:10:59.300 --> 00:10:59.800
Right.

00:10:59.800 --> 00:11:04.020
These sign with this key,
and you have to wait.

00:11:04.020 --> 00:11:06.700
Sign with these two keys,
and you get it immediately.

00:11:06.700 --> 00:11:11.740
This kind of same exact script
is like, so that will be used.

00:11:11.740 --> 00:11:16.450
OK, and then a think I talked
about this on the third class

00:11:16.450 --> 00:11:18.480
about signatures,
but we're going

00:11:18.480 --> 00:11:22.030
to go more in-depth in
Schnorr signatures here.

00:11:22.030 --> 00:11:26.170
OK, so in Bitcoin, we've got
this ECDSA elliptic curve.

00:11:26.170 --> 00:11:31.240
In Bitcoin, you use ECDSA,
Elliptic Curve Digital

00:11:31.240 --> 00:11:34.510
Signature Algorithm, which
is different than what

00:11:34.510 --> 00:11:36.230
I'm going to explain.

00:11:36.230 --> 00:11:38.800
But this aspect is
the same, right?

00:11:38.800 --> 00:11:42.400
The public keys are private
keys times a generator point.

00:11:42.400 --> 00:11:47.110
So we can do this without
actually using the Bitcoin

00:11:47.110 --> 00:11:47.980
signature algorithm.

00:11:47.980 --> 00:11:50.920
We can use our own external
signature algorithm,

00:11:50.920 --> 00:11:54.750
and then use the keys generated
by that in Bitcoin itself.

00:11:54.750 --> 00:11:58.570
OK, so a and b
lowercase, scalar.

00:11:58.570 --> 00:12:01.280
Big A, big B, uppercase,
they're points on the curve.

00:12:01.280 --> 00:12:02.570
So what operations can we do?

00:12:02.570 --> 00:12:05.953
I think this is review, but
this was like months ago.

00:12:05.953 --> 00:12:07.870
Regular numbers, you can
do whatever you want.

00:12:07.870 --> 00:12:08.890
They're regular numbers.

00:12:08.890 --> 00:12:10.600
It's easy.

00:12:10.600 --> 00:12:12.820
Add, subtract,
multiply, divide, it's

00:12:12.820 --> 00:12:16.260
literally in the software
just like BigInt.add,

00:12:16.260 --> 00:12:18.910
and the BigInt addition and
mult-- you know, the BigInt

00:12:18.910 --> 00:12:21.400
operations, if you actually
look underneath at the code,

00:12:21.400 --> 00:12:22.570
they're real simple.

00:12:22.570 --> 00:12:24.500
You're just adding numbers.

00:12:24.500 --> 00:12:26.890
So you can do whatever
you want with these.

00:12:26.890 --> 00:12:28.000
Points.

00:12:28.000 --> 00:12:29.110
Points are a group.

00:12:29.110 --> 00:12:31.810
They do not have two
operations defined.

00:12:31.810 --> 00:12:33.490
They only have one
operation defined,

00:12:33.490 --> 00:12:36.520
and we call that addition.

00:12:36.520 --> 00:12:39.728
It's sort of-- like, you
could call it something else.

00:12:39.728 --> 00:12:41.770
Sometimes, they use a
different symbol than plus,

00:12:41.770 --> 00:12:45.630
but addition's sort
of what we call it.

00:12:45.630 --> 00:12:48.900
And it works the way you'd think
addition would work, right?

00:12:48.900 --> 00:12:50.340
You add these two things.

00:12:50.340 --> 00:12:52.200
If you add A and B,
and then subtract B,

00:12:52.200 --> 00:12:55.080
you get back to A,
things like that.

00:12:55.080 --> 00:12:57.480
OK, so you can add and
subtract, but you can't multiply

00:12:57.480 --> 00:12:58.540
or divide.

00:12:58.540 --> 00:12:59.040
Right?

00:12:59.040 --> 00:13:02.220
These are not defined.

00:13:02.220 --> 00:13:03.860
OK, and you can
mix these things.

00:13:03.860 --> 00:13:08.390
So you cannot add a
point and a scalar.

00:13:08.390 --> 00:13:09.417
That's also undefined.

00:13:09.417 --> 00:13:11.750
So if you have like a point
here, and you want to add 5,

00:13:11.750 --> 00:13:13.380
it doesn't make sense.

00:13:13.380 --> 00:13:16.480
However, you can multiply
a point by a scalar.

00:13:16.480 --> 00:13:19.750
And you can divide a point--

00:13:19.750 --> 00:13:20.537
yeah.

00:13:20.537 --> 00:13:21.370
You can divide that.

00:13:24.020 --> 00:13:26.360
And the way you do
that is you just,

00:13:26.360 --> 00:13:28.760
in the actual elliptic curve,
you-- to double a point,

00:13:28.760 --> 00:13:29.870
you take the tangent.

00:13:29.870 --> 00:13:32.120
So instead of drawing a
line between two points,

00:13:32.120 --> 00:13:34.850
you say, well, I'm drawing a
line between this single point,

00:13:34.850 --> 00:13:37.280
which basically means the
tangent, as you sort of like--

00:13:37.280 --> 00:13:40.550
things like limit as the
spacing between those two points

00:13:40.550 --> 00:13:42.710
goes to zero.

00:13:42.710 --> 00:13:45.620
And then if you can double a
point, if you can add A plus A,

00:13:45.620 --> 00:13:48.830
then you can multiply by any
arbitrary number by saying,

00:13:48.830 --> 00:13:51.770
OK, I'll take 2A
to be a tangent.

00:13:51.770 --> 00:13:53.450
I'll take 4A to be
the tangent of that.

00:13:53.450 --> 00:13:56.960
I'll take it A to A to
be the tangent of that.

00:13:56.960 --> 00:13:59.972
And then you can add up,
like you can do binary

00:13:59.972 --> 00:14:02.180
decomposition-- and computers
are real good at that--

00:14:02.180 --> 00:14:03.305
and say, OK, I'm going to--

00:14:03.305 --> 00:14:07.180
I need 5A, so I'm going
to take A plus 4A.

00:14:07.180 --> 00:14:07.680
Right.

00:14:10.290 --> 00:14:11.270
Now-- oop, yeah.

00:14:11.270 --> 00:14:14.510
So you can divide--
divide's a little annoying,

00:14:14.510 --> 00:14:15.680
but you can do that.

00:14:15.680 --> 00:14:18.170
OK, so you've got all
these operations we can do.

00:14:18.170 --> 00:14:20.600
You can do whatever you
want with the scalars.

00:14:20.600 --> 00:14:25.160
You can add points, subtract
points, multiply these points

00:14:25.160 --> 00:14:27.860
by scalars.

00:14:27.860 --> 00:14:30.500
With this alone you can do--
and then, also, well, you

00:14:30.500 --> 00:14:32.795
have to throw hash
functions in there

00:14:32.795 --> 00:14:34.670
for the stuff we're
going to do, but you guys

00:14:34.670 --> 00:14:36.030
know all about hash functions.

00:14:36.030 --> 00:14:37.530
So with this and
hash functions, you

00:14:37.530 --> 00:14:39.950
can do like ridiculous
amounts of stuff.

00:14:39.950 --> 00:14:42.392
It's really kind of impressive.

00:14:42.392 --> 00:14:44.600
Also, you can-- so yeah,
part of the signature system

00:14:44.600 --> 00:14:48.360
is you pick some random point
G. Sometimes, in other systems,

00:14:48.360 --> 00:14:50.930
you have G and H,
two other points.

00:14:50.930 --> 00:14:53.540
But the idea is
everyone just agrees,

00:14:53.540 --> 00:14:58.530
we've got some point G
and everyone agrees on it.

00:14:58.530 --> 00:15:00.950
OK, a nice property.

00:15:00.950 --> 00:15:04.040
You can add keys that
you can-- you know,

00:15:04.040 --> 00:15:06.480
the addition sort of works--

00:15:06.480 --> 00:15:10.410
addition in the scalar world
works in the point world

00:15:10.410 --> 00:15:10.910
as well.

00:15:10.910 --> 00:15:11.410
Right?

00:15:11.410 --> 00:15:14.000
So if you have a times
G plus b times g,

00:15:14.000 --> 00:15:18.020
and that's a point, that's
equal to a plus b times g,

00:15:18.020 --> 00:15:20.210
also going to be a point.

00:15:20.210 --> 00:15:22.550
So that is what
we're going to use.

00:15:26.830 --> 00:15:31.490
And you can use
this to share keys.

00:15:31.490 --> 00:15:34.340
Right, I think I
explained this last time.

00:15:34.340 --> 00:15:37.310
If you know little a, but
you don't know little b

00:15:37.310 --> 00:15:38.960
you can't sign.

00:15:38.960 --> 00:15:42.570
But if you learn both, you
can sign for this, you know,

00:15:42.570 --> 00:15:46.300
this summed pubkey.

00:15:46.300 --> 00:15:49.370
So this is a way
to like share keys.

00:15:49.370 --> 00:15:50.993
OK.

00:15:50.993 --> 00:15:51.743
Yeah, [INAUDIBLE].

00:15:51.743 --> 00:15:52.693
Yeah, like OK.

00:15:52.693 --> 00:15:54.110
Well, that's sort
of out of order.

00:15:54.110 --> 00:15:56.180
Anyway, Schnorr
signatures, which

00:15:56.180 --> 00:15:58.700
are going to go into
Bitcoin probably

00:15:58.700 --> 00:16:00.500
not even this year,
maybe next year,

00:16:00.500 --> 00:16:02.750
and there's a lot of cool
things you can do with them.

00:16:02.750 --> 00:16:04.958
I think I'm talking about
that next week in the term.

00:16:04.958 --> 00:16:07.790
Like, that's aggregation, right?

00:16:07.790 --> 00:16:10.255
But the basic idea of a
Schnorr signature, you've

00:16:10.255 --> 00:16:12.380
got a public key that you've
already told everyone.

00:16:12.380 --> 00:16:14.780
Right, so before
anything happens,

00:16:14.780 --> 00:16:18.530
you pick a random private key
little a, multiply it by G,

00:16:18.530 --> 00:16:22.190
and then compute big A and tell
that to the world either by

00:16:22.190 --> 00:16:25.610
send-- having that as an output
address in your Bitcoin script

00:16:25.610 --> 00:16:26.990
or publishing it on a website.

00:16:26.990 --> 00:16:28.640
You know, somehow,
you propagate,

00:16:28.640 --> 00:16:29.780
hey, this is my public key.

00:16:29.780 --> 00:16:30.940
This is me.

00:16:30.940 --> 00:16:33.980
OK, and then when
you sign, you come up

00:16:33.980 --> 00:16:36.110
with another private
key, pretty much

00:16:36.110 --> 00:16:37.240
the exact same as little a.

00:16:37.240 --> 00:16:39.560
It's going to be
called little k.

00:16:39.560 --> 00:16:43.790
And then you compute R, which
is k times the generator point.

00:16:43.790 --> 00:16:47.480
So this R is pretty
much the same idea as--

00:16:47.480 --> 00:16:51.110
it's another public key, but
this will only be used once.

00:16:51.110 --> 00:16:56.390
And then to sign, you compute s,
which is k, that thing you just

00:16:56.390 --> 00:17:00.230
made up, minus the hash
of the message the sign

00:17:00.230 --> 00:17:05.030
concatenated with R
times your private key.

00:17:05.030 --> 00:17:09.589
OK, and then the
signature is R and s.

00:17:09.589 --> 00:17:12.000
And then for someone
to verify this,

00:17:12.000 --> 00:17:15.599
they know m, right, the
message you're trying to sign.

00:17:15.599 --> 00:17:19.440
They know your public
key, big A. They know R

00:17:19.440 --> 00:17:21.210
and s, your signature.

00:17:21.210 --> 00:17:21.960
And they try to--

00:17:21.960 --> 00:17:23.835
what they do is they
just multiply both sides

00:17:23.835 --> 00:17:25.619
of this equation by G. Right?

00:17:25.619 --> 00:17:27.780
So you can you can do
that, same as regular math,

00:17:27.780 --> 00:17:29.610
multiply both sides
by the same thing.

00:17:29.610 --> 00:17:32.110
So they can't verify this
because they don't know

00:17:32.110 --> 00:17:34.470
little a, they don't know k.

00:17:34.470 --> 00:17:37.770
But if you multiply it by G,
well then you get s times G

00:17:37.770 --> 00:17:42.420
equals k times G minus
this hash times a times

00:17:42.420 --> 00:17:46.170
G. Well, that is just
your public key, right?

00:17:46.170 --> 00:17:49.230
This is R. And
this, you also know

00:17:49.230 --> 00:17:51.120
because they gave
you s, so you know

00:17:51.120 --> 00:17:55.650
G. That is, you know s times
G. So that's how you verify.

00:17:55.650 --> 00:17:58.267
And it's-- like, there's all
sorts of proofs about why you

00:17:58.267 --> 00:17:59.850
can't forge these
and stuff like that,

00:17:59.850 --> 00:18:01.270
but it sort of makes sense.

00:18:01.270 --> 00:18:01.770
Right?

00:18:01.770 --> 00:18:05.010
If you're trying to forge
a signature, and you say,

00:18:05.010 --> 00:18:08.160
hey, I'm going to solve for s.

00:18:08.160 --> 00:18:12.560
Right, well, I can't solve
for s directly because I don't

00:18:12.560 --> 00:18:16.350
know little a, I don't know k.

00:18:16.350 --> 00:18:18.040
The problem is, I want to--

00:18:18.040 --> 00:18:20.160
OK, I want to solve for
one of these things.

00:18:20.160 --> 00:18:21.660
I've basically got
an equation where

00:18:21.660 --> 00:18:28.090
I've got R minus the hash of R,
and I can't tear those apart.

00:18:28.090 --> 00:18:29.435
Right, like I need--

00:18:29.435 --> 00:18:31.060
how do I-- OK, solve
for R, but there's

00:18:31.060 --> 00:18:34.630
like the hash of R and R on
the same side of the equation.

00:18:34.630 --> 00:18:36.340
I could try to
move this so that,

00:18:36.340 --> 00:18:38.410
OK, R equals the hash of R?

00:18:38.410 --> 00:18:42.190
Like wait, how am
I going to do that?

00:18:42.190 --> 00:18:44.020
Right, so anytime
you try to solve,

00:18:44.020 --> 00:18:48.040
you're going to have an R and a
hash of R in the same equation.

00:18:48.040 --> 00:18:50.840
And, like, that seems
impossible, right?

00:18:50.840 --> 00:18:53.140
OK, so this is
Schnorr signatures.

00:18:53.140 --> 00:18:54.430
It works great.

00:18:54.430 --> 00:18:57.780
It's got nice lots
of nice properties.

00:18:57.780 --> 00:18:59.940
Actually, all of this
could work in ECDSA.

00:18:59.940 --> 00:19:03.750
It's just that ECDSA is like
really ugly and complicated.

00:19:03.750 --> 00:19:07.590
But anyway, so what
Discreet Log Contracts uses

00:19:07.590 --> 00:19:09.990
is a fixed-R signature.

00:19:09.990 --> 00:19:14.270
It's the exact same
equation, but you sort of

00:19:14.270 --> 00:19:16.280
move where R is considered.

00:19:16.280 --> 00:19:19.610
So before, you'd say,
the public key is A,

00:19:19.610 --> 00:19:22.730
and now, my
signature is R and s.

00:19:22.730 --> 00:19:25.160
Now, we're just going to
say, OK, make the public key

00:19:25.160 --> 00:19:28.620
A and R, two points, and
make the signature just s.

00:19:28.620 --> 00:19:30.690
So same equation,
everything's the same.

00:19:30.690 --> 00:19:34.980
It's just that you generate
k at the same time you're

00:19:34.980 --> 00:19:40.760
generating A, and publish both
A and R as your public key.

00:19:40.760 --> 00:19:42.830
Right, no problem.

00:19:42.830 --> 00:19:45.030
OK, the problem is you
can only sign once.

00:19:45.030 --> 00:19:48.760
That's why you don't
usually do this.

00:19:48.760 --> 00:19:50.080
There's no size difference.

00:19:50.080 --> 00:19:52.930
Right, it's like, OK, well, your
public key gets twice as big

00:19:52.930 --> 00:19:55.150
and your signature
gets half as big.

00:19:55.150 --> 00:19:56.650
No net gain.

00:19:56.650 --> 00:19:58.755
But you can only
sign once, and why?

00:19:58.755 --> 00:20:01.120
OK, I'm actually-- it
looks kind of scary,

00:20:01.120 --> 00:20:02.870
but it's actually not too bad.

00:20:02.870 --> 00:20:05.350
So the idea is I sign.

00:20:05.350 --> 00:20:08.110
I have an A and an R,
and those don't change.

00:20:08.110 --> 00:20:10.900
Right, so I have a little a and
a k, and those don't change.

00:20:10.900 --> 00:20:13.640
But I'm signing two
different messages.

00:20:13.640 --> 00:20:16.750
So the idea is I have
signature 1, s1, which

00:20:16.750 --> 00:20:19.870
is k minus the hash of
message 1 concatenated

00:20:19.870 --> 00:20:21.880
to R times my private key.

00:20:21.880 --> 00:20:24.970
Signature 2 is k minus
the hash of message 2

00:20:24.970 --> 00:20:26.680
and R times my private key.

00:20:26.680 --> 00:20:29.320
So I publish both
of these signatures.

00:20:29.320 --> 00:20:32.230
And then someone says, oh, I'm
going to subtract these two

00:20:32.230 --> 00:20:33.880
signatures from each other.

00:20:33.880 --> 00:20:37.000
Right, so s1 minus
s2, well, that

00:20:37.000 --> 00:20:39.550
would be this top thing
minus this thing, which

00:20:39.550 --> 00:20:42.580
is k minus the hash
of message 1 times a,

00:20:42.580 --> 00:20:48.385
minus k plus the hash
of message 2 times a.

00:20:48.385 --> 00:20:50.930
The k's cancel out.

00:20:50.930 --> 00:20:52.330
That's the important part here.

00:20:52.330 --> 00:20:54.010
So k's are gone.

00:20:54.010 --> 00:20:56.890
Cool, now I've got this s1
minus s2, which I can compute.

00:20:56.890 --> 00:20:59.710
Right, s is just a
scalar, s1 minus s2

00:20:59.710 --> 00:21:03.648
takes like a millionth of a
second on my computer to do.

00:21:03.648 --> 00:21:05.440
Now, I've got this s--
you know, this thing

00:21:05.440 --> 00:21:08.720
I know, s1 minus s2
equals the hash of message

00:21:08.720 --> 00:21:13.225
2, R times little a, minus the
hash of message 1, R, little a.

00:21:13.225 --> 00:21:17.920
I don't know a little a, right,
so I can't figure out this.

00:21:17.920 --> 00:21:20.040
But I know what's on this
side of the equation.

00:21:20.040 --> 00:21:20.540
Right?

00:21:20.540 --> 00:21:23.248
I know this sort
of subtracted s.

00:21:23.248 --> 00:21:24.040
What can I do here?

00:21:24.040 --> 00:21:28.930
Well, I can factor out a,
right, because a is multiplied

00:21:28.930 --> 00:21:30.305
on both sides of this.

00:21:30.305 --> 00:21:32.680
So now I can factor-- you
know, put a little parentheses.

00:21:32.680 --> 00:21:36.090
OK, this hash is message 2, R
minus the hash of message 1,

00:21:36.090 --> 00:21:40.090
R times the private key here.

00:21:40.090 --> 00:21:43.000
And now, I can divide.

00:21:43.000 --> 00:21:44.880
And well, this is the
whole equation, right?

00:21:44.880 --> 00:21:45.670
I divide out.

00:21:45.670 --> 00:21:47.550
I divide by little a here.

00:21:47.550 --> 00:21:50.920
The thing I know divided
by a thing I don't know

00:21:50.920 --> 00:21:52.473
equals a thing I know.

00:21:52.473 --> 00:21:54.640
Right, so I can move things
around and say, OK, well

00:21:54.640 --> 00:21:58.270
then a is this thing I
know, right, the difference

00:21:58.270 --> 00:22:02.230
between the two signatures,
divided by the difference

00:22:02.230 --> 00:22:04.222
between these two hashes.

00:22:04.222 --> 00:22:05.680
And those two
hashes, also, I know.

00:22:05.680 --> 00:22:05.980
Right?

00:22:05.980 --> 00:22:07.330
I know what the messages are.

00:22:07.330 --> 00:22:09.100
I know what the R value is.

00:22:09.100 --> 00:22:11.200
It works.

00:22:11.200 --> 00:22:14.110
So the big thing here is
if you have the same k

00:22:14.110 --> 00:22:18.680
value and the same a value,
you can find their private key.

00:22:18.680 --> 00:22:21.350
So normally, this is OK
because k is different.

00:22:21.350 --> 00:22:21.850
Right?

00:22:21.850 --> 00:22:24.520
So you'd have k sub
1, k sub 2 here.

00:22:24.520 --> 00:22:26.500
And then if you
build this equation,

00:22:26.500 --> 00:22:30.610
you've got these k's
which do not cancel out

00:22:30.610 --> 00:22:33.700
because you don't know what they
are and you don't get anywhere

00:22:33.700 --> 00:22:34.370
with this.

00:22:34.370 --> 00:22:38.950
OK, but so if you do
use the same k value,

00:22:38.950 --> 00:22:40.420
you will lose your private key.

00:22:40.420 --> 00:22:43.270
Fun fact, I first learned
about this in 2011

00:22:43.270 --> 00:22:46.960
from the PlayStation
3 code-signing thing.

00:22:46.960 --> 00:22:50.000
And yeah, that was when I--

00:22:50.000 --> 00:22:51.970
I think, because I started
to get into Bitcoin

00:22:51.970 --> 00:22:54.240
and, also, it was like, oh,
PlayStation 3 got hacked.

00:22:54.240 --> 00:22:55.150
Cool.

00:22:55.150 --> 00:22:58.120
So Sony had a k-- like,
they probably read up

00:22:58.120 --> 00:22:59.260
on how to do this.

00:22:59.260 --> 00:23:01.035
And they said, OK, k
needs to be random,

00:23:01.035 --> 00:23:02.410
so they just made
a random number

00:23:02.410 --> 00:23:04.465
and hardcoded it as
the k that they used.

00:23:04.465 --> 00:23:06.340
I don't think they
realized that it has to be

00:23:06.340 --> 00:23:08.500
random and different each time.

00:23:08.500 --> 00:23:11.980
So it was just a
single random k.

00:23:11.980 --> 00:23:14.830
Yeah, there's other cases
of this being a problem.

00:23:14.830 --> 00:23:19.570
In bitcoin-blockchain.info, I
believe, a couple of years ago,

00:23:19.570 --> 00:23:21.850
had something
where k was random,

00:23:21.850 --> 00:23:24.940
but it was like only four bytes
of randomness or something,

00:23:24.940 --> 00:23:28.480
and so you'd end up getting
some occasional k's that were

00:23:28.480 --> 00:23:29.990
the same.

00:23:29.990 --> 00:23:33.537
And then you could compute
people's private keys.

00:23:33.537 --> 00:23:35.620
There's a couple other
things like that where if--

00:23:35.620 --> 00:23:41.430
you know, so actually
in practice, now, you

00:23:41.430 --> 00:23:45.660
don't make k randomly
in Bitcoin Core,

00:23:45.660 --> 00:23:47.550
in most of the
Bitcoin libraries.

00:23:47.550 --> 00:23:51.090
You make k basically the
hash of your private key

00:23:51.090 --> 00:23:54.062
and the message so that it
changes for each message.

00:23:54.062 --> 00:23:55.770
And it's also got like
secret information

00:23:55.770 --> 00:23:58.500
so no one can figure it out.

00:23:58.500 --> 00:24:02.670
That that's called RFC
6979, and it is safer

00:24:02.670 --> 00:24:07.402
because you don't keep needing
new randomness each time.

00:24:07.402 --> 00:24:08.510
Oh, yes?

00:24:08.510 --> 00:24:10.660
AUDIENCE: Is this presented
for history's sake,

00:24:10.660 --> 00:24:13.360
or are people still
making this mistake?

00:24:13.360 --> 00:24:15.430
TADGE DRYJA: I
mean, will people?

00:24:15.430 --> 00:24:18.910
Like, people have made it
in very recent history.

00:24:18.910 --> 00:24:20.350
I wouldn't be
surprised if people

00:24:20.350 --> 00:24:22.600
continue to make this mistake.

00:24:22.600 --> 00:24:25.000
You know, a couple, two, three
years ago, Blockchain.info

00:24:25.000 --> 00:24:28.270
had this where the
k's were the same.

00:24:28.270 --> 00:24:30.220
It's not immediately--
you know, you

00:24:30.220 --> 00:24:32.410
have to sort of look for it.

00:24:32.410 --> 00:24:35.980
But yeah, people still make all
sorts of mistakes like this.

00:24:35.980 --> 00:24:39.640
There's-- elliptic curves
are actually less, I think,

00:24:39.640 --> 00:24:42.100
of a minefield then like RSA.

00:24:42.100 --> 00:24:45.245
RSA has all sorts of
like, I had no idea

00:24:45.245 --> 00:24:47.620
that would break the security
of the system, but it does.

00:24:47.620 --> 00:24:49.330
Like, you know,
in an RSA, you've

00:24:49.330 --> 00:24:51.280
got p and q, two big
prime numbers you

00:24:51.280 --> 00:24:53.290
multiply to get your modulus n.

00:24:53.290 --> 00:24:57.850
But if p minus 1 or
n minus 1 is smooth,

00:24:57.850 --> 00:25:01.128
which means has
many small factors,

00:25:01.128 --> 00:25:03.170
then you can break it and
find their private key.

00:25:03.170 --> 00:25:05.848
Like, I didn't know that
until last year in a class.

00:25:05.848 --> 00:25:06.640
I was like, really?

00:25:06.640 --> 00:25:08.770
Oh, wow.

00:25:08.770 --> 00:25:10.908
So there's all sorts of
bad things that can happen.

00:25:10.908 --> 00:25:12.450
In elliptic curves,
it's kind of nice

00:25:12.450 --> 00:25:15.410
in that your random numbers can
really just be random numbers.

00:25:15.410 --> 00:25:17.050
So it's not too--
it's not as bad.

00:25:17.050 --> 00:25:19.600
But you do have to watch out
for some of these things.

00:25:19.600 --> 00:25:25.930
OK, so this new system, right,
if your pubkey is A and R

00:25:25.930 --> 00:25:29.800
and a message m, right,
you cannot compute s.

00:25:29.800 --> 00:25:34.910
So I know they're a public key.

00:25:34.910 --> 00:25:39.010
Right, I know R. I know
they're probably-- like,

00:25:39.010 --> 00:25:40.990
I know this whole thing.

00:25:40.990 --> 00:25:43.220
I can't compute s,
right, because s

00:25:43.220 --> 00:25:45.130
is in terms of k and little a.

00:25:45.130 --> 00:25:48.580
I can compute s times G, though,
because s times G is in terms

00:25:48.580 --> 00:25:51.520
of R and big A, which I know.

00:25:51.520 --> 00:25:53.260
Right, so you can't
compute little s,

00:25:53.260 --> 00:25:57.990
but you can compute
s times G. So

00:25:57.990 --> 00:26:01.110
s times G is computable
for any given message.

00:26:01.110 --> 00:26:03.750
So if someone publishes this
new type of pubkey, A and R

00:26:03.750 --> 00:26:06.600
together, I can
say, OK, well, what

00:26:06.600 --> 00:26:09.380
will it look like if you
sign the message, sunny?

00:26:09.380 --> 00:26:13.650
Right, if you just take the
word sunny, stick it in here,

00:26:13.650 --> 00:26:15.930
concatenate it with the R
value you already told me,

00:26:15.930 --> 00:26:19.080
hash that, multiply
by your pubkey,

00:26:19.080 --> 00:26:21.630
and then subtract that
from your R value,

00:26:21.630 --> 00:26:23.910
I'll get a point on the
curve and I can compute that.

00:26:23.910 --> 00:26:26.100
And I can compute
that for any m I care

00:26:26.100 --> 00:26:28.678
to throw into this equation.

00:26:28.678 --> 00:26:29.970
So this is kind of neat, right?

00:26:29.970 --> 00:26:33.510
I can compute a point on
a curve for any message

00:26:33.510 --> 00:26:35.610
that you have not yet signed.

00:26:35.610 --> 00:26:40.200
And then the signature
itself would be s.

00:26:40.200 --> 00:26:42.780
This sort of is looking
like a key pair, right?

00:26:42.780 --> 00:26:44.580
So this is an unknown
scalar, right.

00:26:44.580 --> 00:26:46.380
I don't know what
s is, but I can

00:26:46.380 --> 00:26:51.330
compute s times G. This is a
public key, private key, right?

00:26:51.330 --> 00:26:53.670
This is the exact same setup.

00:26:53.670 --> 00:26:56.580
So now we can use this
for a third-party oracle

00:26:56.580 --> 00:26:57.750
to sign messages.

00:26:57.750 --> 00:26:59.250
And then when they
sign the message,

00:26:59.250 --> 00:27:01.208
they're revealing a
private key to a public key

00:27:01.208 --> 00:27:03.770
you've already computed.

00:27:03.770 --> 00:27:05.400
So when I was making
this, I definitely

00:27:05.400 --> 00:27:07.442
didn't start with Schnorr
signatures and do this.

00:27:07.442 --> 00:27:10.590
I had my own crazy
scheme, which had

00:27:10.590 --> 00:27:12.750
like all these different
equations and, like,

00:27:12.750 --> 00:27:14.518
R was multiplied
by this other hash

00:27:14.518 --> 00:27:15.810
and there was all these things.

00:27:15.810 --> 00:27:18.240
And then I was talking to people
and eventually was like, wait,

00:27:18.240 --> 00:27:19.240
you don't need all this.

00:27:19.240 --> 00:27:22.020
This is just a Schnorr
signature where I already

00:27:22.020 --> 00:27:24.060
know the R. So OK,
this is much nicer.

00:27:24.060 --> 00:27:27.662
I don't have to write this
whole crazy proof and stuff.

00:27:27.662 --> 00:27:28.620
OK, so we can use this.

00:27:31.290 --> 00:27:33.720
And we can use
Olivia's signature, s,

00:27:33.720 --> 00:27:37.140
as a private key in
our transactions.

00:27:37.140 --> 00:27:39.648
And we use s times
G as a public key.

00:27:39.648 --> 00:27:41.190
And then we can also
do the fun stuff

00:27:41.190 --> 00:27:44.110
where we mix with Alice
and Bob's public keys.

00:27:44.110 --> 00:27:44.610
Right?

00:27:44.610 --> 00:27:50.040
So I can say that Alice's
pubkey plus s times G is

00:27:50.040 --> 00:27:52.770
the public key
for this contract.

00:27:52.770 --> 00:27:56.380
And Alice's private
key plus s is

00:27:56.380 --> 00:27:58.870
going to be the private
key for this contract.

00:27:58.870 --> 00:28:00.850
So I can say-- what we
can do is we can say,

00:28:00.850 --> 00:28:03.550
OK, I'm going to
compute an address where

00:28:03.550 --> 00:28:06.550
it's your pubkey
plus the signature

00:28:06.550 --> 00:28:10.180
of this oracle signing
the word sunny times g,

00:28:10.180 --> 00:28:13.160
and that's the pubkey
for Alice's sunny pubkey.

00:28:13.160 --> 00:28:13.660
Right?

00:28:13.660 --> 00:28:17.350
Alice can only spend this if
the oracle signs the word sunny

00:28:17.350 --> 00:28:18.980
and she has her private key.

00:28:18.980 --> 00:28:20.650
If the oracle signs
the word rainy,

00:28:20.650 --> 00:28:22.192
Alice doesn't know
how to-- you know,

00:28:22.192 --> 00:28:24.450
doesn't learn the private key.

00:28:24.450 --> 00:28:27.660
Any questions about that part?

00:28:27.660 --> 00:28:28.290
Make sense?

00:28:28.290 --> 00:28:29.100
OK.

00:28:29.100 --> 00:28:30.790
So this is kind of cool.

00:28:30.790 --> 00:28:34.080
So what you can do, so
quick recap Lightning,

00:28:34.080 --> 00:28:36.810
you'd use the mechanism where
you're adding these keys

00:28:36.810 --> 00:28:38.640
to revoke old states, right.

00:28:38.640 --> 00:28:42.030
You say, OK, if I
give you this key,

00:28:42.030 --> 00:28:43.795
you can now spend
it immediately.

00:28:43.795 --> 00:28:46.170
If I give you this key, you
can now spend it immediately.

00:28:46.170 --> 00:28:49.852
So we enforce that with the
most recent one is the OK one

00:28:49.852 --> 00:28:51.560
because if I broadcast
on these old ones,

00:28:51.560 --> 00:28:52.980
you can immediately get it.

00:28:52.980 --> 00:28:55.250
In Discreet Log, I
switch it around a bit.

00:28:57.870 --> 00:29:01.210
I say, well, you know,
it looks like a channel.

00:29:01.210 --> 00:29:02.830
We both put money into here.

00:29:02.830 --> 00:29:07.120
And then we build three
different transactions

00:29:07.120 --> 00:29:10.420
all at the same time,
before we even do anything.

00:29:10.420 --> 00:29:13.990
Before we actually fund this,
we build these descendant

00:29:13.990 --> 00:29:15.190
transactions.

00:29:15.190 --> 00:29:17.440
And the idea is that the
public keys in here--

00:29:20.100 --> 00:29:22.680
this is Bob's public
key, but it's also

00:29:22.680 --> 00:29:25.440
got the sum, the sum
of Bob's public key

00:29:25.440 --> 00:29:28.310
plus the oracle's signature
of the word sunny.

00:29:28.310 --> 00:29:31.710
So if Bob broadcasts
it, and the only way

00:29:31.710 --> 00:29:33.602
he can immediately
take his funds

00:29:33.602 --> 00:29:35.310
is if the oracle
assigned the word sunny,

00:29:35.310 --> 00:29:37.200
and he knows that s value.

00:29:37.200 --> 00:29:39.655
If he broadcasts
it and then waits--

00:29:39.655 --> 00:29:42.780
right, if he broadcasts it,
but it's not actually sunny,

00:29:42.780 --> 00:29:45.260
then Alice can take the
money after a little while,

00:29:45.260 --> 00:29:46.220
right, after a day.

00:29:46.220 --> 00:29:47.790
You'd use the same
timeout procedure

00:29:47.790 --> 00:29:51.060
where, OK if I broadcast
this and I know the key,

00:29:51.060 --> 00:29:52.688
I immediately sweep it.

00:29:52.688 --> 00:29:54.480
If I broadcast it and
I don't know the key,

00:29:54.480 --> 00:29:57.705
my counterparty can take
everything after a day.

00:29:57.705 --> 00:29:59.580
So yeah, all states are
created at the start.

00:29:59.580 --> 00:30:02.250
The validity is determined
by the non-interactive oracle

00:30:02.250 --> 00:30:03.090
signature.

00:30:03.090 --> 00:30:07.770
So the oracle signs
cloudy, which is, yeah.

00:30:07.770 --> 00:30:10.170
And now, either
party can broadcast

00:30:10.170 --> 00:30:14.760
the cloudy transaction and then
take their money immediately.

00:30:14.760 --> 00:30:17.890
If anyone tries to broadcast,
so if-- for example,

00:30:17.890 --> 00:30:21.900
if Alice tries to broadcast
rainy at this point,

00:30:21.900 --> 00:30:23.912
the oracle has signed
the word cloudy,

00:30:23.912 --> 00:30:25.620
they're not going to
sign the word rainy.

00:30:25.620 --> 00:30:29.680
If they do sign the word rainy,
they reveal their private key.

00:30:29.680 --> 00:30:31.900
So if Alice broadcasts
this, her money's stuck.

00:30:31.900 --> 00:30:35.580
She doesn't actually
have this key.

00:30:35.580 --> 00:30:39.570
And then Bob just waits and
then takes all of Alice's money.

00:30:39.570 --> 00:30:42.420
So you know, from the
network's perspective,

00:30:42.420 --> 00:30:45.253
you can broadcast any
of these transactions,

00:30:45.253 --> 00:30:46.170
but you don't want to.

00:30:46.170 --> 00:30:50.920
Because you don't know the
key, it's not your funds.

00:30:50.920 --> 00:30:52.910
OK, so yeah.

00:30:52.910 --> 00:30:55.700
AUDIENCE: So the
wait piece, how does

00:30:55.700 --> 00:31:00.690
that-- so if in the case
where it's cloudy, but Alice

00:31:00.690 --> 00:31:03.310
signs the rainy key?

00:31:03.310 --> 00:31:05.550
TADGE DRYJA: Alice broadcasts
the rainy transaction?

00:31:05.550 --> 00:31:06.175
Yeah.

00:31:06.175 --> 00:31:08.300
AUDIENCE: Alice broadcasts
[INAUDIBLE] transaction,

00:31:08.300 --> 00:31:11.680
but doesn't have the proper
signature of the oracle.

00:31:11.680 --> 00:31:12.430
TADGE DRYJA: Yeah?

00:31:12.430 --> 00:31:15.130
Do you just wait
because you know?

00:31:15.130 --> 00:31:17.940
Then Bob just waits
because Alice's money--

00:31:17.940 --> 00:31:20.580
yeah Alice, it's sending
to Alice's public key

00:31:20.580 --> 00:31:23.770
plus the oracle's
signature publicly.

00:31:23.770 --> 00:31:26.140
And Alice can't sign with that.

00:31:26.140 --> 00:31:27.670
Right, she knows
her private key,

00:31:27.670 --> 00:31:30.620
but she doesn't know the
oracle rainy private key.

00:31:30.620 --> 00:31:32.980
So she can't sign with
this to take the money.

00:31:32.980 --> 00:31:35.008
So the money's just
stuck here, but it's

00:31:35.008 --> 00:31:36.300
got that timeout period, right?

00:31:36.300 --> 00:31:36.790
It's--

00:31:36.790 --> 00:31:38.623
AUDIENCE: OK, so before,
there's no timeout?

00:31:38.623 --> 00:31:40.210
TADGE DRYJA: Yeah, so the--

00:31:40.210 --> 00:31:41.650
wait, did I have it here?

00:31:41.650 --> 00:31:43.990
Yeah, it's the
same script, right.

00:31:43.990 --> 00:31:47.440
In Lightning, it's PubR
or PubT and time, right?

00:31:47.440 --> 00:31:50.880
There's a revocable
one and a timeout one.

00:31:50.880 --> 00:31:53.740
Yeah, so in Lightning, it's
the opposite of Lightning.

00:31:53.740 --> 00:31:57.270
Right, in Lightning, correct
is to use the timeout.

00:31:57.270 --> 00:31:58.522
Right, so in Lightning-- whoa.

00:31:58.522 --> 00:31:59.446
What just happened?

00:31:59.446 --> 00:32:00.832
OK.

00:32:00.832 --> 00:32:05.080
In Lightning, I broadcast this.

00:32:05.080 --> 00:32:06.490
I have to wait, right?

00:32:06.490 --> 00:32:09.857
It's Alice's key that then takes
a day, and then I can sweep it.

00:32:09.857 --> 00:32:11.440
That's the correct
thing that happens.

00:32:11.440 --> 00:32:14.350
If I broadcast this,
Bob can immediately

00:32:14.350 --> 00:32:18.190
take it because I've already
given him the private key.

00:32:18.190 --> 00:32:21.340
It's the opposite in
Discreet Log Contracts,

00:32:21.340 --> 00:32:24.688
where if I broadcast the wrong
thing, it's just stuck forever.

00:32:24.688 --> 00:32:26.230
I'm never going to
be able to get it,

00:32:26.230 --> 00:32:29.740
and then my counterparty
can get it after a day.

00:32:29.740 --> 00:32:32.012
If I broadcast the right
thing, my counterparty

00:32:32.012 --> 00:32:33.220
can still get it after a day.

00:32:33.220 --> 00:32:33.720
Right?

00:32:33.720 --> 00:32:35.740
So if Alice
broadcasts this, Alice

00:32:35.740 --> 00:32:40.120
has to immediately spend this
because, this Alice 5 Bitcoins

00:32:40.120 --> 00:32:43.532
is also Bob's after a day.

00:32:43.532 --> 00:32:45.740
So she needs to say, OK,
I'm going to broadcast this,

00:32:45.740 --> 00:32:48.020
and then immediately
sweep the funds

00:32:48.020 --> 00:32:50.720
to my own regular address.

00:32:50.720 --> 00:32:55.721
So what's nice is that's
like a better timing model.

00:32:55.721 --> 00:32:58.670
Anyway, so in cases of
fraud, the recoverable key

00:32:58.670 --> 00:33:00.770
can be used, half
the key revealed.

00:33:00.770 --> 00:33:03.230
So that's in Lightning,
right, and Lightning

00:33:03.230 --> 00:33:04.820
broadcasts the most recent.

00:33:04.820 --> 00:33:07.250
There is no PubR, right?

00:33:07.250 --> 00:33:09.747
No one can sign this because
you haven't revealed it.

00:33:09.747 --> 00:33:11.330
And then the timing
happens and sends.

00:33:11.330 --> 00:33:13.310
So you broadcast your
most recent state.

00:33:13.310 --> 00:33:17.180
You wait a little while, and you
don't actually have any rush.

00:33:17.180 --> 00:33:21.860
You know you've never given PubR
away, so you can just leave it,

00:33:21.860 --> 00:33:23.690
and then time elapses.

00:33:23.690 --> 00:33:25.373
So maybe the timeout is one day.

00:33:25.373 --> 00:33:27.290
You don't have to spend
it after that one day.

00:33:27.290 --> 00:33:28.940
You can leave it for
a week or a month,

00:33:28.940 --> 00:33:30.860
and then later spend
it because you're

00:33:30.860 --> 00:33:32.480
really sure your
counterparty is never

00:33:32.480 --> 00:33:35.340
going to get this private key.

00:33:35.340 --> 00:33:38.300
So that's the way
Lightning works.

00:33:38.300 --> 00:33:40.460
In Discreet Log Contracts,
however, the timeout one

00:33:40.460 --> 00:33:44.200
is the incorrect one, when you
publish the wrong transaction.

00:33:44.200 --> 00:33:47.120
Right, PubR is the
oracle's signature

00:33:47.120 --> 00:33:50.970
plus your own private key.

00:33:50.970 --> 00:33:55.195
And PubT is just the other
person gets it after a while.

00:33:55.195 --> 00:33:56.570
So you should be
able-- you know,

00:33:56.570 --> 00:33:58.820
if you publish the
right transaction,

00:33:58.820 --> 00:34:00.230
you can immediately spend it.

00:34:00.230 --> 00:34:01.772
If you publish the
wrong transaction,

00:34:01.772 --> 00:34:05.000
you'll never be able to spend
it and your counterparty will,

00:34:05.000 --> 00:34:07.740
tomorrow or next week.

00:34:07.740 --> 00:34:11.300
So it's kind of a
nicer model, I think,

00:34:11.300 --> 00:34:14.499
because, in Lightning, you have
to be watching your channels.

00:34:14.499 --> 00:34:17.389
In Discreet Log
Contract, nothing bad

00:34:17.389 --> 00:34:20.219
can happen if you go offline.

00:34:20.219 --> 00:34:21.679
So that's really nice, right?

00:34:21.679 --> 00:34:24.107
In Lightning, you have
to watch for fraud.

00:34:24.107 --> 00:34:26.440
Old states could be broadcast
and you've got to grab it.

00:34:26.440 --> 00:34:30.060
In DLC, sweep it as
soon as you want.

00:34:30.060 --> 00:34:30.560
It's easier.

00:34:30.560 --> 00:34:32.090
You have the software to
do both at the same time.

00:34:32.090 --> 00:34:32.965
There's no surprises.

00:34:32.965 --> 00:34:35.663
So for example,
in Lightning, this

00:34:35.663 --> 00:34:36.830
is the current state, right?

00:34:36.830 --> 00:34:38.870
Alice has nine coins.

00:34:38.870 --> 00:34:42.650
Bob can, at any time,
broadcast this transaction,

00:34:42.650 --> 00:34:45.889
and Alice must respond and
say, nope, that's wrong,

00:34:45.889 --> 00:34:47.457
I'm taking all these nine coins.

00:34:47.457 --> 00:34:49.790
And your software does that
automatically, sure, but you

00:34:49.790 --> 00:34:54.770
have to be online and you have
to be watching the blockchain.

00:34:54.770 --> 00:34:57.020
So surprises can happen.

00:34:57.020 --> 00:34:59.120
And you know
there's software I'm

00:34:59.120 --> 00:35:02.510
working on called Watchtowers
to anonymously outsource

00:35:02.510 --> 00:35:04.910
watching this to other
people and things like that.

00:35:04.910 --> 00:35:06.680
But it's a downside, right?

00:35:06.680 --> 00:35:10.031
Fraud could occur
if you're offline.

00:35:10.031 --> 00:35:13.850
In Discreet Log Contracts,
fraud cannot occur.

00:35:13.850 --> 00:35:15.320
Eh, I don't want to say that.

00:35:15.320 --> 00:35:18.320
There's all sorts of things
the oracle can do that's bad.

00:35:18.320 --> 00:35:20.550
But the idea if I go offline--

00:35:20.550 --> 00:35:24.360
right, I'm Alice, I enter into
this contract about the weather

00:35:24.360 --> 00:35:26.510
next week, but then
I forget about it

00:35:26.510 --> 00:35:30.470
and I just don't even sign
into my computer for a month,

00:35:30.470 --> 00:35:32.900
there's no risk that the
wrong thing will happen,

00:35:32.900 --> 00:35:36.500
you know, assuming the
oracle is signing correctly.

00:35:36.500 --> 00:35:38.510
Bob can't do
anything bad, right?

00:35:38.510 --> 00:35:40.280
If this is now
endorsed by the oracle

00:35:40.280 --> 00:35:42.710
as being the
correct transaction,

00:35:42.710 --> 00:35:49.090
if Bob broadcasts this or this,
he can never take those coins.

00:35:49.090 --> 00:35:49.590
Right?

00:35:49.590 --> 00:35:52.040
It's just indefinitely
stuck here.

00:35:52.040 --> 00:35:55.340
Alice gets her coins
with no restrictions,

00:35:55.340 --> 00:35:57.630
and Bob's coins are just
stuck there forever.

00:35:57.630 --> 00:36:00.830
Right, he'll never learn this
the key to sign with this.

00:36:00.830 --> 00:36:03.800
And so Alice can come back in
a week, come back in a month,

00:36:03.800 --> 00:36:05.480
and say, oh, cool.

00:36:05.480 --> 00:36:08.420
Bob broadcast the wrong thing,
and now I can take these coins

00:36:08.420 --> 00:36:10.040
at my leisure.

00:36:10.040 --> 00:36:12.140
If Bob broadcasts
the right thing

00:36:12.140 --> 00:36:14.220
and then immediately
takes his coins,

00:36:14.220 --> 00:36:15.470
Alice's coins are still there.

00:36:15.470 --> 00:36:17.120
Everything's fine.

00:36:17.120 --> 00:36:20.380
So this is, I think,
a nicer timing model

00:36:20.380 --> 00:36:22.730
in that you don't have
to be online quickly.

00:36:22.730 --> 00:36:27.330
Also, it's nicer in
that in Lightning,

00:36:27.330 --> 00:36:30.180
if you're being honest
and you broadcast

00:36:30.180 --> 00:36:32.970
the correct transaction,
you have to wait.

00:36:32.970 --> 00:36:34.440
That's annoying, right?

00:36:34.440 --> 00:36:37.020
The timeout could be a day
or a week or something.

00:36:37.020 --> 00:36:39.360
And maybe your
counterparty-- you

00:36:39.360 --> 00:36:42.895
know, if your counterparty's
online and co-operative,

00:36:42.895 --> 00:36:44.520
you don't have to
use this transaction.

00:36:44.520 --> 00:36:46.727
You can just say, hey
look, I want to close out.

00:36:46.727 --> 00:36:47.310
I've got nine.

00:36:47.310 --> 00:36:48.150
You've got one.

00:36:48.150 --> 00:36:50.310
Let's just build a
transaction sending nine to me

00:36:50.310 --> 00:36:52.783
and one to you, with no
weird scripts or anything.

00:36:52.783 --> 00:36:54.950
And then Bob can say, OK,
sure, closing the channel.

00:36:54.950 --> 00:36:55.500
Here we go.

00:36:55.500 --> 00:36:56.640
And we just close it.

00:36:56.640 --> 00:37:00.232
But if Bob's offline, which
happens, Alice says, shoot,

00:37:00.232 --> 00:37:01.440
I have to close this channel.

00:37:01.440 --> 00:37:02.750
I want my nine coins.

00:37:02.750 --> 00:37:04.410
I broadcast this,
closing the channel,

00:37:04.410 --> 00:37:06.165
and then I have to
wait a few days.

00:37:06.165 --> 00:37:07.290
And that's annoying, right?

00:37:07.290 --> 00:37:09.420
That's not great.

00:37:09.420 --> 00:37:12.750
Whereas, in Discreet Log
Contracts, if you're doing

00:37:12.750 --> 00:37:16.600
on it, let's say, I'm Alice.

00:37:16.600 --> 00:37:17.610
Bob seems to be offline.

00:37:17.610 --> 00:37:19.380
I can't contact him.

00:37:19.380 --> 00:37:21.360
I'd say, OK, Bob,
you're not there.

00:37:21.360 --> 00:37:23.130
Fine, well, it was cloudy.

00:37:23.130 --> 00:37:24.030
I broadcast this.

00:37:24.030 --> 00:37:25.530
I immediately take
my five coins.

00:37:25.530 --> 00:37:27.405
I don't have to wait at
all, and the software

00:37:27.405 --> 00:37:28.960
does both of those
at the same time.

00:37:28.960 --> 00:37:33.160
So this is a nicer timing
model than Lighting.

00:37:33.160 --> 00:37:37.300
Yeah, no surprises
and no waiting.

00:37:37.300 --> 00:37:39.550
The only time you have to
wait is if the other party--

00:37:39.550 --> 00:37:45.830
you know, Alice would have to
wait and if Bob broadcasts--

00:37:45.830 --> 00:37:48.010
let's say, Bob broadcasts this.

00:37:48.010 --> 00:37:50.710
Alice gets one coin
immediately and nine coins

00:37:50.710 --> 00:37:51.418
after a few days.

00:37:51.418 --> 00:37:53.418
So Alice is like, well,
I have to wait a little,

00:37:53.418 --> 00:37:55.895
but, hey, I get all the
money, even though I was only

00:37:55.895 --> 00:37:56.770
supposed to get half.

00:37:56.770 --> 00:37:58.660
Great.

00:37:58.660 --> 00:38:02.380
There are some attacks
where, for example,

00:38:02.380 --> 00:38:06.270
let's say this was like
zero or like 0.001,

00:38:06.270 --> 00:38:10.060
like basically nothing,
and the actual thing that

00:38:10.060 --> 00:38:12.100
happened was it was raining.

00:38:12.100 --> 00:38:15.010
And Bob's like,
shoot, I got nothing.

00:38:15.010 --> 00:38:15.610
right?

00:38:15.610 --> 00:38:18.010
Fine, I'm just
going to sign this.

00:38:18.010 --> 00:38:18.760
You know-- sorry--

00:38:18.760 --> 00:38:20.257
I'm just going to
broadcast this,

00:38:20.257 --> 00:38:21.340
where I get all the money.

00:38:21.340 --> 00:38:22.690
I don't actually get
all the money, right?

00:38:22.690 --> 00:38:24.580
Alice is going to
take this after a day.

00:38:24.580 --> 00:38:30.610
But basically, I lost
everything anyways, so fine.

00:38:30.610 --> 00:38:32.650
Well, so that is an
attack where if there's

00:38:32.650 --> 00:38:35.920
almost no money on one side,
Bob can be a jerk and say well

00:38:35.920 --> 00:38:38.860
I'm going to broadcast the
invalid transaction just

00:38:38.860 --> 00:38:42.280
to prevent my counterparty from
getting her money immediately.

00:38:42.280 --> 00:38:44.607
She gets it all,
but maybe all is

00:38:44.607 --> 00:38:46.690
pretty close to what she
would have gotten anyway,

00:38:46.690 --> 00:38:49.810
so Bob has no real loss and
Alice has no real gain there.

00:38:49.810 --> 00:38:52.090
And then Alice has to
waste some time waiting.

00:38:52.090 --> 00:38:53.900
So that's an attack.

00:38:53.900 --> 00:38:55.690
The easiest way to
sort of mitigate

00:38:55.690 --> 00:38:58.107
that is to have this kind of
construction where it's like,

00:38:58.107 --> 00:38:59.380
well, Bob still got one.

00:38:59.380 --> 00:39:02.140
Even when Bob loses, he
still gets one coin back.

00:39:02.140 --> 00:39:05.832
Right, there's extra
collateral in the contract.

00:39:05.832 --> 00:39:08.040
And then he doesn't want to
broadcast the wrong thing

00:39:08.040 --> 00:39:08.930
to be a jerk.

00:39:08.930 --> 00:39:09.430
Yes?

00:39:09.430 --> 00:39:12.642
AUDIENCE: So if someone
broadcasts a wrong--

00:39:12.642 --> 00:39:17.432
the wrong transaction,
the correct--

00:39:17.432 --> 00:39:21.080
if he broadcasts the correct
transaction, it doesn't matter?

00:39:21.080 --> 00:39:24.170
TADGE DRYJA: If-- well, from
the network's perspective,

00:39:24.170 --> 00:39:27.050
right, so if I'm a miner
looking at the Bitcoin network,

00:39:27.050 --> 00:39:29.440
I have no idea what
these things mean.

00:39:29.440 --> 00:39:32.360
Right, it just says,
you know, key one coin.

00:39:32.360 --> 00:39:33.582
Other key, nine coins.

00:39:33.582 --> 00:39:35.540
You know, I just see two
different transactions

00:39:35.540 --> 00:39:37.040
spending the same output.

00:39:37.040 --> 00:39:43.940
So if you see Bob
broadcast this transaction,

00:39:43.940 --> 00:39:46.910
you actually do not want to
broadcast this, probably,

00:39:46.910 --> 00:39:49.580
because you'd rather have all
the money instead of half,

00:39:49.580 --> 00:39:51.080
even if it takes you some time.

00:39:51.080 --> 00:39:54.290
But if you have-- you're
saying, OK, I'm Alice.

00:39:54.290 --> 00:39:57.560
I broadcast this, and then
Bob broadcasts this right

00:39:57.560 --> 00:39:59.840
after, you're like, oh
shoot, that's a much

00:39:59.840 --> 00:40:01.280
better transaction.

00:40:01.280 --> 00:40:02.840
I would, you know,
but you don't know

00:40:02.840 --> 00:40:05.240
which is going to get in because
the miners have no idea what's

00:40:05.240 --> 00:40:05.600
going on.

00:40:05.600 --> 00:40:06.446
AUDIENCE: It means
[INAUDIBLE] going

00:40:06.446 --> 00:40:07.940
to be that you get your money?

00:40:07.940 --> 00:40:08.100
TADGE DRYJA: What, sorry?

00:40:08.100 --> 00:40:09.725
AUDIENCE: It would
be in the other case

00:40:09.725 --> 00:40:12.122
where you used the
attack you just

00:40:12.122 --> 00:40:13.955
talked about, where
people are broadcasting,

00:40:13.955 --> 00:40:14.840
you get the money from it?

00:40:14.840 --> 00:40:15.757
TADGE DRYJA: Oh, yeah.

00:40:15.757 --> 00:40:20.240
Yeah, so if you see that Bob is
being-- the actual outcome was

00:40:20.240 --> 00:40:21.950
it was rainy.

00:40:21.950 --> 00:40:24.650
Bob sees this, and has
very little money at stake,

00:40:24.650 --> 00:40:25.520
so Bob says, fine.

00:40:25.520 --> 00:40:25.820
You know what?

00:40:25.820 --> 00:40:26.320
Screw it.

00:40:26.320 --> 00:40:29.110
I'm going to broadcast
this just so Alice

00:40:29.110 --> 00:40:31.880
gets her 0.001 right
away, but has to wait

00:40:31.880 --> 00:40:34.578
a long time for the 9.99.

00:40:34.578 --> 00:40:35.870
Then Alice could say, uh uh uh.

00:40:35.870 --> 00:40:38.750
I'm broadcasting this,
and then immediately

00:40:38.750 --> 00:40:40.260
try to spend it with a high fee.

00:40:40.260 --> 00:40:41.325
You could do that.

00:40:41.325 --> 00:40:42.200
AUDIENCE: If I were--

00:40:42.200 --> 00:40:42.908
TADGE DRYJA: Yes?

00:40:42.908 --> 00:40:44.940
AUDIENCE: --to be
Alice, and it's cloudy,

00:40:44.940 --> 00:40:50.192
then I would want to just wait,
in case Bob made a mistake?

00:40:50.192 --> 00:40:51.150
TADGE DRYJA: You could.

00:40:51.150 --> 00:40:53.690
Yeah, you could
hope that you're--

00:40:53.690 --> 00:40:54.210
yeah.

00:40:54.210 --> 00:40:58.230
So there's no rush, right?

00:40:58.230 --> 00:41:00.630
The oracle signs it was cloudy.

00:41:00.630 --> 00:41:02.910
You've both got
those private keys.

00:41:02.910 --> 00:41:05.500
You can just wait.

00:41:05.500 --> 00:41:08.050
You know, there's no need
to immediately broadcast it.

00:41:08.050 --> 00:41:10.950
And once you
broadcast this, you do

00:41:10.950 --> 00:41:13.830
need to immediately
spend the part that's

00:41:13.830 --> 00:41:15.270
going to you because
that also has

00:41:15.270 --> 00:41:19.020
the clause that it can go to the
other guy in a week, or a day.

00:41:19.020 --> 00:41:21.000
So but, yeah, and you
can just leave it here.

00:41:21.000 --> 00:41:22.000
You could just leave it.

00:41:22.000 --> 00:41:23.070
Don't broadcast anything.

00:41:23.070 --> 00:41:24.840
And you're like,
well, maybe he'll

00:41:24.840 --> 00:41:26.792
screw up and broadcast
the wrong thing

00:41:26.792 --> 00:41:28.125
and then I'll get all the money.

00:41:28.125 --> 00:41:29.792
It's probably not
going to happen, but--

00:41:29.792 --> 00:41:31.890
AUDIENCE: The oracle never--

00:41:31.890 --> 00:41:33.653
so the oracle just goes quiet?

00:41:33.653 --> 00:41:34.570
TADGE DRYJA: Ah, yeah.

00:41:34.570 --> 00:41:35.520
So if the oracle--

00:41:35.520 --> 00:41:38.570
there's all sorts of things
the oracle can do that's bad.

00:41:38.570 --> 00:41:41.040
So if the oracle never
signs, none of these

00:41:41.040 --> 00:41:42.420
will ever be valid, right?

00:41:42.420 --> 00:41:44.760
So you should-- what the
contract should have is

00:41:44.760 --> 00:41:49.690
a timeout where if--

00:41:49.690 --> 00:41:51.530
you know, so if we're
betting on the price--

00:41:51.530 --> 00:41:54.570
so we're betting on
the weather tomorrow,

00:41:54.570 --> 00:41:56.580
we can say, OK, well,
by Monday, if the oracle

00:41:56.580 --> 00:41:59.280
hasn't signed anything, we've
got a time-locked transaction

00:41:59.280 --> 00:42:01.380
that just gives us
both back five coins.

00:42:01.380 --> 00:42:04.180
Or, you know, it's a wash trade.

00:42:04.180 --> 00:42:05.860
But, yeah, that can happen.

00:42:05.860 --> 00:42:07.740
AUDIENCE: Set it to
destroy the oracle.

00:42:07.740 --> 00:42:10.300
TADGE DRYJA: Yeah, so hopefully
the oracle doesn't do that.

00:42:10.300 --> 00:42:11.410
OK.

00:42:11.410 --> 00:42:13.440
But that's like, it's
not the end of the world.

00:42:13.440 --> 00:42:15.190
It's like, OK, the
oracle's not there,

00:42:15.190 --> 00:42:17.350
so we don't know how
to execute this trade--

00:42:17.350 --> 00:42:20.220
you know, this bet, so we
just get our money back.

00:42:20.220 --> 00:42:24.420
It didn't work,
and we wasted time.

00:42:24.420 --> 00:42:27.240
Oh, OK, so some
scalability fun stuff.

00:42:27.240 --> 00:42:29.820
You can do Discreet Log
Contracts within a channel.

00:42:29.820 --> 00:42:32.400
So let's say you've got
a Lightning channel,

00:42:32.400 --> 00:42:36.240
and if you want to cooperate--
if both parties cooperate,

00:42:36.240 --> 00:42:38.670
no transactions get broadcast
to the blockchain at all.

00:42:38.670 --> 00:42:40.350
This is kind of cool.

00:42:40.350 --> 00:42:42.510
OK so you've got these
nested contracts.

00:42:42.510 --> 00:42:44.880
So this is a Lightning
channel, right?

00:42:44.880 --> 00:42:49.440
And it's Alice has 10
coins, Bob has 20 coins,

00:42:49.440 --> 00:42:52.740
and they've been making lots
of different transactions.

00:42:52.740 --> 00:42:57.000
This is, let's say, the 30th,
35th state of the transaction.

00:42:57.000 --> 00:42:58.920
There's all sorts of
transactions before this.

00:42:58.920 --> 00:43:02.133
but they've all been revoked
by sharing private keys.

00:43:02.133 --> 00:43:04.800
And then you say, OK, well Alice
has 10 coins, Bob has 20 coins.

00:43:04.800 --> 00:43:07.170
Let's build a contract.

00:43:07.170 --> 00:43:11.040
So we both decrement
our balances by five,

00:43:11.040 --> 00:43:14.070
and then we create
a third output.

00:43:14.070 --> 00:43:15.180
So this is a--

00:43:15.180 --> 00:43:18.053
it's sort of like having
an HTLC where you've got--

00:43:18.053 --> 00:43:20.220
you know, as this-- sorry,
these arrows don't really

00:43:20.220 --> 00:43:21.137
line up the right way.

00:43:21.137 --> 00:43:25.513
But you've got one transaction
with three outputs.

00:43:25.513 --> 00:43:26.430
Alice gets five coins.

00:43:26.430 --> 00:43:27.930
Bob gets 15 coins.

00:43:27.930 --> 00:43:31.960
And a new two of two
multisig gets 10 coins.

00:43:31.960 --> 00:43:35.770
From that, you build
two different--

00:43:35.770 --> 00:43:37.850
I should make
colors or something.

00:43:37.850 --> 00:43:40.300
Yeah, these are two
different transactions.

00:43:40.300 --> 00:43:44.315
This is all one
transaction, sorry.

00:43:44.315 --> 00:43:45.690
So from there,
you say, OK, we're

00:43:45.690 --> 00:43:48.330
going to build a Discreet
Log Contract that's

00:43:48.330 --> 00:43:52.310
an output in the channel.

00:43:52.310 --> 00:43:55.393
And we don't-- you know, if
we want to, we can broadcast

00:43:55.393 --> 00:43:56.060
the whole thing.

00:43:56.060 --> 00:43:57.560
Any of us at any
time can say, OK,

00:43:57.560 --> 00:44:00.950
I'm broadcasting this current
state of the channel, which

00:44:00.950 --> 00:44:04.760
is Alice five, Bob
15, Alice and Bob 10.

00:44:04.760 --> 00:44:06.890
And then I have these
transactions as well,

00:44:06.890 --> 00:44:09.030
and I can broadcast
either of those.

00:44:09.030 --> 00:44:11.690
So if your counterparty
becomes unresponsive,

00:44:11.690 --> 00:44:15.320
you close the channel
and close the contract.

00:44:15.320 --> 00:44:18.080
But if the counterparty
is cooperative,

00:44:18.080 --> 00:44:20.360
then the oracle signs,
OK, it was rainy.

00:44:20.360 --> 00:44:21.860
This now becomes valid.

00:44:21.860 --> 00:44:26.330
Both parties agree, yeah,
Alice won nine coins.

00:44:26.330 --> 00:44:29.553
Bob can be a jerk and
just be unresponsive,

00:44:29.553 --> 00:44:31.220
and then Alice is
like, all right, fine.

00:44:31.220 --> 00:44:32.500
Close the channel.

00:44:32.500 --> 00:44:34.970
Spend-- you know,
broadcast this transaction,

00:44:34.970 --> 00:44:37.640
broadcast this transaction,
take the nine coins.

00:44:37.640 --> 00:44:41.120
Alice has to do three
transactions in a row

00:44:41.120 --> 00:44:42.480
to do that.

00:44:42.480 --> 00:44:45.440
But if there's nine coins, you
know, that's totally doable,

00:44:45.440 --> 00:44:46.950
right?

00:44:46.950 --> 00:44:51.500
You know, this to close, this to
finalize the contract, and then

00:44:51.500 --> 00:44:54.650
this the sweep the money
to herself before Bob

00:44:54.650 --> 00:44:57.560
tries to get it.

00:44:57.560 --> 00:44:59.070
But if Bob's
cooperative and says,

00:44:59.070 --> 00:45:00.830
OK, yeah, you won
this bet and, also, we

00:45:00.830 --> 00:45:04.640
keep doing these contracts, we
keep betting with each other,

00:45:04.640 --> 00:45:06.472
this is the only valid one.

00:45:06.472 --> 00:45:08.180
The other one I'm not
going to broadcast.

00:45:08.180 --> 00:45:09.760
I'll never get the money.

00:45:09.760 --> 00:45:11.580
And then we say,
well, Alice got nine.

00:45:11.580 --> 00:45:12.560
Alice got plus nine.

00:45:12.560 --> 00:45:13.850
Bob got plus one.

00:45:13.850 --> 00:45:17.270
We just make a new
state of the channel.

00:45:17.270 --> 00:45:21.440
Right, so this was the
old state, five, 15, 10.

00:45:21.440 --> 00:45:24.560
We went up a level, and now
the new state is Alice gets 14,

00:45:24.560 --> 00:45:27.740
Bob gets 16, and then
we revoke the old state.

00:45:27.740 --> 00:45:32.000
So the contract was built. You
know, all the different terms

00:45:32.000 --> 00:45:34.580
of the contract were
built. One of them

00:45:34.580 --> 00:45:37.100
became known to
be valid, and then

00:45:37.100 --> 00:45:39.020
they basically deleted
the whole thing

00:45:39.020 --> 00:45:40.970
and they never touched
the blockchain.

00:45:40.970 --> 00:45:44.130
Right, they saw this was
all descendent transactions

00:45:44.130 --> 00:45:46.080
within a Lightning channel.

00:45:46.080 --> 00:45:47.967
And now, we've got
our new balances.

00:45:47.967 --> 00:45:49.050
So we can keep doing this.

00:45:49.050 --> 00:45:52.680
We can have like five of
these at the same time

00:45:52.680 --> 00:45:55.920
and then keep sequentially
making all these contracts.

00:45:55.920 --> 00:45:59.270
What's nice about this is
no one ever sees anything.

00:45:59.270 --> 00:46:01.080
Right, Alice and
Bob know that they

00:46:01.080 --> 00:46:02.460
were betting on the weather.

00:46:02.460 --> 00:46:03.960
Nobody else can
see that they were

00:46:03.960 --> 00:46:05.280
making a bet at all, right?

00:46:05.280 --> 00:46:08.790
There's no transaction that
goes onto the blockchain.

00:46:08.790 --> 00:46:10.770
In the worst-case
scenario, a transaction

00:46:10.770 --> 00:46:12.180
does go onto the blockchain.

00:46:12.180 --> 00:46:16.090
And if you see
this get broadcast,

00:46:16.090 --> 00:46:20.190
the thing is, it's still not
clear that it was a contract.

00:46:20.190 --> 00:46:21.998
It could be a channel
within a channel,

00:46:21.998 --> 00:46:23.290
and there's reasons to do that.

00:46:23.290 --> 00:46:26.410
You could say, OK, this
is our cold channel

00:46:26.410 --> 00:46:28.042
that we keep all
the keys offline

00:46:28.042 --> 00:46:29.500
and this is our
hot channel that we

00:46:29.500 --> 00:46:31.330
keep transacting very quickly.

00:46:31.330 --> 00:46:32.830
And we can do some
things like that,

00:46:32.830 --> 00:46:34.848
so there's reasons to do this.

00:46:34.848 --> 00:46:37.390
But the scripts themselves, if
you broadcast the transaction,

00:46:37.390 --> 00:46:38.848
look exactly the
same as Lightning.

00:46:38.848 --> 00:46:45.770
It's just key A and time or
key B. So this is kind of cool,

00:46:45.770 --> 00:46:47.030
I think.

00:46:47.030 --> 00:46:51.670
OK, other-- oh yeah, I have
[INAUDIBLE] Other cool things

00:46:51.670 --> 00:46:57.220
you can do, you can
split the R value

00:46:57.220 --> 00:46:58.690
into an exponent and a mantissa.

00:46:58.690 --> 00:47:01.240
So it's hard to explain.

00:47:01.240 --> 00:47:04.870
OK, so let's say
I did the example

00:47:04.870 --> 00:47:07.360
with like sunny and rainy,
right, but, in practice,

00:47:07.360 --> 00:47:08.860
I think people are
going to use this

00:47:08.860 --> 00:47:12.010
for futures contracts,
where there's

00:47:12.010 --> 00:47:13.420
a bunch of different prices.

00:47:13.420 --> 00:47:17.130
So you could say,
OK, the price we'll

00:47:17.130 --> 00:47:20.370
put the price on this axis.

00:47:20.370 --> 00:47:25.830
Price is $1, $2, $3,
$4, $5, for example.

00:47:25.830 --> 00:47:28.800
And then Alice gets money here.

00:47:28.800 --> 00:47:29.950
Bob gets money here.

00:47:29.950 --> 00:47:33.840
And it can be like that,
or something where at $1

00:47:33.840 --> 00:47:37.260
Alice gets all the money; at $2,
Alice gets most of it; at $3,

00:47:37.260 --> 00:47:39.990
Bob gets most of it-- or half
and half, things like that.

00:47:42.580 --> 00:47:45.280
What might happen
is that there's

00:47:45.280 --> 00:47:50.590
like knock-in and knock-out,
where if the price is $6 or $7

00:47:50.590 --> 00:47:56.420
or something really high, well,
all the money goes to Bob.

00:47:56.420 --> 00:47:59.170
That's just how it is.

00:47:59.170 --> 00:48:01.920
And like, you're not even
sure the order of magnitude,

00:48:01.920 --> 00:48:06.920
so it might actually
go $1 and then $10.

00:48:06.920 --> 00:48:09.235
Like, there might--
how do I do this?

00:48:09.235 --> 00:48:10.860
There might be like
orders of magnitude

00:48:10.860 --> 00:48:13.320
where, OK, the current price
of something we're betting on

00:48:13.320 --> 00:48:15.550
is $20.

00:48:15.550 --> 00:48:18.600
Right, so we actually
only care about the range

00:48:18.600 --> 00:48:21.450
from $10 to $30.

00:48:21.450 --> 00:48:24.420
We only care about-- and
then, like $20, it's Alice

00:48:24.420 --> 00:48:28.210
and Bob get 50-50.

00:48:28.210 --> 00:48:32.790
We might not care about
what happens if it's $0.01

00:48:32.790 --> 00:48:37.100
or what happens if
it goes to $5,000.

00:48:37.100 --> 00:48:38.780
We'll don't care.

00:48:38.780 --> 00:48:40.960
Or we care, you know,
but the thing is

00:48:40.960 --> 00:48:44.620
if it goes to $30 or $5,000,
the same outcome happens.

00:48:44.620 --> 00:48:46.120
So what we can do
is we can say, OK,

00:48:46.120 --> 00:48:49.780
instead of just using one R
value where the oracle signs

00:48:49.780 --> 00:48:53.260
the price and we have to
compute messages for all

00:48:53.260 --> 00:48:55.900
the different prices and
compute s times G for all

00:48:55.900 --> 00:48:57.580
the different
prices, they can say,

00:48:57.580 --> 00:49:05.210
OK, well, we've got R
exponent and R mantissa.

00:49:05.210 --> 00:49:08.268
And mantissa is a weird
word for the thing that's

00:49:08.268 --> 00:49:09.310
behind the decimal point.

00:49:12.190 --> 00:49:14.070
So then I can-- so
exponent, you can

00:49:14.070 --> 00:49:17.740
you say, OK, well, it's
either 10 to the one or 10

00:49:17.740 --> 00:49:21.360
to the two or 10 to the
three or 10 to the four,

00:49:21.360 --> 00:49:23.110
and I'm going to have
an R value for that,

00:49:23.110 --> 00:49:25.210
and I'm going to produce
an s times G for that.

00:49:25.210 --> 00:49:28.135
And then the mantissa could
be like one, two, three, four,

00:49:28.135 --> 00:49:32.420
da da da to nine,
something simple like that.

00:49:32.420 --> 00:49:34.160
So in some cases--

00:49:34.160 --> 00:49:38.845
so, for example, in the
case of 10 to the two,

00:49:38.845 --> 00:49:42.340
10 to the three,
10 to the four--

00:49:42.340 --> 00:49:44.300
we don't care
about the mantissa.

00:49:44.300 --> 00:49:44.800
Right?

00:49:44.800 --> 00:49:49.030
If the exponent is 10 to
the two, three, or four,

00:49:49.030 --> 00:49:52.190
then Bob gets all the
money, right away.

00:49:52.190 --> 00:49:54.310
And if the exponent
is 10 to the zero,

00:49:54.310 --> 00:49:55.630
then Alice gets all the money.

00:49:55.630 --> 00:49:57.580
We don't have to involve
the mantissa at all.

00:49:57.580 --> 00:50:01.990
But if the exponent is 10 to
the one, then we actually care,

00:50:01.990 --> 00:50:03.490
and we can just add the point.

00:50:03.490 --> 00:50:17.240
So we say, OK, sG equals R 10 to
the one minus the hash times A.

00:50:17.240 --> 00:50:20.780
And then this is sG exponent.

00:50:20.780 --> 00:50:30.310
And then, sG mantissa is
R3 minus the hash times A.

00:50:30.310 --> 00:50:32.060
And then we can just
add these two points,

00:50:32.060 --> 00:50:36.410
so we say sG exponent
plus sG mantissa

00:50:36.410 --> 00:50:41.630
equals the contract sG
contract, and that's

00:50:41.630 --> 00:50:46.410
what we put in our
contract for the keys.

00:50:46.410 --> 00:50:50.820
That way, we need the oracle
to sign that the exponent is

00:50:50.820 --> 00:50:54.090
10 to the one, and the number,
you know, the base is three.

00:50:54.090 --> 00:50:57.130
OK, it was $30.

00:50:57.130 --> 00:51:01.000
So that way, it's a little extra
data for the oracle to sign,

00:51:01.000 --> 00:51:04.060
but pretty small, right,
an extra 32 bytes.

00:51:04.060 --> 00:51:07.600
And then we can
potentially save on a lot

00:51:07.600 --> 00:51:11.080
of these extra transactions out
in areas that all end up being

00:51:11.080 --> 00:51:13.850
the same result to us.

00:51:13.850 --> 00:51:14.900
Any questions about that?

00:51:14.900 --> 00:51:16.915
Does that sort of makes sense?

00:51:16.915 --> 00:51:17.790
It's an optimization.

00:51:17.790 --> 00:51:18.290
Right?

00:51:18.290 --> 00:51:20.940
You don't have to do it, but
it can lead to a lot less data.

00:51:20.940 --> 00:51:21.740
Yeah?

00:51:21.740 --> 00:51:24.680
AUDIENCE: So for the
mantissa, the 1, 2, 3, 4?

00:51:24.680 --> 00:51:25.430
TADGE DRYJA: Yeah?

00:51:25.430 --> 00:51:28.980
AUDIENCE: Does that come from
a specific decimal place?

00:51:28.980 --> 00:51:29.730
TADGE DRYJA: Yeah.

00:51:29.730 --> 00:51:35.310
Well, it's-- the idea is the
actual number is going to be R

00:51:35.310 --> 00:51:40.920
mantissa times Rx, you know,
or 10 to the Rx, right?

00:51:40.920 --> 00:51:43.770
So the actual-- so
if the number was 20,

00:51:43.770 --> 00:51:45.780
you say, OK, 10 to the one.

00:51:45.780 --> 00:51:47.000
R exponent's 10 to the one.

00:51:47.000 --> 00:51:48.480
R mantissa is two.

00:51:48.480 --> 00:51:54.540
If the number was 5,000, you
say, OK, 10 to the three, five.

00:51:54.540 --> 00:51:56.790
And then you just
release both of these.

00:51:56.790 --> 00:51:58.980
And they're independent,
so that the two users

00:51:58.980 --> 00:52:00.810
can use them independently.

00:52:00.810 --> 00:52:05.400
And the most likely case is we
don't care about the mantissa,

00:52:05.400 --> 00:52:07.020
we only care about the exponent.

00:52:07.020 --> 00:52:10.530
So we're only-- some of our bets
only deal with the magnitude

00:52:10.530 --> 00:52:11.880
of the price.

00:52:11.880 --> 00:52:13.857
You could also do
bets where you're only

00:52:13.857 --> 00:52:16.190
dealing with the mantissa,
but that seems kind of silly,

00:52:16.190 --> 00:52:19.770
where it's like, I don't care
if it's $2 or $20 or $200.

00:52:19.770 --> 00:52:22.730
But anyway, if the first digit
of the price starts with two,

00:52:22.730 --> 00:52:24.990
you know, is two, I win.

00:52:24.990 --> 00:52:29.990
You could do that, but
probably not as useful.

00:52:29.990 --> 00:52:33.515
But yeah, and then
in the extreme case,

00:52:33.515 --> 00:52:34.890
the extreme version
of this would

00:52:34.890 --> 00:52:38.220
be to have bind--
you know, decompose

00:52:38.220 --> 00:52:39.900
the number being
signed into binary,

00:52:39.900 --> 00:52:41.610
and then find every bit.

00:52:41.610 --> 00:52:43.110
And then there's
only two signatures

00:52:43.110 --> 00:52:46.530
possible for every
bit, and then the users

00:52:46.530 --> 00:52:49.530
can sort of combine these
things in any way they want.

00:52:49.530 --> 00:52:52.710
More signature data,
but it gives the users

00:52:52.710 --> 00:52:55.480
a lot of flexibility.

00:52:55.480 --> 00:52:57.360
OK.

00:52:57.360 --> 00:52:59.070
multi-oracle, another
thing you can do.

00:52:59.070 --> 00:53:01.740
So the problem is,
how trustworthy

00:53:01.740 --> 00:53:03.270
is this are these oracles?

00:53:03.270 --> 00:53:05.280
The oracles can cheat, right.

00:53:05.280 --> 00:53:10.920
They can just easily sign that
it's rainy when it's sunny.

00:53:10.920 --> 00:53:13.710
That's publicly knowable, and
if they have a reputation,

00:53:13.710 --> 00:53:16.590
that hopefully hurts them.

00:53:16.590 --> 00:53:20.797
But you are trusting the
oracle to sign the right thing.

00:53:20.797 --> 00:53:22.380
So maybe they want
to use two oracles.

00:53:22.380 --> 00:53:23.980
So that's totally doable.

00:53:23.980 --> 00:53:29.020
Right, you have the oracle,
the a oracle and the b oracle,

00:53:29.020 --> 00:53:31.890
and you just add the two
points that you come up with.

00:53:31.890 --> 00:53:35.487
And then when they both
release their s values,

00:53:35.487 --> 00:53:37.070
you add those two s
points, and you'll

00:53:37.070 --> 00:53:40.460
get the private
key, totally easy.

00:53:40.460 --> 00:53:42.390
For n of m, there's
no size increase.

00:53:42.390 --> 00:53:42.890
Right?

00:53:42.890 --> 00:53:45.170
You just-- you can
pick 10 oracles,

00:53:45.170 --> 00:53:46.550
add up all those things.

00:53:46.550 --> 00:53:47.910
No one can tell.

00:53:47.910 --> 00:53:50.660
And your transactions
are still really small.

00:53:50.660 --> 00:53:53.290
For n of m, it--

00:53:53.290 --> 00:53:55.020
or usually, it's
called m of n, huh?

00:53:55.020 --> 00:53:57.770
Well, anyway, there's
a size blow up

00:53:57.770 --> 00:54:00.530
because you're going to say,
OK, well, I want two of three,

00:54:00.530 --> 00:54:02.720
and I have to make new
transactions for all

00:54:02.720 --> 00:54:04.440
these different combinations.

00:54:04.440 --> 00:54:06.560
And so you end up having
a lot of transactions.

00:54:06.560 --> 00:54:09.650
For small things, like sunny
or rainy, it's totally doable.

00:54:09.650 --> 00:54:11.810
For things like where
you're already hitting up

00:54:11.810 --> 00:54:13.185
against limits
where, oh, we have

00:54:13.185 --> 00:54:15.410
to sign thousands
of transactions

00:54:15.410 --> 00:54:17.160
for all the possible
different prices,

00:54:17.160 --> 00:54:19.490
then this can get very costly.

00:54:19.490 --> 00:54:23.120
Another downside to this is if
they signed different things,

00:54:23.120 --> 00:54:24.150
you get stuck.

00:54:24.150 --> 00:54:24.650
Right?

00:54:24.650 --> 00:54:28.010
So if we say, OK, we're going
to use Thomson Reuters oracle

00:54:28.010 --> 00:54:30.100
and Bloomberg oracle
and we're going

00:54:30.100 --> 00:54:34.190
to use their price of oil,
and then one of them signs,

00:54:34.190 --> 00:54:37.420
oh, it's $50.03 and the
other signs that it's $50.

00:54:37.420 --> 00:54:39.230
05, shoot.

00:54:39.230 --> 00:54:43.490
We can't-- you know, we just
used the same value for all

00:54:43.490 --> 00:54:47.930
these sG points to build
all the combined points.

00:54:47.930 --> 00:54:51.380
Now, we don't have a match,
so we cannot build the point--

00:54:51.380 --> 00:54:53.550
the private key that
we're looking for.

00:54:53.550 --> 00:54:55.220
So this contract either reverts.

00:54:55.220 --> 00:54:56.990
So that's another
reason why you might

00:54:56.990 --> 00:54:58.757
want to decompose it this way.

00:54:58.757 --> 00:55:00.590
You could have a
construction where you say,

00:55:00.590 --> 00:55:03.110
OK, we're using Bloomberg
and Thomson Reuters,

00:55:03.110 --> 00:55:06.950
but for Thomson Reuters
we're only using the exponent

00:55:06.950 --> 00:55:09.230
and for Bloomberg
we're using both.

00:55:09.230 --> 00:55:13.130
So the idea is if there's a
case where the exponent is

00:55:13.130 --> 00:55:15.770
different between Bloomberg
and Thomson Reuters,

00:55:15.770 --> 00:55:17.840
our contract fails.

00:55:17.840 --> 00:55:20.900
But if the case is their
exponent is the same,

00:55:20.900 --> 00:55:25.490
then we just go with the actual
precise price from Bloomberg.

00:55:25.490 --> 00:55:28.670
So in case Thomson Reuters
gets hacked and they say,

00:55:28.670 --> 00:55:32.000
oh, the price of oil
is $50 million a barrel

00:55:32.000 --> 00:55:34.160
and that could cause
contracts to go the wrong way,

00:55:34.160 --> 00:55:36.990
then that's sort of a
safety catch on there.

00:55:36.990 --> 00:55:39.170
So there's all sorts of
things you can do like that.

00:55:39.170 --> 00:55:41.090
I don't know how this
will actually work out.

00:55:41.090 --> 00:55:43.340
Will there be lots
of different oracles?

00:55:43.340 --> 00:55:45.710
My guess is no.

00:55:45.710 --> 00:55:47.930
You kind of want
them to be reputable.

00:55:47.930 --> 00:55:50.750
And you can't really
make money doing it.

00:55:50.750 --> 00:55:54.020
And it's really scalable and
cheap to be an oracle because,

00:55:54.020 --> 00:55:55.873
like, all you're doing
is signing things.

00:55:55.873 --> 00:55:57.290
So it feels like
the kind of thing

00:55:57.290 --> 00:56:00.278
that once you have a-- you know,
once you get some momentum,

00:56:00.278 --> 00:56:01.820
you're just going
to be this monopoly

00:56:01.820 --> 00:56:04.490
and everyone's going
to use the same oracle.

00:56:04.490 --> 00:56:05.580
But who knows?

00:56:08.120 --> 00:56:13.300
Yeah, oracle problems,
so yeah, oracles can lie.

00:56:13.300 --> 00:56:15.990
They can also-- they
can they can equivocate.

00:56:15.990 --> 00:56:17.740
Right, they can sign
two different things,

00:56:17.740 --> 00:56:19.460
but then they reveal
their private key.

00:56:19.460 --> 00:56:23.920
So you might want
them to post coins

00:56:23.920 --> 00:56:26.650
on the blockchain with
their A, you know,

00:56:26.650 --> 00:56:31.390
that's got their regular public
key A, so that if they ever

00:56:31.390 --> 00:56:34.117
do sign two of the same message,
then they lose their money

00:56:34.117 --> 00:56:35.450
and everyone can try to grab it.

00:56:38.890 --> 00:56:40.540
Yeah, what are the other things?

00:56:40.540 --> 00:56:43.220
Oh, I was going to
talk about novation.

00:56:43.220 --> 00:56:44.050
We have time.

00:56:44.050 --> 00:56:46.540
Yeah, so another
thing that people

00:56:46.540 --> 00:56:48.460
like to do with these
types of contracts

00:56:48.460 --> 00:56:54.070
is enter into contracts and
then sort of sell their position

00:56:54.070 --> 00:56:54.760
in the contract.

00:56:54.760 --> 00:56:59.770
So for example, if we were in
a contract about the weather,

00:56:59.770 --> 00:57:01.840
and I look outside,
I'm like, oh, it's

00:57:01.840 --> 00:57:04.970
definitely going to be
rainy, so the oracle

00:57:04.970 --> 00:57:08.220
is going to sign about
the weather as of noon.

00:57:08.220 --> 00:57:09.700
I'm like, it's 11 o'clock.

00:57:09.700 --> 00:57:10.810
It's going to be rainy.

00:57:10.810 --> 00:57:13.480
I want to sort of
lock in my profit.

00:57:13.480 --> 00:57:15.940
And it's not exactly sure
yet, so there may still

00:57:15.940 --> 00:57:18.220
be some value to
the sunny position,

00:57:18.220 --> 00:57:21.990
but it's looking pretty
grim for the sunny position.

00:57:21.990 --> 00:57:24.420
I might just contact
my counterparty

00:57:24.420 --> 00:57:26.630
and say, hey, let's close early.

00:57:26.630 --> 00:57:27.240
Right?

00:57:27.240 --> 00:57:30.180
I don't need the entire
profit, but give me

00:57:30.180 --> 00:57:33.060
90% of it because it's,
you know, pretty rainy.

00:57:33.060 --> 00:57:35.910
And they might agree to do
that, but a better way to do it

00:57:35.910 --> 00:57:37.320
would be to say,
I'm going to let

00:57:37.320 --> 00:57:40.260
someone else take my position.

00:57:40.260 --> 00:57:41.640
So for example, if you have--

00:57:44.680 --> 00:57:51.600
so if you've got like Alice
and Bob are in a contract.

00:57:51.600 --> 00:57:57.180
And then there's like Alice
gets nine, Bob gets one for sun.

00:57:57.180 --> 00:58:03.240
And then Alice gets one,
Bob gets nine for rain.

00:58:03.240 --> 00:58:05.160
And then they say, OK,
let's just do it early.

00:58:05.160 --> 00:58:09.330
Bob might not be cooperative.

00:58:09.330 --> 00:58:12.150
Alice wants to say, let's
just get out of it right now,

00:58:12.150 --> 00:58:13.950
at some, at one of--

00:58:13.950 --> 00:58:15.570
you know, a little
bit less than this.

00:58:15.570 --> 00:58:18.240
Bob says, no, I want to
keep holding it through.

00:58:18.240 --> 00:58:19.750
What Alice wants
to do is say, look,

00:58:19.750 --> 00:58:22.200
I'm going to replace
myself with Carol.

00:58:22.200 --> 00:58:25.470
Alice finds some other
person, Carol, to now

00:58:25.470 --> 00:58:29.160
have a Carol-Bob
transaction where

00:58:29.160 --> 00:58:33.050
it's the same exact contract.

00:58:33.050 --> 00:58:38.130
So it'd be Carol nine,
Bob one and Carol one,

00:58:38.130 --> 00:58:41.400
Bob nine for sun and rain.

00:58:43.920 --> 00:58:47.170
So what's nice about this
is, from Bob's perspective,

00:58:47.170 --> 00:58:51.322
nothing changes except the
counterparty's public key,

00:58:51.322 --> 00:58:52.530
which Bob doesn't care about.

00:58:52.530 --> 00:58:54.150
Right?

00:58:54.150 --> 00:58:58.440
So Alice can say, hey, Bob
let's switch this transaction.

00:58:58.440 --> 00:59:00.210
You have the same
exact payout based

00:59:00.210 --> 00:59:02.670
on the same exact
signatures from the oracle,

00:59:02.670 --> 00:59:04.458
so it's no change to you.

00:59:04.458 --> 00:59:06.000
It's just that my
public key is going

00:59:06.000 --> 00:59:08.480
to change because it's actually
going to be someone else.

00:59:08.480 --> 00:59:10.110
And then Bob-- that
way, Bob's software

00:59:10.110 --> 00:59:12.000
can automatically do it.

00:59:12.000 --> 00:59:15.720
This is still interactive in
that Bob's keys have to sign.

00:59:15.720 --> 00:59:20.550
Right, Bob needs to make a new
signature spending from here

00:59:20.550 --> 00:59:24.312
to go into this new two of
two output, so that's new.

00:59:24.312 --> 00:59:26.520
So their computer has to be
on and they have to sign,

00:59:26.520 --> 00:59:29.070
but you can make the computer
software do it automatically

00:59:29.070 --> 00:59:31.200
because there's no
user interaction needed

00:59:31.200 --> 00:59:34.733
in that it's like, hey,
your position didn't change.

00:59:34.733 --> 00:59:36.150
And then probably
put in something

00:59:36.150 --> 00:59:41.790
where Alice pays Bob
a little extra, right.

00:59:41.790 --> 00:59:45.030
Alice gives Bob a dollar or
two to incentivize him to leave

00:59:45.030 --> 00:59:47.285
his computer on to collect fee.

00:59:47.285 --> 00:59:48.660
You know, essentially,
it's like,

00:59:48.660 --> 00:59:50.952
oh, if I leave my computer
on and my counterparty wants

00:59:50.952 --> 00:59:53.300
to novate and switch
with someone else,

00:59:53.300 --> 00:59:54.270
I might make a buck.

00:59:54.270 --> 00:59:57.120
And my position doesn't
change, so cool.

00:59:57.120 --> 00:59:59.055
So that is doable.

01:00:02.040 --> 01:00:03.710
I do not look forward
to programming

01:00:03.710 --> 01:00:07.543
that because that now has three
different computers talking

01:00:07.543 --> 01:00:09.460
to each other and they
all have to do messages

01:00:09.460 --> 01:00:12.387
in the right sequence and stuff,
and that's not the most fun

01:00:12.387 --> 01:00:13.220
part of programming.

01:00:13.220 --> 01:00:19.340
But yeah, so anyway, so
that's the idea of this.

01:00:19.340 --> 01:00:21.140
What are some use cases?

01:00:21.140 --> 01:00:24.890
I can think of some, but there's
all sorts of other ideas.

01:00:24.890 --> 01:00:26.720
I think it can be pretty useful.

01:00:26.720 --> 01:00:28.170
You could do currency futures.

01:00:28.170 --> 01:00:30.420
So I think one of the biggest
would be dollar futures.

01:00:30.420 --> 01:00:34.670
So right now, in CME,
I think, or CBOT or one

01:00:34.670 --> 01:00:38.630
of those Chicago kind of
places, or both of them,

01:00:38.630 --> 01:00:41.060
you can do Bitcoin
futures which are

01:00:41.060 --> 01:00:42.920
dollar-settled Bitcoin futures.

01:00:42.920 --> 01:00:44.420
Right, so you get
a bunch of dollars

01:00:44.420 --> 01:00:46.070
based on the price of Bitcoin.

01:00:48.920 --> 01:00:51.920
Yeah, so you can say,
I want 10 Bitcoins

01:00:51.920 --> 01:00:53.955
for delivery on next week.

01:00:53.955 --> 01:00:55.580
And then you don't
get the 10 Bitcoins,

01:00:55.580 --> 01:00:57.890
but you get however
many dollars those 10

01:00:57.890 --> 01:01:01.550
Bitcoins are worth based
on some exchange price

01:01:01.550 --> 01:01:02.490
that they agree on.

01:01:02.490 --> 01:01:04.157
You know, we're going
to use the average

01:01:04.157 --> 01:01:06.320
of these different
exchanges and stuff.

01:01:06.320 --> 01:01:09.260
With DLC, you could do sort
of the inverse of that, where

01:01:09.260 --> 01:01:11.630
I have Bitcoins I
entered into a contract

01:01:11.630 --> 01:01:14.613
where I have dollars
being delivered--

01:01:14.613 --> 01:01:16.460
or, sorry, I have
Bitcoins, you know,

01:01:16.460 --> 01:01:18.330
the dollar value
being delivered.

01:01:18.330 --> 01:01:21.860
So the idea is I have $10,000
worth of Bitcoin being

01:01:21.860 --> 01:01:25.640
delivered to me on Friday, so
if the price of Bitcoin goes up,

01:01:25.640 --> 01:01:26.492
I get fewer of them.

01:01:26.492 --> 01:01:28.700
If the price of Bitcoins
goes down I get more of them

01:01:28.700 --> 01:01:32.060
such that the amount of
Bitcoin I receive on Friday

01:01:32.060 --> 01:01:35.570
has a value of $10,000.

01:01:35.570 --> 01:01:38.500
And that's a pretty
straightforward Discreet Log

01:01:38.500 --> 01:01:39.500
Contract ability, right?

01:01:39.500 --> 01:01:42.747
You just need to
know the price of a--

01:01:42.747 --> 01:01:44.330
it actually ends up
being a lot easier

01:01:44.330 --> 01:01:46.310
to think of Bitcoin
as the main currency

01:01:46.310 --> 01:01:49.760
and then dollars as
the asset being traded.

01:01:49.760 --> 01:01:52.820
So you sort of want to know the
price of a dollar in Bitcoins,

01:01:52.820 --> 01:01:55.130
or how many Satoshi
is a dollar's worth,

01:01:55.130 --> 01:01:57.320
and then you build your
contract from there.

01:01:57.320 --> 01:01:59.760
And so if the price
of a dollar goes up,

01:01:59.760 --> 01:02:01.860
you get more of these things.

01:02:01.860 --> 01:02:05.120
So one side will say, OK, I've
got $10,000 worth of Bitcoin

01:02:05.120 --> 01:02:06.120
coming on Friday.

01:02:06.120 --> 01:02:08.450
The other side basically
says, I get whatever's

01:02:08.450 --> 01:02:11.660
left in this contract.

01:02:11.660 --> 01:02:13.670
And that other
side is essentially

01:02:13.670 --> 01:02:15.740
like a more volatile Bitcoin.

01:02:15.740 --> 01:02:17.810
So if the price of
bitcoin goes up, great.

01:02:17.810 --> 01:02:19.137
Also, you get more of them.

01:02:19.137 --> 01:02:20.720
And if the price of
Bitcoin goes down,

01:02:20.720 --> 01:02:23.600
you're really screwed because
your Bitcoin's worth less

01:02:23.600 --> 01:02:26.390
and you lose most of them.

01:02:26.390 --> 01:02:28.525
But I feel like people
will want to do that.

01:02:28.525 --> 01:02:29.900
Like there will
be people who are

01:02:29.900 --> 01:02:31.950
like, cool,
double-volatile Bitcoin.

01:02:31.950 --> 01:02:33.542
You know, where do I sign up?

01:02:33.542 --> 01:02:35.000
And there's also
going to be people

01:02:35.000 --> 01:02:37.820
who are like, I think
Bitcoin is cool,

01:02:37.820 --> 01:02:41.660
but I want to anonymously
and trustless--

01:02:41.660 --> 01:02:44.360
trustless, except
for the oracle--

01:02:44.360 --> 01:02:48.670
you know, not so
trustfully short it.

01:02:48.670 --> 01:02:50.270
Right, I want to
say, OK, I'm not--

01:02:50.270 --> 01:02:54.490
I sort of don't have a
Bitcoin position anymore.

01:02:54.490 --> 01:02:59.460
However, it's not the
same in that you don't

01:02:59.460 --> 01:03:01.080
know who your counterparty is.

01:03:01.080 --> 01:03:03.000
It's fully collateralized
at the outset,

01:03:03.000 --> 01:03:05.920
so if the price of-- you know,
if both parties put in 10-- you

01:03:05.920 --> 01:03:08.430
know, both parties
put in 10 coins,

01:03:08.430 --> 01:03:11.020
20 Bitcoins is all that's ever
coming out of this contract.

01:03:11.020 --> 01:03:11.520
Right?

01:03:11.520 --> 01:03:13.740
You can't say, hey, I want
to do like a margin call.

01:03:13.740 --> 01:03:16.290
You need to put like 40
more coins in this contract

01:03:16.290 --> 01:03:18.120
because the price went down.

01:03:18.120 --> 01:03:21.600
Your counterparty just
will say, no, I'm not.

01:03:21.600 --> 01:03:23.910
So there's sort of
bounded loss and gain

01:03:23.910 --> 01:03:26.407
for both parties at the outset.

01:03:26.407 --> 01:03:28.740
Also, because you have no
idea who your counterparty is,

01:03:28.740 --> 01:03:31.370
right, you can do this
totally anonymously.

01:03:31.370 --> 01:03:33.120
It's-- I don't want
to say it's trustless,

01:03:33.120 --> 01:03:35.495
because you are trusting the
oracle to report the correct

01:03:35.495 --> 01:03:39.100
price, but your counterparty,
you don't trust at all.

01:03:39.100 --> 01:03:39.600
Right?

01:03:39.600 --> 01:03:41.040
You have no idea who they are.

01:03:41.040 --> 01:03:43.270
You assume everything
they're telling you is a lie,

01:03:43.270 --> 01:03:46.940
you know, like they're trying
to hack you, stuff like that.

01:03:46.940 --> 01:03:49.440
So I think currency futures
would be a big one, where

01:03:49.440 --> 01:03:51.390
people can then buy and sell.

01:03:51.390 --> 01:03:53.177
Stocks might be a big one.

01:03:53.177 --> 01:03:55.260
There's a lot of issues
there with insider trading

01:03:55.260 --> 01:03:57.360
because if you can,
now, anonymously

01:03:57.360 --> 01:04:01.350
trade stock futures,
I don't know,

01:04:01.350 --> 01:04:03.300
that's probably
something people might

01:04:03.300 --> 01:04:06.690
want to do who
shouldn't be doing it.

01:04:06.690 --> 01:04:10.260
But it's hard to enforce
because these oracles have

01:04:10.260 --> 01:04:12.453
no idea that anyone is
actually making contracts.

01:04:12.453 --> 01:04:13.870
And if you look
on the blockchain,

01:04:13.870 --> 01:04:15.450
you never see the contracts.

01:04:15.450 --> 01:04:17.353
Or you might sort
of be like, well,

01:04:17.353 --> 01:04:19.770
is this a Lightning Network
channel that closed or is this

01:04:19.770 --> 01:04:22.380
a Discreet Log Contract
that just executed?

01:04:22.380 --> 01:04:24.630
It just looks like keys.

01:04:24.630 --> 01:04:26.760
You can't-- oh, that's
an important part.

01:04:26.760 --> 01:04:30.120
Given, even if you're the oracle
and you know what you signed,

01:04:30.120 --> 01:04:33.510
the fact that you're
adding these two points

01:04:33.510 --> 01:04:39.005
means that unless you knew
the original Alice key,

01:04:39.005 --> 01:04:40.380
you wouldn't be
able to tell, oh,

01:04:40.380 --> 01:04:42.185
that's Alice's key plus my key.

01:04:42.185 --> 01:04:44.310
Right, because you don't
know what Alice's key was.

01:04:44.310 --> 01:04:47.240
It never existed independently.

01:04:47.240 --> 01:04:49.740
Or, oh, Alice and Bob knew it,
but you didn't as the oracle.

01:04:49.740 --> 01:04:51.330
And so no one will--
the oracles won't

01:04:51.330 --> 01:04:56.970
know what contracts are being
executed, even after the fact.

01:04:56.970 --> 01:04:59.588
You can, however,
prove that you used--

01:04:59.588 --> 01:05:00.630
you know, if you want to.

01:05:00.630 --> 01:05:03.000
If you're Alice, you can say,
hey, this was my contract.

01:05:03.000 --> 01:05:04.208
I can show you all the terms.

01:05:04.208 --> 01:05:08.040
And you can prove it by signing
a message with the Alice

01:05:08.040 --> 01:05:10.830
private key and then also
showing that it's, you know,

01:05:10.830 --> 01:05:14.305
this is my public key and I
added it to the oracle's thing.

01:05:14.305 --> 01:05:16.680
Yeah commodities, sports,
there's all sorts of fun things

01:05:16.680 --> 01:05:17.490
you can do with it.

01:05:17.490 --> 01:05:19.290
It's pretty general,
conditional payments

01:05:19.290 --> 01:05:23.580
based on any number or element
from a predetermined set.

01:05:23.580 --> 01:05:25.800
Cool, so any
questions about this?

01:05:25.800 --> 01:05:26.970
Yes?

01:05:26.970 --> 01:05:29.530
AUDIENCE: So, if the public
policymakers wanted to see

01:05:29.530 --> 01:05:31.305
this, they absolutely couldn't?

01:05:34.224 --> 01:05:36.750
It is [INAUDIBLE] encrypted?

01:05:36.750 --> 01:05:39.240
TADGE DRYJA: You could
talk to the oracles

01:05:39.240 --> 01:05:41.700
because they'll probably
be publicly-known entities.

01:05:41.700 --> 01:05:45.810
And so you could say,
hey, oracles, don't sign--

01:05:45.810 --> 01:05:46.740
don't sign messages.

01:05:46.740 --> 01:05:53.300
I mean, yeah, but the actual
counterparties A and B,

01:05:53.300 --> 01:05:55.247
if it's like OTC, if
it's just Alice and Bob

01:05:55.247 --> 01:05:57.830
sort of talking to each other,
hey, let's build this contract.

01:05:57.830 --> 01:05:59.030
We both trust Bloomberg.

01:05:59.030 --> 01:06:00.880
Their prices are correct.

01:06:00.880 --> 01:06:03.052
It's-- you can't see that
this happened at all.

01:06:03.052 --> 01:06:05.510
AUDIENCE: Does Bloomberg have
to be complicit [INAUDIBLE]??

01:06:05.510 --> 01:06:06.802
TADGE DRYJA: Bloomberg has to--

01:06:06.802 --> 01:06:08.390
so some oracle,
someone, somewhere,

01:06:08.390 --> 01:06:13.304
has to be saying, look, I'm
going to sign the price of oil.

01:06:13.304 --> 01:06:14.280
That's it.

01:06:14.280 --> 01:06:17.103
AUDIENCE: Even if they
disagree to, right?

01:06:17.103 --> 01:06:18.020
TADGE DRYJA: Oh, yeah.

01:06:18.020 --> 01:06:18.140
Yeah.

01:06:18.140 --> 01:06:20.557
So well, so yeah, most of these
transactions never happen.

01:06:20.557 --> 01:06:22.490
If Alice and Bob see
that the oracle signed,

01:06:22.490 --> 01:06:24.198
they don't have to
actually broadcast it.

01:06:24.198 --> 01:06:28.820
But they do need the
oracle's public key, first,

01:06:28.820 --> 01:06:31.070
to build the contract.

01:06:31.070 --> 01:06:35.090
So as you could try to
regulate public oracles,

01:06:35.090 --> 01:06:37.240
but that seems like--

01:06:37.240 --> 01:06:39.970
AUDIENCE: Assume Bloomberg's
bringing in, assume that--

01:06:39.970 --> 01:06:40.530
TADGE DRYJA: Yeah, yeah.

01:06:40.530 --> 01:06:41.330
But, so the question is--

01:06:41.330 --> 01:06:42.075
AUDIENCE: --they
have somebody sitting

01:06:42.075 --> 01:06:45.000
in the Cayman Islands who's
got a software program that

01:06:45.000 --> 01:06:46.640
grabs the Bloomberg fee?

01:06:46.640 --> 01:06:47.610
TADGE DRYJA: Yeah.

01:06:47.610 --> 01:06:50.420
The issue there
is the signatures

01:06:50.420 --> 01:06:52.100
are sort of usable by anyone.

01:06:52.100 --> 01:06:54.230
You could say, OK, well,
Bloomberg charges money

01:06:54.230 --> 01:06:56.790
to provide these signatures
and these public keys.

01:06:56.790 --> 01:07:00.140
But if those get out,
everyone knows, oh, these

01:07:00.140 --> 01:07:01.245
are Bloomberg signatures.

01:07:01.245 --> 01:07:02.120
You know, these are--

01:07:02.120 --> 01:07:04.460
this is the Bloomberg data.

01:07:04.460 --> 01:07:07.730
We can now execute
trades using this data.

01:07:07.730 --> 01:07:10.670
And we do have--
so this eliminates

01:07:10.670 --> 01:07:12.170
the trust between
counterparties,

01:07:12.170 --> 01:07:14.733
but doesn't eliminate
the oracle trust.

01:07:14.733 --> 01:07:16.150
But the thing is,
the oracle trust

01:07:16.150 --> 01:07:17.340
is sort of the easy problem.

01:07:17.340 --> 01:07:17.840
Right?

01:07:17.840 --> 01:07:20.900
There's not too many cases of--

01:07:20.900 --> 01:07:23.470
you know, if you have some
OTC contracts and you say,

01:07:23.470 --> 01:07:25.470
oh, we're using the price
according to Bloomberg

01:07:25.470 --> 01:07:27.512
or the price according to
the Wall Street Journal

01:07:27.512 --> 01:07:30.660
or whatever,
generally that works.

01:07:30.660 --> 01:07:32.850
So yeah, so what you can
do is, I think the place

01:07:32.850 --> 01:07:37.110
that people will try to regulate
is the matchmaking area where,

01:07:37.110 --> 01:07:38.940
if it's OTC, and
Alice just calls up

01:07:38.940 --> 01:07:41.070
Bob and Alice is in
the Cayman Islands

01:07:41.070 --> 01:07:42.655
and Bob is in British
Virgin Islands,

01:07:42.655 --> 01:07:44.280
or whatever-- are
those the same thing?

01:07:44.280 --> 01:07:45.930
I don't know.

01:07:45.930 --> 01:07:48.275
They say, hey, I
want to short oil.

01:07:48.275 --> 01:07:49.500
Oh, I want to go long oil.

01:07:49.500 --> 01:07:52.140
OK, and we just build our
contract between our two

01:07:52.140 --> 01:07:54.790
computers, and Bloomberg has
no idea we're doing this.

01:07:54.790 --> 01:07:57.180
No one else in the world has
any idea we're doing this,

01:07:57.180 --> 01:08:00.180
and we have this smart contract.

01:08:00.180 --> 01:08:02.190
But in most cases,
people will not

01:08:02.190 --> 01:08:04.110
know who they're wanting
to trade with, right?

01:08:04.110 --> 01:08:07.150
They want some kind of exchange
where we can meet and say, hey,

01:08:07.150 --> 01:08:08.870
I want to short Bitcoin.

01:08:08.870 --> 01:08:09.973
You know, I want dollars.

01:08:09.973 --> 01:08:12.390
And someone says, oh, cool I
want double-volatile Bitcoin.

01:08:12.390 --> 01:08:15.870
Let's meet, and let's
make this a contract.

01:08:15.870 --> 01:08:19.452
Those exchanges will probably
be more regulated, I guess.

01:08:19.452 --> 01:08:20.910
You could sort of
say, hey, we need

01:08:20.910 --> 01:08:24.210
you to KYC all your
exchange participants.

01:08:24.210 --> 01:08:26.319
But even then,
like if you wanted,

01:08:26.319 --> 01:08:29.130
so similar to Altcoin's
stuff now, you could say,

01:08:29.130 --> 01:08:32.790
I'm operating an
exchange out of wherever.

01:08:32.790 --> 01:08:36.540
And you can't operate an
oracle out of wherever, really,

01:08:36.540 --> 01:08:38.380
because people won't trust it.

01:08:38.380 --> 01:08:41.550
But you could say, I'm operating
an exchange out of Hong Kong.

01:08:41.550 --> 01:08:43.510
We don't KYC anyone.

01:08:43.510 --> 01:08:45.010
Maybe we'll get
shut down in a year.

01:08:45.010 --> 01:08:48.870
But anyway, you can use
the Bloomberg data feed

01:08:48.870 --> 01:08:52.290
and enter into these contracts.

01:08:52.290 --> 01:08:55.520
So yeah, it makes
enforcement hard.

01:08:55.520 --> 01:08:56.109
Yes?

01:08:56.109 --> 01:08:57.651
AUDIENCE: It strikes
me that the hole

01:08:57.651 --> 01:09:00.700
here, from the
public policy side,

01:09:00.700 --> 01:09:06.569
is that even oracles
are semi-regulated,

01:09:06.569 --> 01:09:09.240
and there's been tons
of fraud in oracles

01:09:09.240 --> 01:09:10.247
for hundreds of years.

01:09:10.247 --> 01:09:11.080
TADGE DRYJA: Really?

01:09:11.080 --> 01:09:12.163
AUDIENCE: Oh, and massive.

01:09:12.163 --> 01:09:14.060
TADGE DRYJA: But
they seem so useful.

01:09:14.060 --> 01:09:16.010
AUDIENCE: You trust too much.

01:09:16.010 --> 01:09:17.010
TADGE DRYJA: So people--

01:09:17.010 --> 01:09:18.990
AUDIENCE: And you're a
Bitcoin Core developer.

01:09:18.990 --> 01:09:19.710
TADGE DRYJA: Yeah,
I just figured

01:09:19.710 --> 01:09:21.502
that the financial
system figured that out,

01:09:21.502 --> 01:09:22.450
so it's whatever.

01:09:22.450 --> 01:09:22.950
No.

01:09:22.950 --> 01:09:23.825
AUDIENCE: Yeah, sure.

01:09:23.825 --> 01:09:27.210
Wicked loads of
fraud lots of years.

01:09:27.210 --> 01:09:29.600
I used to run the Commodity
Futures Trading Commission,

01:09:29.600 --> 01:09:34.907
so we did gold,
currency, interest rates.

01:09:34.907 --> 01:09:36.990
TADGE DRYJA: So there, was
it that the spot market

01:09:36.990 --> 01:09:38.580
itself was being manipulated?

01:09:38.580 --> 01:09:40.823
Or the spot market says
the price price is $50,

01:09:40.823 --> 01:09:41.865
the oracle says it's $80?

01:09:41.865 --> 01:09:43.657
AUDIENCE: we would take
what the oracle was

01:09:43.657 --> 01:09:47.145
publishing only because you're
long or short a position.

01:09:47.145 --> 01:09:49.020
TADGE DRYJA: But then,
wouldn't you just sort

01:09:49.020 --> 01:09:51.540
of sue people and say, hey,
look this oracle was wrong,

01:09:51.540 --> 01:09:53.550
like obviously the
spot price was this?

01:09:53.550 --> 01:09:54.628
It's not as--

01:09:54.628 --> 01:09:55.920
AUDIENCE: We could [INAUDIBLE].

01:09:55.920 --> 01:09:58.038
It's often hard to say
what is this spot price.

01:09:58.038 --> 01:09:58.830
TADGE DRYJA: Right.

01:09:58.830 --> 01:10:01.205
AUDIENCE: And sometimes, you
come in at different places.

01:10:01.205 --> 01:10:02.670
Besides, it seems
like the holes,

01:10:02.670 --> 01:10:06.340
the holes here, is not so much
around the oracles, which there

01:10:06.340 --> 01:10:09.270
could be big holes like,
somebody could just

01:10:09.270 --> 01:10:11.460
become an aggregator
of the oracles

01:10:11.460 --> 01:10:13.490
because the CMA
takes four prices,

01:10:13.490 --> 01:10:15.240
but somebody sitting
in the Cayman Islands

01:10:15.240 --> 01:10:18.100
could say we're going to just
take the same four prices right

01:10:18.100 --> 01:10:20.720
[INAUDIBLE].

01:10:20.720 --> 01:10:23.490
And being crypto, settle.

01:10:23.490 --> 01:10:25.260
If it's fiat, settle.

01:10:25.260 --> 01:10:28.580
Just travel more ways to get
into the on-ramps and off-ramps

01:10:28.580 --> 01:10:30.874
to the banking system.

01:10:30.874 --> 01:10:33.660
But and that's why you're
seeing a lot of exchanges having

01:10:33.660 --> 01:10:39.570
a hard time getting, basically,
deposit accounts in banks

01:10:39.570 --> 01:10:42.150
because the banking
regulators around the globe

01:10:42.150 --> 01:10:44.570
are trying to regulate
on-ramps and off-ramps,

01:10:44.570 --> 01:10:47.160
but it's harder for crypto
and crypto exchange.

01:10:47.160 --> 01:10:49.530
TADGE DRYJA: Yeah, crypto
crypto, start a computer.

01:10:49.530 --> 01:10:50.430
Yeah, you've got it.

01:10:50.430 --> 01:10:51.140
You don't have to ask.

01:10:51.140 --> 01:10:51.640
Yeah.

01:10:51.640 --> 01:10:53.700
AUDIENCE: And you could
have it, and you know,

01:10:53.700 --> 01:10:57.980
so over-the-counter Cayman
Islands aggregator oracles,

01:10:57.980 --> 01:11:01.310
and somebody could do
single-stock futures that are

01:11:01.310 --> 01:11:02.817
banned in this country, so--

01:11:02.817 --> 01:11:03.650
TADGE DRYJA: Really?

01:11:03.650 --> 01:11:05.422
AUDIENCE: Single-stock futures.

01:11:05.422 --> 01:11:07.130
TADGE DRYJA: Well,
options aren't, right?

01:11:07.130 --> 01:11:08.172
AUDIENCE: Options aren't.

01:11:08.172 --> 01:11:10.760
TADGE DRYJA: So,
oh, I didn't say,

01:11:10.760 --> 01:11:14.150
you want to make options
contracts with this,

01:11:14.150 --> 01:11:16.423
you just don't give
the data to one side.

01:11:16.423 --> 01:11:18.590
It's basically the same
construction, but like, now,

01:11:18.590 --> 01:11:20.780
Alice has the option to
broadcast the transaction

01:11:20.780 --> 01:11:23.060
and Bob doesn't.

01:11:23.060 --> 01:11:25.010
But so you can make
options with this--

01:11:25.010 --> 01:11:26.452
or futures, I mean.

01:11:26.452 --> 01:11:31.790
AUDIENCE: But you're not trying
to subvert public policy norms.

01:11:31.790 --> 01:11:33.575
This could be a gray
technology, or do you

01:11:33.575 --> 01:11:37.050
think that is useful for
subverting public policy norms?

01:11:37.050 --> 01:11:40.080
[LAUGHTER]

01:11:40.080 --> 01:11:42.410
TADGE DRYJA: I think
it has both use cases.

01:11:42.410 --> 01:11:46.640
One of the big ones will be sort
of similar to Bitcoin, where

01:11:46.640 --> 01:11:49.428
it's like, hey, I can do these
things that maybe I'm not--

01:11:49.428 --> 01:11:50.970
you know, people
don't want me to do.

01:11:50.970 --> 01:11:52.460
And in some cases,
the don't want

01:11:52.460 --> 01:11:56.210
me to do is just like
scale in terms of like,

01:11:56.210 --> 01:12:02.180
OK, I'm some guy in Thailand,
and I want to go long Apple.

01:12:02.180 --> 01:12:04.670
And probably, you
can legally do that.

01:12:04.670 --> 01:12:06.715
But if you've got like
a couple hundred bucks

01:12:06.715 --> 01:12:08.090
and you're in some
random country

01:12:08.090 --> 01:12:13.250
and you want to go
long, some US equity,

01:12:13.250 --> 01:12:14.400
that's not really feasible.

01:12:14.400 --> 01:12:14.900
Right?

01:12:14.900 --> 01:12:16.050
Maybe you can open accounts.

01:12:16.050 --> 01:12:17.220
Maybe you can try to
open a foreign account.

01:12:17.220 --> 01:12:18.840
Like it's-- there's
a lot of friction.

01:12:18.840 --> 01:12:20.340
And so with this
kind of thing, it's

01:12:20.340 --> 01:12:21.770
like, hey, we've got a Bitcoin.

01:12:21.770 --> 01:12:23.810
I trust this price oracle.

01:12:23.810 --> 01:12:25.890
OK, I'll do it with
like a couple hundred

01:12:25.890 --> 01:12:28.980
bucks worth of bitcoin.

01:12:28.980 --> 01:12:31.870
That said, there's also
cases where it's like, OK,

01:12:31.870 --> 01:12:34.740
I work at Foxconn
in Shenzhen and I

01:12:34.740 --> 01:12:36.550
think the Apple
iPhone 11 is not going

01:12:36.550 --> 01:12:39.210
be any good, so I'm
going to short Apple

01:12:39.210 --> 01:12:41.290
using this kind of technology.

01:12:41.290 --> 01:12:43.920
So there will be
good and bad things.

01:12:43.920 --> 01:12:48.150
You could also-- it could also
be useful in cases between

01:12:48.150 --> 01:12:52.140
actual regular legal
Wall-Streety kind of people,

01:12:52.140 --> 01:12:54.174
maybe not-- where--

01:12:54.174 --> 01:12:55.787
then again, it's
good where you've

01:12:55.787 --> 01:12:58.120
got like not a lot of trust
between your counterparties,

01:12:58.120 --> 01:13:01.660
but you do trust some
kind of oracle feed.

01:13:01.660 --> 01:13:03.493
And the other thing
is-- like, I have talked

01:13:03.493 --> 01:13:04.993
to this sort of
Wall-Streety people,

01:13:04.993 --> 01:13:07.450
and they don't really like it
because they're like, wait,

01:13:07.450 --> 01:13:08.140
there's no leverage.

01:13:08.140 --> 01:13:08.320
Right?

01:13:08.320 --> 01:13:10.070
You have to put all
the money you're going

01:13:10.070 --> 01:13:12.280
to get in at the beginning.

01:13:12.280 --> 01:13:14.530
And they always want to have
it like super-leveraged.

01:13:14.530 --> 01:13:18.020
You can crank up the slope.

01:13:18.020 --> 01:13:20.680
So you can say, OK, we
both put 10 Bitcoins in,

01:13:20.680 --> 01:13:24.130
but a small difference
in price, right,

01:13:24.130 --> 01:13:26.110
so like a 5% movement
in a price will

01:13:26.110 --> 01:13:28.820
like make all the money go
to one side or the other,

01:13:28.820 --> 01:13:31.080
so we hit the knock-in
and knock-out really soon.

01:13:31.080 --> 01:13:33.340
So you can do that, which
is kind of like leverage.

01:13:33.340 --> 01:13:36.640
But fundamentally, it's
only the Bitcoins that

01:13:36.640 --> 01:13:39.880
go into the contract come out.

01:13:39.880 --> 01:13:42.130
So yeah, I don't know how
this will be regulated.

01:13:42.130 --> 01:13:46.690
I'm working-- there's a
company in Japan who's

01:13:46.690 --> 01:13:49.740
interested in building
this technology.

01:13:49.740 --> 01:13:54.010
There's like-- it's a brokerage
that's making this stuff.

01:13:54.010 --> 01:13:57.610
I'm working on it with
some other people.

01:13:57.610 --> 01:13:59.050
We'll see.

01:13:59.050 --> 01:14:00.940
I don't know how it will be.

01:14:00.940 --> 01:14:03.400
Maybe people won't like it.

01:14:03.400 --> 01:14:05.320
It's-- yeah.

01:14:05.320 --> 01:14:07.780
AUDIENCE: I mean, it
seems to me like that's

01:14:07.780 --> 01:14:09.670
one of the big things
that Bitcoin's missing.

01:14:09.670 --> 01:14:12.900
So if the financial
system is for distributing

01:14:12.900 --> 01:14:16.520
risk and [INAUDIBLE]
the risk, right now,

01:14:16.520 --> 01:14:18.765
I don't really do
that with Bitcoin.

01:14:18.765 --> 01:14:20.500
It's kind of just a
transactions channel.

01:14:20.500 --> 01:14:21.250
TADGE DRYJA: Yeah.

01:14:21.250 --> 01:14:22.632
AUDIENCE: So this--

01:14:22.632 --> 01:14:24.090
TADGE DRYJA: I
think it'll be cool.

01:14:24.090 --> 01:14:25.660
AUDIENCE: --be logically,
kind of the next step.

01:14:25.660 --> 01:14:27.577
TADGE DRYJA: Yeah, oh I
think this'll be cool.

01:14:27.577 --> 01:14:28.890
I think people would use it.

01:14:28.890 --> 01:14:31.230
I just, you know, it's
a lot of work to program

01:14:31.230 --> 01:14:32.950
and I don't, yeah,
have enough time.

01:14:32.950 --> 01:14:37.138
But there's other
people starting to get--

01:14:37.138 --> 01:14:38.180
I don't know, it's weird.

01:14:38.180 --> 01:14:40.400
It's sort of like Lightning
was like three years ago,

01:14:40.400 --> 01:14:41.900
and some people
were like, oh, cool.

01:14:41.900 --> 01:14:44.090
And then eventually,
people were like,

01:14:44.090 --> 01:14:46.460
oh, this is a really big deal,
and let's all work on it.

01:14:46.460 --> 01:14:48.170
And it might be
the same with this,

01:14:48.170 --> 01:14:51.830
where like no one really cares
and then, eventually, people

01:14:51.830 --> 01:14:55.490
will be like, oh, hey we should
build this and use it and start

01:14:55.490 --> 01:14:58.110
companies and things like that.

01:14:58.110 --> 01:14:59.790
So hopefully, people
will get into it.

01:14:59.790 --> 01:15:02.120
I think it's a pretty
nice construction

01:15:02.120 --> 01:15:04.130
for these kinds of things.

01:15:04.130 --> 01:15:07.970
It competes-- there's things
like Augur, which is--

01:15:07.970 --> 01:15:11.130
I don't think is the best idea.

01:15:11.130 --> 01:15:14.670
It, like the Augur, the idea is
the oracle is sort of everyone,

01:15:14.670 --> 01:15:17.130
and like everyone votes
on what these outcomes

01:15:17.130 --> 01:15:19.710
for different things were.

01:15:19.710 --> 01:15:21.645
But yeah, I don't know.

01:15:21.645 --> 01:15:24.270
I don't know how far along they
are in terms of their software.

01:15:24.270 --> 01:15:27.880
But that was also like
two or three years ago.

01:15:27.880 --> 01:15:29.880
And this could be
applied more broadly,

01:15:29.880 --> 01:15:33.210
like where anytime you have
Ethereum-type smart contracts

01:15:33.210 --> 01:15:36.000
or something where you want
some external oracle who

01:15:36.000 --> 01:15:38.550
then can sign things.

01:15:38.550 --> 01:15:41.580
And then you can use it in a
way where the oracle's signature

01:15:41.580 --> 01:15:43.960
doesn't show up after the fact.

01:15:43.960 --> 01:15:46.990
So anyway, any questions?

01:15:46.990 --> 01:15:48.381
Sounds good?