6 ms·

Ethereum Ceremony – Add your randomness to prepare the way for EIP-4844

82 points by kristianpaul 3y ago

quickthrower2 3y ago
Kind of sounds like a frat hazing ritual but for some unimaginably complex cryptograhpic scheme. Nothing will go wrong though of course!
- mptest 3y ago
  I haven't kept up with the space in some time but if this is what I'm remembering, all that's needed is one participant in the ceremony to keep their secret forever/"lose" it for the security to be guaranteed. That's why as many participants as possible is a good thing. all that said I'm a student/layman and not an expert in anything
  - quickthrower2 3y ago
    What makes me think it is complicated is that a hash to all zeros would do this sort of a job, as no one could reverse this and find a key that would map to it. So whatever they are doing doesn’t have a natural “nothing up my sleeve” number and needs a social construct like this.
    - mptest 3y ago
      If I'm understanding you correctly, you're saying they don't need the social ceremony where everyone adds obfuscation, because there is some simple way for one user to derive the same security? Does that not rely on us all trusting that initial user who "hashes to all zeroes" to maintain the secret? The goal here is not only to establish security but security anyone can participate in to add security, such that everyone trusts it, because anyone could have participated. Even if that's more complicated, it's more trustworthy. Again though, I am not an expert in anything, I'm a student of computer science. I may be completely misunderstanding you and if I am, I apologize. It could be said though the social construct/contract is kind of the whole point of the decentralized protocols
      - quickthrower2 3y ago
        Like you I am no expert. What I mean is you can construct a challenge that is provably very hard, such as a hash input that produces zeros (translates to near infinite compute power in terms of mining, or some mathematical or quantum computing breakthrough that renders modern cryptography useless then this Ethereum thing is the least of your worries).
        deleted 3y ago
        [deleted]
        rrobukef 3y ago
        They don't need one number, they need two (or more) that are related in such a way they have cryptographic properties. And the math says to derive them from a seed. However the seed must be secret because it's a back-door. Luckily everybody can generate their own seed and their contributions can be combined without knowing the seeds. All zeros won't work because they don't have the properties.
  - robocat 3y ago
    From FAQ further down the page: What needs to go wrong for the safety of the Ceremony to break? The ceremony has a "1-of-N" trust assumption, which means that only a single participant in the entire ceremony needs to destroy or otherwise forget their secret input for everything to be secure. To break the Ceremony output, every participant would have to strip apart the software that they are using to contribute, get that software to give them the secret, and then collude with every single other participant to reconstruct the final secret. A more realistic failure mode is a common bug which leaks the randomness. To combat this, this site has been audited and there are alternative implementations of the contribution software built on entirely different software stacks. This is why there will be thousands of participants using different pieces of software on different operating systems to help prevent single points of failure both in the people and hardware/software.
- latchkey 3y ago
  > Nothing will go wrong though of course! At this point, I'm willing to give the Ethereum developers the benefit of the doubt. They've really knocked some major features out of the park over the last few years. Namely, they switched the entire consensus model out, while the plane was flying full of people and that went off pretty much without a hitch. Don't forget that this also had the side effect of significantly cutting power usage not only for ETH, but also for every single other GPU mined PoW chain out there. So yea... they made something creative out of the process of the next round of improvements, and invited you to join. Seems cool to me.
  - littlestymaar 3y ago
    > At this point, I'm willing to give the Ethereum developers the benefit of the doubt. Accidental* crypto developer here. The most consistent behavior from Ethereum developers is designing “clever home-brewed mechanisms” because they are ”very smart”, and then it turns out this is yet another dirty hack that'll need more dirty hacks in the future to circumvent all its flaws. It's 2023, stop giving the benefit of the doubt to arrogant cranks that have consistently proven over almost a decade that they really are arrogant cranks. [*]gotta pay the bills…
    - pa7x1 3y ago
      Could you provide examples of previously deployed dirty hacks that need more dirty hacks to circumvent the flaws?
      - littlestymaar 3y ago
        Well, the entirety of the “Web3” API is a pile of hacks, but my “favorite” is probably eip-1559 (and not for the “political” reasons, like “make eth deflationary”, it's just very annoying to work with).
        pa7x1 3y ago
        This is like complaining about the HTTP protocol because you don't like the requests Python library. There is no "Web3" API as part of the Ethereum protocol. "Web3" APIs (in plural because there are multiple ones, in different programming languages) are externally built libraries that expose in an API details about the Ethereum blockchain (blocks, transactions, gas consumed in a block, base fee, etc...). If you don't like a particular library, you can use a different one, or build your own. EIP-1559 has never been patched. It's still functioning as it was conceived. A minor clarification is that it was not introduced to make ETH deflationary, and in fact, it doesn't guarantee in any way that it will be deflationary. It's a side effect of demand for settling on Ethereum exceeding the current issuance of ETH. In much the same way the supply of oil may go down if demand for it is greater than its production. In what ways is it annoying to work with EIP-1559? It's, I would argue, much simpler than it was in the past, as you now have a pre-defined base fee to pay to be included in a block. But perhaps you have something else in mind.
joosters 3y ago
How can they claim 'it is secure as long as one person forgets their secret' and 'we need to protect against sybil attacks (so sign in with your github account)' ? If the first claim was true, why should they care if the same person takes part multiple times. More doublespeak from crypto fetishists.
- charcircuit 3y ago
  There is an upperbound to the amount of contributions due to how slow adding one is because of the computation needed. The goal of the ceremony is to have as many different people contribute as possible. Without protecting against Sybil attacks an attacker can reduce the number of contributors by hogging the limited number of contribution slots that are available during the ceremony. You can imagine an extreme case of a ceremony only allowing for 5 contributions. Wouldn't you want to have some sort of protection against all 5 of those contributions being from the same person?
- pa7x1 3y ago
  The reason to provide some sibyl protection/spam protection mechanism is so that every one that wants to contribute can do so. The ceremony is secure if there is 1 out of N that correctly destroyed its secret. You individually, may not trust any one else, but then you should be allowed to contribute a secret and delete it, in order for you to trust the ceremony output. If you are prevented from contributing because there are bots filling up the queue then you won't be able to trust the ceremony. I think it's a sensible constraint from the crypto fetishists.
- x-complexity 3y ago
  > How can they claim 'it is secure as long as one person forgets their secret' and 'we need to protect against sybil attacks (so sign in with your github account)' ? If the first claim was true, why should they care if the same person takes part multiple times. > 'it is secure as long as one person forgets their secret' This is from the 1-of-N security assumption of the cryptographic procedure, wherein at least 1 person is actually honest and destroys their own secret to ensure its security. With a large enough N, this security assumption is made guaranteed due to the non-zero probability of human nature for deviant behavior from the rest of the group, wherein at least 1 person will be honest and perform as specified. > 'we need to protect against sybil attacks (so sign in with your github account)' ...this claim ignores the large visible button right above the 'or unlock with Github' link, that prompts the user to sign in with their Ethereum address. https://imgur.com/a/FkjcEQN https://imgur.com/a/FkjcEQN Aside from this, this is meant as one of the 2 methods of preventing bot spam, the other one being the sign in using an Ethereum address. > More doublespeak from crypto fetishists. Doublespeak is not present, joosters, as the two claims address different issues (1-of-N security of the KZG ceremony & bot spam).
toastal 3y ago
> You need to enable JavaScript to run this app. What app? Why don’t folks do the bare minimum in their <noscript> elements to actually describe what it is that I’m missing out on.
- RockRobotRock 3y ago
  "Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting."
  - toastal 3y ago
    So we just sweep basic accessibility and best practices under the rug because it’s common to screw it up? A little public shame should inspire the webmaster and comment readers to double-check their websites.
- eimrine 3y ago
  I ran the app and I see some countdown timer with 51 hours left which proposes me to do something I am struggling to understand. Also it has some plain-text faq but you know, nobody is storing just a plain text and it was made in such a way that every point is spoilered. There is indeed no reason to disallow seeing the faq for no-javascript users. upd: I have discovered a link to off-the-app documentation: https://github.com/ethereum/kzg-ceremony https://github.com/ethereum/kzg-ceremony
  - toastal 3y ago
    Well, the purpose of this site is to provide information and it’s not a web app. The goal of such site should be to make that info as accessible as possible with no reason to involve anything more complicated than absolutely necessary--not just towards users but also bots/scrapers for SEO. That generic <noscript> text is commonly from create-react-app or its ilk which should be reserved as technology for web apps. This is yet another example of a landing page that could+should be static pages with minimal JavaScript for progressive enhancement.
- 3y ago
faffffaf 3y ago
[flagged]
- jl2718 3y ago
  “Danksharding” is named for a person, “Dankrad”, who has been their expert and champion of elliptic pairing-based cryptographic mechanisms.
  - faffffaf 3y ago
    The name is the least of my problems (although I have always wondered where it came from). The whole thing reads like a D&D script.
    - laratied 3y ago
      It is unbelievable. Just when I thought I couldn't hate crypto and the crypto community more I read this.
kapsteur 3y ago
Why I can't sign up my submission with Metamask !!
jtode 3y ago
Christian Ceremony - Add your prayer to prepare the way for Jesus
southernplaces7 3y ago
As usual, the crypto hate is strong to the point of going full-bore irrational from all the enlightened souls on this site, despite this ethereum event being far from a typical crypto bro crank job and instead being a sincere effort to improve the quality of something with plausible usability, that these people have invested lots of time in working on. This makes it different from so many other complex if imperfect programming projects how? Or perhaps now that Ether has shifted from the so lovingly hated PoW mechanism to PoS, some other thing has to be scorned, rational analysis be damned? Might add that much of the crypto hate on HN comes from the same circle of people who more recently swallow nearly anything AI-related with absurdly wide eyed applause. People who actually insinuate that LLM systems are some genuine new form of intelligence, despite absolutely no factual signs of that and plenty of reasons for worry about perfectly human use-case dangers, which make the worst of crypto seem minor in comparison.

82 points by kristianpaul 3y ago

Kind of sounds like a frat hazing ritual but for some unimaginably complex cryptograhpic scheme. Nothing will go wrong though of course!

mptest 3y ago
I haven't kept up with the space in some time but if this is what I'm remembering, all that's needed is one participant in the ceremony to keep their secret forever/"lose" it for the security to be guaranteed. That's why as many participants as possible is a good thing. all that said I'm a student/layman and not an expert in anything
- quickthrower2 3y ago
  What makes me think it is complicated is that a hash to all zeros would do this sort of a job, as no one could reverse this and find a key that would map to it. So whatever they are doing doesn’t have a natural “nothing up my sleeve” number and needs a social construct like this.
  - mptest 3y ago
    If I'm understanding you correctly, you're saying they don't need the social ceremony where everyone adds obfuscation, because there is some simple way for one user to derive the same security? Does that not rely on us all trusting that initial user who "hashes to all zeroes" to maintain the secret? The goal here is not only to establish security but security anyone can participate in to add security, such that everyone trusts it, because anyone could have participated. Even if that's more complicated, it's more trustworthy. Again though, I am not an expert in anything, I'm a student of computer science. I may be completely misunderstanding you and if I am, I apologize. It could be said though the social construct/contract is kind of the whole point of the decentralized protocols
    - quickthrower2 3y ago
      Like you I am no expert. What I mean is you can construct a challenge that is provably very hard, such as a hash input that produces zeros (translates to near infinite compute power in terms of mining, or some mathematical or quantum computing breakthrough that renders modern cryptography useless then this Ethereum thing is the least of your worries).
      - deleted 3y ago
        [deleted]
      - rrobukef 3y ago
        They don't need one number, they need two (or more) that are related in such a way they have cryptographic properties. And the math says to derive them from a seed. However the seed must be secret because it's a back-door. Luckily everybody can generate their own seed and their contributions can be combined without knowing the seeds. All zeros won't work because they don't have the properties.
- robocat 3y ago
  From FAQ further down the page: What needs to go wrong for the safety of the Ceremony to break? The ceremony has a "1-of-N" trust assumption, which means that only a single participant in the entire ceremony needs to destroy or otherwise forget their secret input for everything to be secure. To break the Ceremony output, every participant would have to strip apart the software that they are using to contribute, get that software to give them the secret, and then collude with every single other participant to reconstruct the final secret. A more realistic failure mode is a common bug which leaks the randomness. To combat this, this site has been audited and there are alternative implementations of the contribution software built on entirely different software stacks. This is why there will be thousands of participants using different pieces of software on different operating systems to help prevent single points of failure both in the people and hardware/software.
latchkey 3y ago
> Nothing will go wrong though of course! At this point, I'm willing to give the Ethereum developers the benefit of the doubt. They've really knocked some major features out of the park over the last few years. Namely, they switched the entire consensus model out, while the plane was flying full of people and that went off pretty much without a hitch. Don't forget that this also had the side effect of significantly cutting power usage not only for ETH, but also for every single other GPU mined PoW chain out there. So yea... they made something creative out of the process of the next round of improvements, and invited you to join. Seems cool to me.
- littlestymaar 3y ago
  > At this point, I'm willing to give the Ethereum developers the benefit of the doubt. Accidental* crypto developer here. The most consistent behavior from Ethereum developers is designing “clever home-brewed mechanisms” because they are ”very smart”, and then it turns out this is yet another dirty hack that'll need more dirty hacks in the future to circumvent all its flaws. It's 2023, stop giving the benefit of the doubt to arrogant cranks that have consistently proven over almost a decade that they really are arrogant cranks. [*]gotta pay the bills…
  - pa7x1 3y ago
    Could you provide examples of previously deployed dirty hacks that need more dirty hacks to circumvent the flaws?
    - littlestymaar 3y ago
      Well, the entirety of the “Web3” API is a pile of hacks, but my “favorite” is probably eip-1559 (and not for the “political” reasons, like “make eth deflationary”, it's just very annoying to work with).
      - pa7x1 3y ago
        This is like complaining about the HTTP protocol because you don't like the requests Python library. There is no "Web3" API as part of the Ethereum protocol. "Web3" APIs (in plural because there are multiple ones, in different programming languages) are externally built libraries that expose in an API details about the Ethereum blockchain (blocks, transactions, gas consumed in a block, base fee, etc...). If you don't like a particular library, you can use a different one, or build your own. EIP-1559 has never been patched. It's still functioning as it was conceived. A minor clarification is that it was not introduced to make ETH deflationary, and in fact, it doesn't guarantee in any way that it will be deflationary. It's a side effect of demand for settling on Ethereum exceeding the current issuance of ETH. In much the same way the supply of oil may go down if demand for it is greater than its production. In what ways is it annoying to work with EIP-1559? It's, I would argue, much simpler than it was in the past, as you now have a pre-defined base fee to pay to be included in a block. But perhaps you have something else in mind.

joosters 3y ago

How can they claim 'it is secure as long as one person forgets their secret' and 'we need to protect against sybil attacks (so sign in with your github account)' ? If the first claim was true, why should they care if the same person takes part multiple times. More doublespeak from crypto fetishists.

charcircuit 3y ago
There is an upperbound to the amount of contributions due to how slow adding one is because of the computation needed. The goal of the ceremony is to have as many different people contribute as possible. Without protecting against Sybil attacks an attacker can reduce the number of contributors by hogging the limited number of contribution slots that are available during the ceremony. You can imagine an extreme case of a ceremony only allowing for 5 contributions. Wouldn't you want to have some sort of protection against all 5 of those contributions being from the same person?
pa7x1 3y ago
The reason to provide some sibyl protection/spam protection mechanism is so that every one that wants to contribute can do so. The ceremony is secure if there is 1 out of N that correctly destroyed its secret. You individually, may not trust any one else, but then you should be allowed to contribute a secret and delete it, in order for you to trust the ceremony output. If you are prevented from contributing because there are bots filling up the queue then you won't be able to trust the ceremony. I think it's a sensible constraint from the crypto fetishists.
x-complexity 3y ago
> How can they claim 'it is secure as long as one person forgets their secret' and 'we need to protect against sybil attacks (so sign in with your github account)' ? If the first claim was true, why should they care if the same person takes part multiple times. > 'it is secure as long as one person forgets their secret' This is from the 1-of-N security assumption of the cryptographic procedure, wherein at least 1 person is actually honest and destroys their own secret to ensure its security. With a large enough N, this security assumption is made guaranteed due to the non-zero probability of human nature for deviant behavior from the rest of the group, wherein at least 1 person will be honest and perform as specified. > 'we need to protect against sybil attacks (so sign in with your github account)' ...this claim ignores the large visible button right above the 'or unlock with Github' link, that prompts the user to sign in with their Ethereum address. https://imgur.com/a/FkjcEQN https://imgur.com/a/FkjcEQN Aside from this, this is meant as one of the 2 methods of preventing bot spam, the other one being the sign in using an Ethereum address. > More doublespeak from crypto fetishists. Doublespeak is not present, joosters, as the two claims address different issues (1-of-N security of the KZG ceremony & bot spam).

toastal 3y ago

> You need to enable JavaScript to run this app. What app? Why don’t folks do the bare minimum in their <noscript> elements to actually describe what it is that I’m missing out on.

RockRobotRock 3y ago
"Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting."
- toastal 3y ago
  So we just sweep basic accessibility and best practices under the rug because it’s common to screw it up? A little public shame should inspire the webmaster and comment readers to double-check their websites.
eimrine 3y ago
I ran the app and I see some countdown timer with 51 hours left which proposes me to do something I am struggling to understand. Also it has some plain-text faq but you know, nobody is storing just a plain text and it was made in such a way that every point is spoilered. There is indeed no reason to disallow seeing the faq for no-javascript users. upd: I have discovered a link to off-the-app documentation: https://github.com/ethereum/kzg-ceremony https://github.com/ethereum/kzg-ceremony
- toastal 3y ago
  Well, the purpose of this site is to provide information and it’s not a web app. The goal of such site should be to make that info as accessible as possible with no reason to involve anything more complicated than absolutely necessary--not just towards users but also bots/scrapers for SEO. That generic <noscript> text is commonly from create-react-app or its ilk which should be reserved as technology for web apps. This is yet another example of a landing page that could+should be static pages with minimal JavaScript for progressive enhancement.
3y ago

faffffaf 3y ago

[flagged]

jl2718 3y ago
“Danksharding” is named for a person, “Dankrad”, who has been their expert and champion of elliptic pairing-based cryptographic mechanisms.
- faffffaf 3y ago
  The name is the least of my problems (although I have always wondered where it came from). The whole thing reads like a D&D script.
  - laratied 3y ago
    It is unbelievable. Just when I thought I couldn't hate crypto and the crypto community more I read this.

kapsteur 3y ago

Why I can't sign up my submission with Metamask !!

jtode 3y ago

Christian Ceremony - Add your prayer to prepare the way for Jesus

southernplaces7 3y ago

As usual, the crypto hate is strong to the point of going full-bore irrational from all the enlightened souls on this site, despite this ethereum event being far from a typical crypto bro crank job and instead being a sincere effort to improve the quality of something with plausible usability, that these people have invested lots of time in working on. This makes it different from so many other complex if imperfect programming projects how? Or perhaps now that Ether has shifted from the so lovingly hated PoW mechanism to PoS, some other thing has to be scorned, rational analysis be damned? Might add that much of the crypto hate on HN comes from the same circle of people who more recently swallow nearly anything AI-related with absurdly wide eyed applause. People who actually insinuate that LLM systems are some genuine new form of intelligence, despite absolutely no factual signs of that and plenty of reasons for worry about perfectly human use-case dangers, which make the worst of crypto seem minor in comparison.