Substrate, with Tendermint, has a known block producer schedule, enabling DoSs

[kayabaNerve]

We did not go with BABE + GRANDPA, where BABE has a primary candidate and multiple secondary, and GRANDPA eventually finalizes on a chain, because we wanted per-block finality. With this decision, we lost BABE's fallback block production, as multiple proposers are incompatible with Tendermint.

Since Tendermint only has a single, known proposer, it's vulnerable to DDoS attacks. Cosmos solves this via proxies, which is a practical solution.

The W3F also has research into a new block production protocol which has is private regarding order, yet with only producer, SASSAFRAS. It, or a similar design, should be usable here.

We either have to handle this from a ops point of view or from a consensus point of view to ensure security however.

Related to #47.

[kayabaNerve]

Consensus protocols which flicker between candidates for eventual resolution on one, such as Avalanche (not an endorsement, just an acknowledgement) would also be another option. Considering SASSAFRAS is premised on ZK-proofs, the overhead of the rounds of Avalanche may be more performant in practice (though I believe moving consensus yet again isn't a feasible discussion).

[kayabaNerve]

Based on W3F's work on SASSAFRAS, yet here firmly described without a reliance on ZK-SNARKS:

Assuming the proof needs to:

1. Establish you're a validator with some ticket
2. Select a definitive proxy
3. Be unlinkable with regards to the original validator to both the network and the proxy

Define basepoints:
G - G
B - hash_to_point("SASSAFRAS blinding")

Commit(value, blinding): (value * G) + (blinding * B)

For each slot a validator should have, they sample t and b. They then publish Commit(t, b).

Once the commit phase is over, validators perform membership proofs over B for their commitment. By applying an offset of -b, tG is left standing.

A Schnorr PoK for t over G establishes this is actually was the value committed to by a ring member.

The proxy is H(tG, block hash) % validators.len().

The proxy publishes the membership proof and tG.

The block proposal is signed with tG to authenticate it as the legitimate proposal for that slot.

In summary:

• Validators publish a Pedersen Commitment of Commit(ticket, blinding).
• Proxies publish the ticket (ticket * G).
• Block producers publish proposals with a signature by ticket.

If Bootle proofs are used for membership, with 512 members:

• 1.3kb proofs
• 4692 group exps to prove.
• 512 + 69p group exps to verify, where p is per-proof, as this is batchable. That means the entire multiexp would have 35840 statements for all 512 proofs.

Compared to Groth16, the only benefit appears to be with proving time. I believe the merkle tree used (presumably Poseidon) would take twice as long to prove, even with no other operations. I am unsure how complex the full SASSAFRAS circuit is.

Instead of having n slots per validator with n keys, a single unlinked ticket key can be used if the actual validator never signs the block, thereby linking them. This may require Dandelion++ to ensure the node actually responsible is not discovered via network analysis, or simply sufficiently frequent key changes. This greatly increases the efficiency of the protocol.

[kayabaNerve]

SASSAFRAS doesn't allow slashing on failure to propose. It'd need to be extended with a MPC (where the group can decrypt a ticket on failure) system for that. While that doesn't feel necessary, it's a decent note.

[kayabaNerve]

We now use BABE which has secondaries to protect against DoSs.

[kayabaNerve]

#159 was about Tendermint having a bad block producer algorithm. This was more about Substrate.

[kayabaNerve]

https://eprint.iacr.org/2020/025.pdf, to throw in a link relevant, even though this issue is closed.