VITARIT: Paying for Threshold Services on Bitcoin and Friends

VITARIT: Paying for Threshold Services on Bitcoin and Friends

Speakers: Easwar Vivek Mangipudi; Sri AravindaKrishnan Thyagarajan; Pratyay Mukherjee; Lucjan Hanzlik; Aniket Kate

Conference: IEEE S&P

YouTube: https://www.youtube.com/watch?v=nojFy5AlVYY

Overview

In the rapidly evolving landscape of Web3, the demand for decentralized services, such as verifiable random functions (VRFs) and oracles, has surged. These services are critical for maintaining the integrity and autonomy of blockchain applications, often relying on a collective of independent entities to provide robust and censorship-resistant functionality. However, the existing paradigms for integrating these services, particularly through smart contracts, face significant limitations, including privacy concerns due to exposed data, computational inefficiencies from on-chain verification, and a fundamental incompatibility with non-Turing complete blockchains like Bitcoin. This talk introduces VITARIT, a novel protocol designed to overcome these challenges by enabling atomic, privacy-preserving, and Bitcoin-compatible payments for distributed verifiable threshold services.

Presented by Easwar Vivek Mangipudi and co-authored with Sri AravindaKrishnan Thyagarajan, Pratyay Mukherjee, Lucjan Hanzlik, and Aniket Kate, VITARIT represents a significant step forward in extending the utility of threshold services to a broader range of blockchain ecosystems. The protocol's core innovation lies in its ability to facilitate secure payments only upon guaranteed service delivery, addressing the "free-riding" problem inherent in many distributed systems. By moving complex computations off-chain and leveraging advanced cryptographic primitives, VITARIT not only enhances efficiency and privacy but also opens up new possibilities for decentralized applications on platforms previously considered unsuitable for such integrations.

The importance of VITARIT cannot be overstated. As the Web3 ecosystem matures, the need for robust, scalable, and versatile infrastructure becomes paramount. VITARIT directly tackles critical pain points in service provisioning, offering a blueprint for more efficient and secure interactions between clients and decentralized service providers. Its compatibility with Bitcoin, a blockchain renowned for its security and decentralization but limited in smart contract capabilities, is particularly noteworthy, promising to unlock new use cases and economic models within the largest cryptocurrency ecosystem.

Background

▶ Watch: Introduction to VITARIT and problem with existing solutions (0:00)

The evolution of decentralized applications has highlighted a persistent tension between the need for complex, off-chain computations and the desire for trust-minimized, on-chain verification. Services like Verifiable Random Functions (VRFs), which provide unpredictable and publicly verifiable random outputs, are essential for applications requiring fairness, such as lotteries, gaming, and validator selection in proof-of-stake systems. Similarly, oracles are crucial for bringing real-world data onto blockchains, enabling smart contracts to react to external events.

Traditionally, these services are implemented using smart contracts on platforms like Ethereum. While smart contracts offer a flexible environment for defining complex logic, they come with inherent drawbacks. Firstly, the transparency of public blockchains means that inputs and outputs to smart contracts are typically exposed, leading to significant privacy losses for users. For instance, if a user's bet in a decentralized game is visible before a VRF output is revealed, it could be exploited. Secondly, performing computationally intensive tasks, such as verifying cryptographic proofs, directly on-chain within a smart contract is inefficient and expensive, leading to high gas costs and network congestion. Each operation incurs a fee, making complex computations economically unfeasible for many applications.

A more fundamental limitation is the incompatibility of smart contracts with all blockchain systems. Bitcoin, for example, utilizes a Unspent Transaction Output (UTXO) model and a scripting language that is intentionally limited to prevent arbitrary computation, prioritizing security and simplicity over Turing-completeness. This design choice means that directly porting complex smart contract logic for threshold services to Bitcoin is not feasible.

Prior attempts to address these challenges have faced their own set of problems:

• Paying all servers at once: In a threshold service where n servers contribute to a computation and t+1 are needed for a valid output, simply paying all n servers upfront can lead to the "free-riding server problem." Malicious or lazy servers might receive payment without contributing their share of the computation, diminishing the integrity and efficiency of the service.
• Using a trusted combiner: Introducing a central entity (a "combiner") to select and pay servers mitigates free-riding but reintroduces a single point of failure and trust. A malicious combiner could bias server selection, censor participants, or unfairly distribute payments. This undermines the very decentralization ethos of Web3.
• Atomic swaps with individual servers: While atomic swaps can facilitate trustless exchange between two parties, applying this directly to a threshold service in a UTXO model like Bitcoin presents complexities. A server might need to publish multiple transactions prematurely, potentially allowing it to withdraw more than one payment for a single partial computation, leading to economic exploits. The challenge is ensuring that a server is paid at most once for its contribution, even when interacting with multiple clients or across multiple payment channels.

VITARIT emerges as a solution designed to overcome these limitations. It aims to provide a protocol for any distributed verifiable threshold service that is Bitcoin-compatible, ensures atomic payments (meaning either the service is delivered and paid for, or neither happens), preserves privacy, and improves upon existing smart contract-based approaches by moving computation off-chain. The protocol specifically targets the problem of paying only a threshold number of servers, avoiding both free-riding and the need for a trusted third party, while ensuring each server is paid exactly once for its contribution.

Key Findings

▶ Watch: VITARIT protocol: atomic, Bitcoin-compatible payments for services (2:30)

The VITARIT protocol introduces several key findings and contributions that significantly advance the state of threshold services on blockchains, particularly for Bitcoin and similar UTXO-based systems.

1. Bitcoin-Compatible Threshold Services with Atomic Payments: VITARIT's primary achievement is enabling the deployment of distributed verifiable threshold services on Bitcoin. This is a crucial breakthrough, as Bitcoin's limited scripting capabilities have historically made such complex interactions challenging. By leveraging adapter signatures and a carefully designed payment mechanism, VITARIT ensures that clients can atomically pay for a service only if they receive a valid, verifiable output. This directly addresses the long-standing incompatibility of advanced decentralized services with Bitcoin's architecture.

1. Resolution of the Free-Riding Problem and Single Payment Guarantee: The protocol effectively tackles the "free-riding server problem" by ensuring that only a threshold number of active and contributing servers receive payment. Furthermore, it guarantees that each server is paid at most once for its partial evaluation. This is achieved through a meticulous setup involving client deposits and server auxiliary deposits, combined with a mechanism where server payment transactions bundle both the auxiliary deposit and the client's payment, making double-claiming economically infeasible or cryptographically prevented.

1. Privacy Preservation through Verifiable Non-Committing Encryption (VNCE): VITARIT introduces a novel cryptographic primitive: Verifiable Non-Committing Encryption (VNCE). This primitive is central to the protocol's privacy guarantees. VNCE ensures that a ciphertext can be opened to any value by the prover (the server), while simultaneously providing a proof of correctness that the ciphertext corresponds to a valid partial evaluation. This prevents a malicious client from gaining information about the service output prematurely or distinguishing between real and "fake" ciphertexts, thereby maintaining the privacy of the computation until the client has paid and decrypted the result.

1. Improved Efficiency and Cost Savings over Smart Contracts: By moving the bulk of computation and verification off-chain, VITARIT achieves significant efficiency gains and cost reductions compared to traditional smart contract-based implementations. The talk highlights a 68% gas cost saving for a five-server Distributed Verifiable Random Function (DVRF) service on Ethereum, with the gas cost with VITARIT being approximately 298K gas (excluding setup costs). This improvement scales with the number of servers, demonstrating that VITARIT offers a more economically viable solution for deploying and utilizing threshold services as the network grows.

1. Practical Implementation and Performance Metrics: The research includes a practical implementation of VITARIT instantiated with a BLS-based DVRF using Rust crates, including Direct 25519. The performance metrics are encouraging:

• Each server takes approximately 2004 milliseconds (just over 2 seconds) for the two-party computation with the client.
• Each server outputs a ciphertext of roughly 57 KB.
• The client's two-party computation takes about 126 milliseconds.
• The final signature output for the client is a compact 48-byte signature.

These figures demonstrate that VITARIT is not just a theoretical construct but a practically implementable and reasonably efficient protocol suitable for real-world applications.

These findings collectively present VITARIT as a robust, private, and efficient framework for integrating complex off-chain computations with the security guarantees of blockchain technology, particularly addressing the unique constraints of Bitcoin.

Technical Deep Dive

▶ Watch: Atomic exchange between client and server using adapter signatures (3:45)

The VITARIT protocol's technical elegance lies in its clever combination of cryptographic primitives and a well-structured multi-party interaction model. It addresses the core challenges of atomic payment, privacy, and verifiability in a Bitcoin-compatible manner.

At its heart, VITARIT enables a client to obtain a verifiable output from a threshold of t+1 servers out of n total servers, paying only if the final output is guaranteed. This is achieved through an adapter signature-based swap between the client and each server, orchestrated alongside a novel primitive called Verifiable Non-Committing Encryption (VNCE).

System Setup and Payment Mechanism

1. Client Deposit: The client initiates the process by making a total deposit of (t+1) d where d is the payment value for each server. This deposit is distributed across t+1 distinct Unspent Transaction Outputs (UTXOs), each worth d. The client publishes multiple transactions such that any* server can claim any of these t+1 deposits. This setup ensures competition among servers and allows the client to obtain the necessary threshold of partial evaluations.
2. Server Auxiliary Deposit: Each server locks a small auxiliary deposit. This deposit serves a crucial role in preventing double-spending and guaranteeing that each server is paid at most once. When a server claims a payment from the client, the payment transaction is structured to include both the client's d and the server's auxiliary deposit. This bundling makes it economically unfeasible for a server to attempt to claim multiple payments for a single partial computation, as doing so would require them to risk or forfeit their auxiliary deposit multiple times.
3. Threshold Payment: The client ultimately only needs to pay t+1 servers. The design ensures that once t+1 servers have provided valid partial evaluations and claimed their payments, the client can reconstruct the final output, and no further payments are necessary or possible for the remaining servers.

Atomic Exchange via Adapter Signatures

The core interaction between the client and each individual server relies on an atomic exchange protocol leveraging adapter signatures. This mechanism ensures that the client receives the server's partial evaluation if and only if the server receives its payment.

1. Server Key Generation and Partial Evaluation:

• Each server S_i generates a public/private key pair (PK_i, SK_i). These keys are used for encryption and decryption within the VNCE scheme.
• The server then computes its partial evaluation v_i based on the client's request.
• It encrypts v_i using its public key PK_i to produce a ciphertext C_i.
• Crucially, the server also attaches a VNCE proof to C_i, demonstrating that C_i is a valid encryption of some value v_i without revealing v_i itself, and that v_i is a correct partial evaluation.
• The server sends (C_i, proof) to the client.

1. Client Pre-Signature and Witness:

• The client receives (C_i, proof) from multiple servers. It verifies the VNCE proof for each server.
• For the t+1 servers whose proofs are valid, the client constructs a payment transaction TX_payment_i that pays server S_i.
• The client then creates a pre-signature for TX_payment_i. This pre-signature is a cryptographic commitment to sign TX_payment_i but is dependent on a secret value, which in VITARIT, is the server's decryption key DK_i (which is effectively SK_i). The decryption key DK_i acts as the witness.
• The client sends this pre-signature to server S_i.

1. Server Adapts and Publishes:

• Upon receiving the pre-signature, server S_i uses its private decryption key DK_i to adapt the pre-signature into a valid, final signature for TX_payment_i.
• The server then publishes the fully signed TX_payment_i on the blockchain. This transaction includes the server's auxiliary deposit and the client's payment d.

1. Client Extracts Witness and Decrypts:

• The client monitors the blockchain. Once TX_payment_i is published, the client can extract the witness DK_i from the published transaction. This is a fundamental property of adapter signatures: the secret witness used to complete the signature can be derived by anyone who observes the valid signed transaction.
• With DK_i, the client can now decrypt the initial ciphertext C_i to obtain the server's partial evaluation v_i.
• The client repeats this process for t+1 servers, collects t+1 valid v_i values, and then combines them to reconstruct the final service output.

Verifiable Non-Committing Encryption (VNCE)

The Verifiable Non-Committing Encryption (VNCE) primitive is a cornerstone of VITARIT's privacy and security. It ensures that a malicious client cannot gain any information about v_i before payment, nor can it trick servers into revealing information.

• Non-Committing Property: VNCE guarantees that a ciphertext C generated by a server can be opened to any value by the server, if the server is malicious. This is crucial for preventing a malicious client from distinguishing between a "real" ciphertext (containing a correct v_i) and a "fake" ciphertext (containing some arbitrary v_i'). This property prevents chosen-ciphertext attacks or other information leakage.
• Verifiability: Despite the non-committing property, VNCE includes a robust proof mechanism. The server provides a proof alongside C_i that demonstrates:

1. C_i is a well-formed ciphertext under PK_i.
2. The value v_i (which is still hidden) corresponds to a correct partial evaluation according to the service's rules.

This proof is verifiable by the client without needing to decrypt C_i.

• Cut-and-Choose Technique: The talk mentions that VNCE involves a cut-and-choose technique for proof of correctness. In a cut-and-choose protocol, a prover generates multiple instances of a computation or proof. The verifier then randomly selects a subset of these instances to "cut" (open and check for correctness) and the remaining instances to "choose" (assume correct and use for the main computation). This technique probabilistically guarantees the prover's honesty. In VITARIT's VNCE, this would likely apply to proving the correctness of the encrypted partial evaluation without revealing the evaluation itself.

Performance and Efficiency

The practical implementation of VITARIT using a BLS-based DVRF on Bitcoin-like systems showcases impressive efficiency gains.

• The use of Direct 25519 and other Rust crates points to a modern, high-performance cryptographic implementation.
• The 48-byte signature output for the client is compact, minimizing on-chain footprint.
• The 2004 milliseconds (approx. 2 seconds) for server-side two-party computation and 126 milliseconds for client-side two-party computation demonstrate that the cryptographic overhead is manageable for many applications.
• The 57 KB ciphertext size per server is also a reasonable footprint for off-chain communication.
• The 68% gas cost saving on Ethereum for a 5-server DVRF (with a cost of 298K gas with VITARIT) is a compelling economic argument, showing that off-chain computation and verification drastically reduce transaction costs, especially as the number of servers increases. This improvement scales because the intensive cryptographic verification is moved away from the expensive on-chain environment.

In summary, VITARIT's technical design systematically addresses the challenges of trust, privacy, and efficiency for threshold services, offering a robust solution that is both cryptographically sound and practically viable.

Demo / Proof of Concept

▶ Watch: Verifiable Non-Committing Encryption (VNC) for security (4:25)

While the talk did not feature a live, visual demonstration, the speakers explicitly detailed a proof of concept (PoC) implementation and presented its performance characteristics. This implementation serves as concrete evidence of VITARIT's feasibility and practical benefits.

The researchers implemented the VITARIT protocol instantiated as a BLS-based Distributed Verifiable Random Function (DVRF). This choice is significant because DVRFs are fundamental building blocks for many decentralized applications requiring unbiasable randomness. The implementation utilized Rust crates, a popular choice for high-performance and secure systems programming, including Direct 25519 for cryptographic operations. This indicates a focus on robust and efficient low-level code.

The PoC provided specific, measurable performance metrics, which are crucial for assessing the real-world viability of any cryptographic protocol:

• Server Computation Time: Each server, when engaging in a two-party computation with the client, took approximately 2004 milliseconds (just over 2 seconds). This time includes generating the partial evaluation, encrypting it using VNCE, and preparing the proof.
• Client Computation Time: The client's part in the two-party computation, which involves verifying proofs and performing its share of cryptographic operations, took roughly 126 milliseconds.
• Ciphertext Size: The output ciphertext from each server, containing the encrypted partial evaluation and its associated proof, was approximately 57 KB. This indicates a moderate communication overhead, which is acceptable for off-chain interactions.
• Final Signature Output: The client, after obtaining and combining the partial evaluations, produces a final signature output that is 48 bytes in size. This compact size is beneficial for on-chain storage or transmission, minimizing data footprint.

Furthermore, to demonstrate the efficiency gains over existing smart contract approaches, the team realized the same DVRF functionality on the Ethereum blockchain, both with and without VITARIT. This comparison revealed a substantial gas cost saving of roughly 68% when using VITARIT. Specifically, the gas cost with VITARIT was approximately 298K gas (excluding setup costs), a significant reduction compared to a purely on-chain implementation. The speakers emphasized that this improvement only increases with a higher number of servers, as VITARIT effectively offloads computationally intensive verification from the expensive on-chain environment.

Although not a traditional "demo" in the sense of a user interface or live interaction, the detailed performance results and comparative analysis against smart contract implementations serve as a compelling demonstration of VITARIT's practical advantages and its potential to revolutionize how threshold services are integrated into blockchain ecosystems.

Defensive Implications

▶ Watch: Significant gas cost savings on Ethereum compared to smart contracts (6:00)

VITARIT, while primarily a protocol for enabling services, carries significant defensive implications for both service providers and users within the Web3 ecosystem. Understanding these implications is crucial for adopting VITARIT securely and leveraging its benefits effectively.

1. Mitigation of Free-Riding and Malicious Service Providers: For organizations or individuals operating threshold services (e.g., VRF providers, oracle networks), VITARIT offers robust protection against free-riding. Traditional models struggle with ensuring all paid participants contribute. VITARIT's atomic payment mechanism, coupled with server auxiliary deposits, economically disincentivizes non-participation or malicious behavior. Defenders building or managing such services can rely on VITARIT to ensure that capital is only expended on genuinely contributing servers, improving the economic efficiency and reliability of their operations.

1. Enhanced Privacy for Users and Applications: The integration of Verifiable Non-Committing Encryption (VNCE) is a critical defensive measure against privacy breaches. For applications that require sensitive inputs or outputs (e.g., decentralized gaming, private voting, confidential financial services), VITARIT ensures that the client's request and the server's partial evaluation remain confidential until the client has paid and successfully decrypted the result. This prevents front-running, censorship, or information leakage that could be exploited by malicious actors observing public blockchain transactions. Developers should prioritize protocols incorporating such privacy-preserving techniques to safeguard user data.

1. Security Against Malicious Clients: VNCE also acts as a defense against malicious clients attempting to gain information without paying. The non-committing property ensures that even if a client tries to probe the servers with various inputs or analyzes ciphertexts, they cannot distinguish valid partial evaluations from arbitrary data without the decryption key, which is only released upon payment. This prevents clients from "peeking" at the service output before fulfilling their payment obligation.

1. Cost-Effective and Scalable Service Provision: From a defensive operations perspective, the significant gas cost savings (68% on Ethereum) offered by VITARIT are a major advantage. High transaction costs can make services prohibitive, exposing them to economic denial-of-service or making them non-competitive. By moving computation off-chain, VITARIT allows services to scale more efficiently, reducing the attack surface related to economic exploits and making the service more resilient to network congestion and fluctuating gas prices. This enables defenders to allocate resources more effectively to other security measures.

1. Bitcoin Compatibility and Extended Security Guarantees: For applications seeking the unparalleled security and decentralization of the Bitcoin network, VITARIT provides a defensive pathway to integrate complex services without compromising Bitcoin's core principles. By leveraging adapter signatures within Bitcoin's UTXO model, VITARIT extends the security guarantees of Bitcoin to threshold service payments. This means that applications can benefit from Bitcoin's robust settlement layer for financial transactions related to services, rather than relying solely on potentially less secure or less decentralized chains.

1. Trust-Minimized Interactions: VITARIT minimizes the need for trusted third parties, a common vulnerability in many decentralized systems. The protocol's design ensures that trust is distributed among the n servers, requiring only a threshold t+1 honest participants. This reduces the risk of a single point of compromise, a fundamental defensive principle in distributed systems.

In summary, VITARIT equips both service providers and users with a more secure, private, and economically viable framework for interacting with decentralized threshold services. Defenders should consider VITARIT's architecture when designing new services or evaluating existing ones, recognizing its potential to enhance privacy, reduce operational costs, and bolster overall system resilience against various forms of attack and economic manipulation.

Key Takeaways

• Bitcoin-Compatible Threshold Services: VITARIT enables the deployment of complex, decentralized verifiable threshold services (like VRFs and oracles) on Bitcoin and other UTXO-based blockchains, overcoming previous compatibility limitations.
• Atomic and Secure Payments: The protocol guarantees atomic payments for service delivery, ensuring clients pay only if they receive a valid output and preventing servers from "free-riding" or claiming multiple payments for a single contribution through adapter signatures and auxiliary deposits.
• Enhanced Privacy with VNCE: VITARIT introduces Verifiable Non-Committing Encryption (VNCE), a novel primitive that preserves the privacy of service inputs and outputs, preventing malicious clients from gaining information before payment and ensuring verifiability without revealing secrets.
• Significant Efficiency and Cost Savings: By offloading computationally intensive tasks from the blockchain, VITARIT dramatically reduces gas costs (demonstrated as 68% savings on Ethereum for a 5-server DVRF), making threshold services more economically viable and scalable.
• Practical and Performant Implementation: A proof-of-concept using a BLS-based DVRF with Rust crates shows practical feasibility, with server computations taking ~2 seconds, client computations ~126 milliseconds, and compact 48-byte final signatures.
• Robust Against Malicious Actors: The protocol is designed to secure interactions against both malicious servers (preventing free-riding and double-claiming) and malicious clients (preventing information leakage without payment), fostering a more trustworthy environment for decentralized services.

About the Speaker(s)

The talk "VITARIT: Paying for Threshold Services on Bitcoin and Friends" was presented by Easwar Vivek Mangipudi. He is listed as a primary author alongside Sri AravindaKrishnan Thyagarajan, Pratyay Mukherjee, Lucjan Hanzlik, and Aniket Kate. While specific affiliations or titles for each individual were not detailed in the transcript, their collective work presented at IEEE S&P, a premier conference in security and privacy, indicates a strong background in cryptographic research and blockchain security. The presentation by Easwar Vivek Mangipudi showcased deep technical expertise in distributed systems, cryptography, and blockchain architecture, particularly in addressing the practical challenges of integrating advanced cryptographic primitives with established blockchain protocols like Bitcoin.