Full episode with Vitalik Buterin (Mar 2020): https://www.youtube.com/watch?v=3x1b_S6Qp2Q
Clips channel (Lex Clips): https://www.youtube.com/lexclips
Main channel (Lex Fridman): https://www.youtube.com/lexfridman
(more links below)

Podcast full episodes playlist:
https://www.youtube.com/playlist?list=PLrAXtmErZgOdP_8GztsuKi9nrraNbKKp4

Podcasts clips playlist:
https://www.youtube.com/playlist?list=PLrAXtmErZgOeciFP3CBCIEElOJeitOr41

Podcast website:
https://lexfridman.com/ai

Podcast on Apple Podcasts (iTunes):
https://apple.co/2lwqZIr

Podcast on Spotify:
https://spoti.fi/2nEwCF8

Podcast RSS:
https://lexfridman.com/category/ai/feed/

Vitalik Buterin is co-creator of and author of the white paper that launched Ethereum and ether, which is a cryptocurrency that is currently the second-largest digital currency after bitcoin. There's about 110 million ether out there, which equates at this moment to about 22 trillion dollars. Ethereum has a lot of interesting technical ideas that are defining the future of blockchain technology, and Vitalik is one of the most brilliant people innovating this space today.

Subscribe to this YouTube channel or connect on:
- Twitter: https://twitter.com/lexfridman
- LinkedIn: https://www.linkedin.com/in/lexfridman
- Facebook: https://www.facebook.com/lexfridman
- Instagram: https://www.instagram.com/lexfridman
- Medium: https://medium.com/@lexfridman
- Support on Patreon: https://www.patreon.com/lexfridman

If we could, can we go to the very basics?

Or perhaps we might even start at the Byzantine Generals Problem, the Byzantine Fault Tolerance in general, that Bitcoin was taking steps to providing a solution for.

So the Byzantine generals problem, it's this paper that Leslie Lamport published in 1982, where he has this thought experiment where if you have 2 generals that are kind of camped out on opposite sides of a city, and they're planning when to attack the city, then the question is, and if how could those generals coordinate with each other?

And they could send messengers between each other, but those messengers could get sniped by the enemy on the road.

Some of those messages could end up being traitors, and things could end up happening.

And with just 2 mess generals, it turns out that there's kind of no solution in a finite number of rounds that guarantees that they will be able to kind of coordinate on the same answer.

But then in the case where you have more than 2 generals, so then Leslie analyzes cases like, are the messages kind of just oral messages?

Are the messages kind of signed messages?

So I could give you a signed message and you can pass along that signed message and the third party can still verify that I originally made that message.

And depending on those different cases, there's kind of different bounds on like, given how many generals and how many traders among those generals and what, like under what conditions you actually can agree when to launch an attack.

So it's actually a big misconception that the Byzantine generals problem was unsolved.

The thing that was unsolved though is that all of these solutions assume that you've already agreed on a fixed list of who the generals are.

And these generals have to be kind of semi-trusted to some extent.

They can't just be anonymous people because if they're anonymous, then the enemy could just be 99% of the generals.

So in the 1980s and the 1990s, the general use case for distributed system stuff was more kind of enterprise-y stuff where you could assume that you know who the nodes are that are running these computer networks.

So if he wants to have some kind of decentralized computer network that pretends to be a single computer and that you can kind of do a lot of operations on, then it's made out of these kind of 15 specific computers and we know kind of who and where they are.

And So we have a good reason to believe that say at least 11 of them would be fine.

And it could also be within a single system, almost a network of devices, sensors, so on, like in airplanes.

And I think like flight systems in general still use these kinds of ideas.

Now, the cypherpunks had a different use case in mind, which is that they wanted to create a fully decentralized global permissionless currency.

And The problem here is that they didn't want any authorities and they didn't even want any kind of privileged list of people.

And so now the question is, well, how do you use these techniques to create consensus when you have no way of kind of measuring identities, right?

You have no way of determining whether or not some 99% of participants aren't actually all the same guy.

And so the clever solution that Satoshi had, this is going back to that presentation I made at DEF CON a few months ago, where I said that the things Satoshi invented with crypto economics is this really neat idea that you can use economic resources to kind of limit how many identities you can get.

And if there isn't any existing decentralized digital currency, then the only way to do this is with proof of work, right?

So with proof of work, the solution is just you publish a solution to a hard mathematical puzzle that takes some kind of clearly calculable amount of computational power to solve, you get an identity.

And then you solve 5 of those puzzles, you get 5 identities.

And then these are the identities that we run the consensus algorithm between.

So the proof of work mechanism you just described is like the fundamental idea proposed in the white paper that defines Bitcoin.

What's the idea of consensus that we wish to reach?

So the goal here in just simple technical terms is to basically kind of wire together a set of a large number of computers in such a way that they kind of pretend to the outside world to be a single computer where that single computer keeps working, even if a large portion of the kind of constituents, the computers that make it up break, and kind of break in arbitrary ways.

Like they could shut off, they could try to actively break a system, they could do lots of mean things.

So the reason why the cypherpunks wanted to do this is because they wanted to run 1 particular program on this virtual computer.

And the 1 particular program that they wanted to run is just a currency system, right?

It's a system that just processes a series of transactions.

And for every transaction, it verifies that the sender has enough coins to pay for the transaction, it verifies that the digital signature is correct, and if the check's passed, then it subtracts the coins from 1 account and adds the coins to the other account, roughly.

So first of all, the proof of work idea is kind of, I mean, at least to me, seems pretty fascinating.

I mean, that's a, it's kind of a revolutionary idea.

I mean, is it obvious to come up with that you can use, You can exchange basically computational resources for identity.

It was first proposed in a paper by Cynthia Dwork and Naor in 1994, I believe.

And the original use case was combating email spam.

So the idea is that if you send an email, you have to send it with a proof of work attached.

And like this makes it reasonably cheap to send emails to your friends, but it makes it really expensive to send spam to a million people.

So maybe also taking a step back, so what is the role of blockchain in this?

Sure, So the blockchain, my way of thinking about it is that it is this kind of system where you have this kind of 1 virtual computer created by a bunch of these nodes in the network.

And the reason why the term blockchain is used is because the data structure that these systems use, at least so far, is 1 where different nodes in the network periodically publish blocks.

And a block is a list of transactions together with a pointer, like a hash of a previous block that it builds on top of.

And so you have a series of blocks that nodes in the network create where each block points to the previous block.

Is a fault tolerance mechanism built into the idea of blockchain or is

there a lot of possibilities of different ways to make sure there's no funny stuff going on?

So in a kind of just simple architecture, as I just described, the way the fault tolerance happens is like this, right?

So you have a bunch of nodes and they're just happily and occasionally creating blocks, building on top of each other's blocks.

And let's say you have 1 block, we'll call it kind of block 1.

And then someone else builds another block, honestly, we'll call it block 2, then we have an attacker.

And what the attacker tries to do is the attacker tries to revert block 2.

And the way they revert block 2 is instead of doing the thing they're supposed to do, which is build a block on top of block 2, they're gonna build another block on top of block 1.

So you have block 1, which has 2 children, block 2 and then block 2 prime.

Now, this might sometimes even happen by random chance if 2 nodes in the network just happen to create blocks at the same time and they don't hear about each other's things before they create their own.

But this also could happen because of an attack.

Now, if this happens, you have an attack, then in the Bitcoin system, the nodes follow the longest chain.

So if this attack had happened when the original chain had more than 2 blocks on it.

So if it was trying to kind of revert more than 2 blocks, then everyone would just ignore it and everyone would just keep following the regular chain.

But here, you know, we have block 2 and we have block 2 prime.

And so the 2 are kind of even and then whatever block, the next block is created on top of.

So say block 3 is now created on top of block 2 prime.

Then everyone agrees that block 3 is the new head and block 2 prime is just kind of forgotten.

And then everyone just kind of peacefully builds on top of block 3 and the thing continues.

So how difficult is it to mess with the system?

So how, like, if we look at the general problem, like how many, What fraction of people who participate in the system have to be bad players in order to mess with it truly?

Well, depending on kind of what your model of the participants is and like what kind of attack we're talking about, it's anywhere between 23.2 and 50%.

Of all of the computing power in the network.

So like once your portion of the total computing power of the network goes above the 23.2 level, then there's kind of things that you can mean things that you can potentially do.

And as your percentage of the network kind of keeps going up then your ability to do mean things kind of goes higher.

And then if you have above 50% then you can just break everything.

Like it seems that so far historically speaking it's been exceptionally difficult.

So the economic cost of acquiring that level of stuff from scratch is a fairly high.

I think it's somewhere in the low billions of dollars.

And when you say that stuff, you mean computational resources?

Yeah, so specifically specialized hardware and of ASICs that people use to solve these puzzles, to do the mining

So obviously I work a lot in deep learning with GPUs and ASICs for that application.

And I tangentially kind of hear that so many of these, you know, sometimes NVIDIA GPUs are sold out because of this other application.

Like what do, if you can comment, I don't know if you're familiar or interested in this space, what kind of ASICs, what kind of hardware is generally used these days for to do the actual computation for the proof of work?

So in the case of Bitcoin and Ethereum are a bit different.

So in the case of Bitcoin, there is an algorithm called SHA-256.

And so The puzzle is just coming up with a number where the hash of the number is below some threshold.

And so, because the hashes are designed to be random, you just have to keep on trying different numbers until 1 works.

And the ASICs are just like specialized circuits that contain, and if circuits for evaluating this hash over and over again.

And you have like millions or billions of these hash evaluators and just stacks on top of each other inside of a box.

And you just keep on running the box 24 7.

In the ASICs, there's literally specialized hardware designed for this.

Another tangent, and I'll come back to the basics, but does quantum computing throw a wrench into any of this?

So quantum computers have 2 main families of algorithms that are relevant to cryptography.

And Shor's algorithm is 1 that kind of completely breaks the hardness of some specific kinds of mathematical problems.

So the 1 that you've probably heard of is it makes it very easy to factor numbers.

So like figure out kind of what prime factors are that kind of that you need to multiply together to get some number, even if that number is extremely big.

Shor's algorithm can also be used to break elliptic curve cryptography.

It can break any kind of hidden order groups.

It breaks a lot of cryptographic nice things that we're used to.

But the good news is that for every major use of things that Shor's algorithm breaks, we already know of quantum proof alternatives.

We don't use these quantum proof alternatives yet because in many cases they're 5 to 10 times less efficient, but the crypto industry in general knows that this is coming eventually and it's ready to take the hit and switch to that stuff when we have to.

The second algorithm that is relevant to cryptography is Grover's algorithm.

And Grover's algorithm might even be more familiar to AI people, it's basically usually described as solving search problems.

But the idea here is that if you have a problem of the form, find a number that satisfies some property, then if with a classical computer, you need to try out of n times before you find the number, then with a quantum computer, you only need to do square root of n computations.

And Grovers could potentially be used for mining, but there's 2 possibilities here.

1 is that Grovers could be used for mining, and whoever creates the first working quantum computer that could do Grover's, we'll just mine way faster than everyone else.

And we'll see another round of what we saw when ASICs came out, which is that kind of the new hardware just kind of dominated the old stuff.

And then eventually it switched to a new equilibrium.

But by the way, way faster, not exponentially faster.

Quadratically faster, which is not sort of, it's not game changing, I would say.

It's like ASICs, like you said, it would be.

So it would not necessarily break proof of work as a thing.

Now, the other kind of possible world, right, is that quantum computers have a lot of overhead.

There's a lot of complexity involved in maintaining quantum states.

And there's also, as we've been realizing recently, making quantum computers actually work requires quantum error correction, which requires a thousand real qubits per logical qubit.

And so there's the very real possibility that the overhead of running a quantum computer will be higher than the speed up you get with Grover's, which would be kind of sad, but which would also mean that the given proof of work will just keep working fine.

So proof of work is the core idea of Bitcoin.

Is there other core ideas before we kind of

take a step towards the origin story and ideas of Ethereum?

Is there other stuff that were key to the white paper of Bitcoin?

There is proof of work and then there's just the cryptography, just kind of public keys and signatures that are used to verify transactions.


Speaker 0: If we could, can we go to the very basics? What is the blockchain? Or perhaps we might even start at the Byzantine Generals Problem, the Byzantine Fault Tolerance in general, that Bitcoin was taking steps to providing a solution for.

Speaker 1: So the Byzantine generals problem, it's this paper that Leslie Lamport published in 1982, where he has this thought experiment where if you have 2 generals that are kind of camped out on opposite sides of a city, and they're planning when to attack the city, then the question is, and if how could those generals coordinate with each other? And they could send messengers between each other, but those messengers could get sniped by the enemy on the road. Some of those messages could end up being traitors, and things could end up happening. And with just 2 mess generals, it turns out that there's kind of no solution in a finite number of rounds that guarantees that they will be able to kind of coordinate on the same answer. But then in the case where you have more than 2 generals, so then Leslie analyzes cases like, are the messages kind of just oral messages?

Are the messages kind of signed messages? So I could give you a signed message and you can pass along that signed message and the third party can still verify that I originally made that message. And depending on those different cases, there's kind of different bounds on like, given how many generals and how many traders among those generals and what, like under what conditions you actually can agree when to launch an attack. So it's actually a big misconception that the Byzantine generals problem was unsolved. So Lesley Lamport solved it.

The thing that was unsolved though is that all of these solutions assume that you've already agreed on a fixed list of who the generals are. And these generals have to be kind of semi-trusted to some extent. They can't just be anonymous people because if they're anonymous, then the enemy could just be 99% of the generals. So in the 1980s and the 1990s, the general use case for distributed system stuff was more kind of enterprise-y stuff where you could assume that you know who the nodes are that are running these computer networks. So if he wants to have some kind of decentralized computer network that pretends to be a single computer and that you can kind of do a lot of operations on, then it's made out of these kind of 15 specific computers and we know kind of who and where they are.

And So we have a good reason to believe that say at least 11 of them would be fine.

Speaker 0: And it could also be within a single system, almost a network of devices, sensors, so on, like in airplanes. And I think like flight systems in general still use these kinds of ideas.

Speaker 1: Yep. So that's the 80s. That's the 80s and 90s. Now, the cypherpunks had a different use case in mind, which is that they wanted to create a fully decentralized global permissionless currency. And The problem here is that they didn't want any authorities and they didn't even want any kind of privileged list of people.

And so now the question is, well, how do you use these techniques to create consensus when you have no way of kind of measuring identities, right? You have no way of determining whether or not some 99% of participants aren't actually all the same guy. And so the clever solution that Satoshi had, this is going back to that presentation I made at DEF CON a few months ago, where I said that the things Satoshi invented with crypto economics is this really neat idea that you can use economic resources to kind of limit how many identities you can get. And if there isn't any existing decentralized digital currency, then the only way to do this is with proof of work, right? So with proof of work, the solution is just you publish a solution to a hard mathematical puzzle that takes some kind of clearly calculable amount of computational power to solve, you get an identity.

And then you solve 5 of those puzzles, you get 5 identities. And then these are the identities that we run the consensus algorithm between.

Speaker 0: So the proof of work mechanism you just described is like the fundamental idea proposed in the white paper that defines Bitcoin. What's the idea of consensus that we wish to reach? Why is consensus important here? What is consensus?

Speaker 1: So the goal here in just simple technical terms is to basically kind of wire together a set of a large number of computers in such a way that they kind of pretend to the outside world to be a single computer where that single computer keeps working, even if a large portion of the kind of constituents, the computers that make it up break, and kind of break in arbitrary ways. Like they could shut off, they could try to actively break a system, they could do lots of mean things. So the reason why the cypherpunks wanted to do this is because they wanted to run 1 particular program on this virtual computer. And the 1 particular program that they wanted to run is just a currency system, right? It's a system that just processes a series of transactions.

And for every transaction, it verifies that the sender has enough coins to pay for the transaction, it verifies that the digital signature is correct, and if the check's passed, then it subtracts the coins from 1 account and adds the coins to the other account, roughly.

Speaker 0: So first of all, the proof of work idea is kind of, I mean, at least to me, seems pretty fascinating. It is. I mean, that's a, it's kind of a revolutionary idea. I mean, is it obvious to come up with that you can use, You can exchange basically computational resources for identity.

Speaker 1: It actually has a pretty long history. It was first proposed in a paper by Cynthia Dwork and Naor in 1994, I believe. And the original use case was combating email spam. So the idea is that if you send an email, you have to send it with a proof of work attached. And like this makes it reasonably cheap to send emails to your friends, but it makes it really expensive to send spam to a million people.

Speaker 0: Yeah, that's a simple, brilliant idea. So maybe also taking a step back, so what is the role of blockchain in this? What is the blockchain?

Speaker 1: Sure, So the blockchain, my way of thinking about it is that it is this kind of system where you have this kind of 1 virtual computer created by a bunch of these nodes in the network. And the reason why the term blockchain is used is because the data structure that these systems use, at least so far, is 1 where different nodes in the network periodically publish blocks. And a block is a list of transactions together with a pointer, like a hash of a previous block that it builds on top of. And so you have a series of blocks that nodes in the network create where each block points to the previous block. And so you have this chain of them.

Is a fault tolerance mechanism built into the idea of blockchain or is

Speaker 0: there a lot of possibilities of different ways to make sure there's no funny stuff going on?

Speaker 1: There are indeed a lot of possibilities. So in a kind of just simple architecture, as I just described, the way the fault tolerance happens is like this, right? So you have a bunch of nodes and they're just happily and occasionally creating blocks, building on top of each other's blocks. And let's say you have 1 block, we'll call it kind of block 1. And then someone else builds another block, honestly, we'll call it block 2, then we have an attacker.

And what the attacker tries to do is the attacker tries to revert block 2. And the way they revert block 2 is instead of doing the thing they're supposed to do, which is build a block on top of block 2, they're gonna build another block on top of block 1. So you have block 1, which has 2 children, block 2 and then block 2 prime. Now, this might sometimes even happen by random chance if 2 nodes in the network just happen to create blocks at the same time and they don't hear about each other's things before they create their own. But this also could happen because of an attack.

Now, if this happens, you have an attack, then in the Bitcoin system, the nodes follow the longest chain. So if this attack had happened when the original chain had more than 2 blocks on it. So if it was trying to kind of revert more than 2 blocks, then everyone would just ignore it and everyone would just keep following the regular chain. But here, you know, we have block 2 and we have block 2 prime. And so the 2 are kind of even and then whatever block, the next block is created on top of.

So say block 3 is now created on top of block 2 prime. Then everyone agrees that block 3 is the new head and block 2 prime is just kind of forgotten. And then everyone just kind of peacefully builds on top of block 3 and the thing continues.

Speaker 0: So how difficult is it to mess with the system? So how, like, if we look at the general problem, like how many, What fraction of people who participate in the system have to be bad players in order to mess with it truly? Is there a good number?

Speaker 1: There is. Well, depending on kind of what your model of the participants is and like what kind of attack we're talking about, it's anywhere between 23.2 and 50%.

Speaker 0: Of what?

Speaker 1: Of all of the computing power in the network. Sorry, so 22 and 50? Between 23.2 and 50%.

Speaker 0: And 50% can be compromised.

Speaker 1: So like once your portion of the total computing power of the network goes above the 23.2 level, then there's kind of things that you can mean things that you can potentially do. And as your percentage of the network kind of keeps going up then your ability to do mean things kind of goes higher. And then if you have above 50% then you can just break everything.

Speaker 0: So how hard is it to achieve that level? Like it seems that so far historically speaking it's been exceptionally difficult.

Speaker 1: So- This is a challenging question. So the economic cost of acquiring that level of stuff from scratch is a fairly high. I think it's somewhere in the low billions of dollars.

Speaker 0: And when you say that stuff, you mean computational resources?

Speaker 1: Yeah, so specifically specialized hardware and of ASICs that people use to solve these puzzles, to do the mining

Speaker 0: these days. Small tangent. So obviously I work a lot in deep learning with GPUs and ASICs for that application. And I tangentially kind of hear that so many of these, you know, sometimes NVIDIA GPUs are sold out because of this other application. Like what do, if you can comment, I don't know if you're familiar or interested in this space, what kind of ASICs, what kind of hardware is generally used these days for to do the actual computation for the proof of work?

Speaker 1: Sure. So in the case of Bitcoin and Ethereum are a bit different. So in the case of Bitcoin, there is an algorithm called SHA-256. It's just a hash function. And so The puzzle is just coming up with a number where the hash of the number is below some threshold.

And so, because the hashes are designed to be random, you just have to keep on trying different numbers until 1 works. And the ASICs are just like specialized circuits that contain, and if circuits for evaluating this hash over and over again. And you have like millions or billions of these hash evaluators and just stacks on top of each other inside of a box. And you just keep on running the box 24 7.

Speaker 0: In the ASICs, there's literally specialized hardware designed for this. Yes. Oh, this is living in an amazing world. Another tangent, and I'll come back to the basics, but does quantum computing throw a wrench into any of this?

Speaker 1: Very good question. So quantum computers have 2 main families of algorithms that are relevant to cryptography. 1 is a Shor's algorithm. And Shor's algorithm is 1 that kind of completely breaks the hardness of some specific kinds of mathematical problems. So the 1 that you've probably heard of is it makes it very easy to factor numbers.

So like figure out kind of what prime factors are that kind of that you need to multiply together to get some number, even if that number is extremely big. Shor's algorithm can also be used to break elliptic curve cryptography. It can break any kind of hidden order groups. It breaks a lot of cryptographic nice things that we're used to. But the good news is that for every major use of things that Shor's algorithm breaks, we already know of quantum proof alternatives.

We don't use these quantum proof alternatives yet because in many cases they're 5 to 10 times less efficient, but the crypto industry in general knows that this is coming eventually and it's ready to take the hit and switch to that stuff when we have to. The second algorithm that is relevant to cryptography is Grover's algorithm. And Grover's algorithm might even be more familiar to AI people, it's basically usually described as solving search problems. But the idea here is that if you have a problem of the form, find a number that satisfies some property, then if with a classical computer, you need to try out of n times before you find the number, then with a quantum computer, you only need to do square root of n computations. And Grovers could potentially be used for mining, but there's 2 possibilities here.

1 is that Grovers could be used for mining, and whoever creates the first working quantum computer that could do Grover's, we'll just mine way faster than everyone else. And we'll see another round of what we saw when ASICs came out, which is that kind of the new hardware just kind of dominated the old stuff. And then eventually it switched to a new equilibrium.

Speaker 0: But by the way, way faster, not exponentially faster.

Speaker 1: Quadratically faster.

Speaker 0: Quadratically faster, which is not sort of, it's not game changing, I would say. It's like ASICs, like you said, it would be.

Speaker 1: Exactly. Yeah. So it would not necessarily break proof of work as a thing. That's

Speaker 0: right, yeah.

Speaker 1: Now, the other kind of possible world, right, is that quantum computers have a lot of overhead. There's a lot of complexity involved in maintaining quantum states. And there's also, as we've been realizing recently, making quantum computers actually work requires quantum error correction, which requires a thousand real qubits per logical qubit. And so there's the very real possibility that the overhead of running a quantum computer will be higher than the speed up you get with Grover's, which would be kind of sad, but which would also mean that the given proof of work will just keep working fine. So beautifully put.

So proof of work is the core idea of Bitcoin. Is there other core ideas before we kind of

Speaker 0: take a step towards the origin story and ideas of Ethereum? Is there other stuff that were key to the white paper of Bitcoin?

Speaker 1: There is proof of work and then there's just the cryptography, just kind of public keys and signatures that are used to verify transactions. Those 2 are the big things.

See all Lex Fridman transcripts on Youtube

Cryptocurrency, Blockchain, and the Byzantine Generals Problem (Vitalik Buterin) | AI Podcast Clips