Bitcoin-NG: A Secure, Faster, Better Blockchain

Bitcoin-NG: Next-Generation Blockchains

We have developed a next-generation blockchain protocol, called Bitcoin-NG for short, that eliminates the scalability limits described above. Bitcoin-NG addresses the scalability bottleneck by enabling the Bitcoin network to achieve the highest throughput allowed by the network conditions. Paradoxically, not only does it improve transaction throughput, it also reduces transaction latencies -- it is possible to get an initial transaction confirmation in seconds rather than in minutes. And it does so without changing Bitcoin’s open architecture and trust model.

While the full details of Bitcoin-NG are now available as a white paper, this post describes the key insight behind its operation. To do this effectively and describe why the core idea behind Bitcoin-NG is both fresh and revolutionary, we first describe the traditional approaches that have dominated the scalability discussion so far.

The Scalability Challenge

Until Bitcoin-NG, the thinking was that there were, essentially, two options for increasing Bitcoin’s transaction throughput: increase the size of blocks, or decrease the block interval. Both options lead to various undesirable outcomes. Without rehashing (no pun intended) the entire blocksize debate, we’ll quickly touch upon some of the key arguments.

In essence, all the protocol problems stem from the same fundamental issue. Due to the nature of the distribution algorithm, increasing the blocksize or reducing the block interval both lead to an increased rate of forks. In a fork, the blockchain is bifurcated into multiple branches, and there is no single blockchain. The system is therefore in an undecided state. Eventually, the fork is resolved, one branch is chosen and other branches are thereafter pruned, or simply, ignored.

Forks incur two significant security risks. First, they reduce security against attackers. Bitcoin is secured by mining power, and mining power in pruned branches does not participate in securing the system. If 1/4 of the blocks are pruned, then an attacker can be 1/4 smaller to perform selfish mining, or a 51% attack.

Second, forks reduce fairness. Bitcoin and all blockchain protocols compensate miners for their effort, and the compensation should be proportional to a miner’s power. When forks are frequent, small miners and miners that are not well connected to the overlay network are at a disadvantage, earning less than their fair share. Miners are therefore incentivized to coalesce into larger and larger pools, and thereby pose a centralization threat.

And of course, larger blocks typically require more resources, effectively cutting certain kinds of peers out of the network. Since the Bitcoin network is quite bursty, and at the network level, operates by lying idle for long periods of time, punctuated with sudden waves when a block has to be propagated throughout the globe, well-provisioned nodes are a necessity. And certain geographic regions may be at a permanent disadvantage.

The scalability debate has revolved around these issues, and has been caught in a morass, as these concerns are genuine and the tradeoffs difficult to resolve. And even if a compromise is found, the tradeoffs involved mean that the throughput gains will be modest. Under the currently prominent proposals, Bitcoin does not become competitive with today’s VISA throughput for decades. The block-size/block-interval parameter adjustment is a difficult line to toe, as is clear from the tenor of the scalability debate.

Bitcoin-NG: Scaling without Limits

Bitcoin-NG sidesteps the scaling dilemma by inverting the behavior of the blockchain. In Bitcoin, the system generates a retrospective block that encases in cryptographic stone the transactions that took place in the preceding 10 minutes. In Bitcoin-NG, the protocol is, instead, forward-looking: every 10 minutes, NG elects a leader, who then vets future transactions as soon as they happen. The former is necessarily limited by the blocksize and block interval, while the latter approach can run as fast as the network will allow.

Specifically, Bitcoin-NG chooses a leader at the beginning of an epoch, and she is in charge of serializing transactions until the next leader is chosen. NG maintains the overall blockchain structure, but has two types of blocks: key-blocks and microblocks. Key-blocks are used for leader election. They are generated by mining with Proof of Work, as in Bitcoin, and they occur at 10 minute intervals on average, as in Bitcoin; in fact, they are identical, in format, to Bitcoin blocks, except for a small twist on the coinbase transaction, explained below. Every key-block initiates a new epoch. Microblocks contain transactions; they are generated by the epoch leader; they contain no proof of work, and are signed with the leader’s private key.

In a Bitcoin block, the first transaction, called the coinbase, rewards the miner for having solved a cryptopuzzle and thus for having contributed a block to the blockchain. All of the transactions are part of the same block and are contributed en masse. In between blocks, the traditional Bitcoin system appears idle to an onlooker, as miners are working to discover the next block, but without apparent progress on the consensus front. In contrast, in Bitcoin-NG, the key-blocks can be tiny because they need contain only the coinbase transaction, which names the public key that the miner will be using to sign microblocks. Because a key-block requires proof of work, competing miners cannot just manufacture one and usurp the leadership at will. Following the key-block, the lead miner can quickly issue microblocks, simply by signing them with the private key corresponding to the public key named in the key-block’s coinbase.

In short, Bitcoin-NG shifts the process of issuing blocks: instead of manufacturing a block at a time as in Bitcoin, an NG miner first acquires the right to issue microblocks, and can thereafter efficiently create a series of microblocks. Microblock creation is limited solely by signing speed (in the millisecond range) and network propagation speeds of small microblocks. Should the miner falter for any reason, other miners can take over when they discover a new key-block. Unlike Ripple and related protocols, leadership handover does not require participation from a quorum of existing nodes, and therefore maintains Bitcoin’s decentralized Byzantine fault tolerance guarantees.

The keen reader may already notice several potential pitfalls, as it might seem difficult, at first glance, to incentivize miners to follow the protocol. Double-spend attacks by malicious miners are obviously a key concern. We discuss the algorithm in detail and specifically address the incentive mechanisms, as well as potential attacks, in the white paper.

We have run large scale experiments with 1000 nodes comparing Bitcoin and Bitcoin-NG. At 1/6th of the routable Bitcoin network, these are, to our knowledge, the largest Bitcoin scaling experiments ever executed with the actual Bitcoin client code. The results demonstrate a qualitative improvement on all metrics related to performance and fairness. Bitcoin-NG scales optimally at the protocol level, limited only by the properties of the physical network and the individual nodes.

We believe that Bitcoin-NG advances the science of blockchains by increasing throughput and reducing latency, without impacting miner fairness, the open architecture of Bitcoin, or the clients in any substantial way. It is worth noting that there is no conflict or contradiction between NG and Blockstream’s sidechains; in fact, Blockstream’s pegs allow for moving bitcoins among chains, and such chains can benefit from improved performance using Bitcoin-NG. In future work, we plan to expand on how to incrementally deploy Bitcoin-NG on top of the current Bitcoin network.

Overall, we are excited and somewhat surprised ourselves that such substantial improvements in throughput and latency can be achieved with nominal cost, and while remaining backwards compatible. We look forward to more secure, faster, better blockchains.

In Context

Since the Bitcoin world is rife with conflicts of interest, there is value in reproducing part of the announcement that accompanied this note on the bitcoin developers list:

NG is compatible with both Bitcoin as is, as well as Blockstream-like sidechains, and we currently are not planning to compete commercially with either technology -- we see NG as being complementary to both efforts. This is pure science, published and shared with the community to advance the state of blockchains and to help them reach throughputs and latencies required of cutting edge fintech applications. Perhaps it can be adopted, or perhaps it can provide the spark of inspiration for someone else to come up with even better solutions.