diff --git a/LICENSE b/LICENSE deleted file mode 100644 index bec5015..0000000 --- a/LICENSE +++ /dev/null @@ -1,21 +0,0 @@ -The MIT License (MIT) - -Copyright (c) 2016 The ELements Project - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. diff --git a/README.md b/README.md index bf310e2..a7e1a34 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,12 @@ ElementsProject.org =================== -Welcome to the Elements Project. We're excited you're here, and want to -collaborate with you on making Elements accessible to anyone who will find -utility in their use. +Welcome to the Elements Project. We're excited you're here, and want to collaborate with you on making Elements accessible to anyone who will find utility in their use. ## Quick Start -ElementsProject.org is a static website powered by [Hexo](https://hexo.io). -You'll need `npm` (which comes with Node.js) to get started. +ElementsProject.org is a static website powered by [Hexo](https://hexo.io). You'll need `npm` (which comes with Node.js) to get started. + +First, install hexo: `npm install hexo-cli -g` Fork the repository (top right hand corner on GitHub), and get a local copy: ``` @@ -15,11 +14,9 @@ git clone git@github.com:YOUR_USERNAME/elementsproject.org # clone the repo cd elementsproject.org # move into the directory ``` -Next, install the dependancies using `npm install` - Now, you can use Hexo to run a local copy to preview your changes: ``` -npm start +hexo server ``` That's it. Make modifications, commit them, and submit a pull request. diff --git a/javascripts/scale.fix.js b/javascripts/scale.fix.js deleted file mode 100644 index 08716c0..0000000 --- a/javascripts/scale.fix.js +++ /dev/null @@ -1,20 +0,0 @@ -fixScale = function(doc) { - - var addEvent = 'addEventListener', - type = 'gesturestart', - qsa = 'querySelectorAll', - scales = [1, 1], - meta = qsa in doc ? doc[qsa]('meta[name=viewport]') : []; - - function fix() { - meta.content = 'width=device-width,minimum-scale=' + scales[0] + ',maximum-scale=' + scales[1]; - doc.removeEventListener(type, fix, true); - } - - if ((meta = meta[meta.length - 1]) && addEvent in doc) { - fix(); - scales = [.25, 1.6]; - doc[addEvent](type, fix, true); - } - -}; \ No newline at end of file diff --git a/package.json b/package.json index ada1887..ce7d6ce 100644 --- a/package.json +++ b/package.json @@ -1,16 +1,12 @@ { - "name": "elementsproject.org", - "version": "2.8.3", + "name": "hexo-site", + "version": "0.0.0", "private": true, - "scripts": { - "start": "hexo server" - }, "hexo": { - "version": "3.2.2" + "version": "3.1.1" }, "dependencies": { "hexo": "^3.1.0", - "hexo-browsersync": "^0.2.0", "hexo-generator-archive": "^0.1.2", "hexo-generator-category": "^0.1.2", "hexo-generator-index": "^0.1.2", @@ -21,14 +17,5 @@ "hexo-renderer-marked": "^0.2.4", "hexo-renderer-stylus": "^0.3.0", "hexo-server": "^0.1.2" - }, - "license": "MIT", - "bugs": { - "url": "https://github.com/ElementsProject/elementsproject.org/issues" - }, - "homepage": "https://github.com/ElementsProject/elementsproject.org#readme", - "repository": { - "type": "git", - "url": "git+https://github.com/ElementsProject/elementsproject.org.git" } -} \ No newline at end of file +} diff --git a/source/_posts/announcing-elements.md b/source/_posts/announcing-elements.md index 9b24199..85ae231 100644 --- a/source/_posts/announcing-elements.md +++ b/source/_posts/announcing-elements.md @@ -1,85 +1,75 @@ --- -title: Announcing the New Elements Project -subtitle: Open source code and developer sidechains for advancing Bitcoin. -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/_posts/announcing-elements.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/_posts/announcing-elements.md -author: martindale +title: Announcing Sidechain Elements: Open source code and developer sidechains for advancing Bitcoin +source: +github: --- +We're excited to announce the release of Sidechain Elements. Sidechains extend +Bitcoin functionality through interoperable blockchain networks and today's open +source release includes an +experime[![elements_logo](https://www.blockstream.com/wp-content/uploads/2015/06/elements_logo-300x78.png)](https://www.blockstream.com/wp-content/uploads/2015/06/elements_logo.png)ntal +sidechain that has a number of new working capabilities. With the release of +Sidechain Elements, Blockstream is moving this effort into the community. We're +inviting developers to work with us, to test and use the code for their +projects, and to share their proposals and code for additional capabilities. -On the heels of the [Scaling Bitcoin workshop in Hong -Kong][scaling-bitcoin-hong-kong], we're excited to announce the release of [the -New Elements Project][elements]. The Elements Project is a community effort to -create and test new extensions to the Bitcoin protocol. Core Developers have -already announced several of these new Elements, including [Confidential -Transactions][confidential-transactions] by Gregory Maxwell and [Segregated -Witness][segregated-witness] by Pieter Wuille, which have undergone extensive -testing on existing sidechains. - +Sidechains are decentralized, peer-to-peer networks that provide useful +security, risk, and performance enhancements for global systems of value +exchange that don't need intermediaries, central banks or other third parties. +They are distributed ledgers that are interoperable with each other and with +Bitcoin, leveraging the most secure blockchain and code infrastructure in an +additive way. Sidechains enable innovators to safely develop new applications +without jeopardizing Bitcoin's core code and putting billions of dollars worth +of digital currency at risk. -Along with this new release also comes a new community initiative, **[the -Sidechain Developer Community][contributing].** We're hoping this community -will facilitate discussion around how various Elements are being used, including -known efforts by companies like Gem and RootStock. +We began our work on sidechains almost one year ago first through extensive +discussions and debate with others in the technical community, and then in the +publication of a +[whitepaper](https://www.blockstream.com/2014/10/23/why-we-are-co-founders-of-blockstream/ +"Why we co-founded Blockstream") and [launch of +Blockstream](https://www.blockstream.com/2014/11/17/blockstream-closes-21m-seed-round/ +"Blockstream closes $21M seed round"). Over the past several months, we've been +coding and testing initial implementations all in preparation for today's +release. -
- -
+Sidechain Elements consists of several components: the core network software to +build an initial testing sidechain, eight new features not currently supported +by Bitcoin, a basic wallet, and the code for moving coins between blockchains. +We've selected a collection of elements chosen to be both exciting and useful to +three audiences with overlapping interests: the broader Bitcoin community; core +technologists and smart-contract programmers; and businesses just starting to +explore blockchain use cases. The new elements include Confidential +Transactions, Basic Asset Issuance, Relative Lock Time and several others. We've +posted a video of our CTO, Greg Maxwell, walking through all of new +capabilities. -### What are Elements? -Elements are bundles of code that extend Bitcoin functionality, and today's -release includes new developer documentation on how the existing Elements work, -in addition to [a new community-managed index of available -Elements][element-list]. Everything on the Elements Project website is stored -in [the ElementsProject.org GitHub repository][github] and can be edited and -contributed to by the community. We hope that you will join us. +The initial sidechain included in Sidechain Elements works on a federated +security model; while it's still peer-to-peer and consensus-based, security for +the blockchain is provided by a set of predefined functionaries in an +arrangement called a Fed-Peg. A number of academic groups and individual +contributors have agreed to run the Sidechain Elements Fed-Peg, including +blockchain groups at Stanford, MIT, and Princeton. The sidechain does not +include mining or proof-of-work at this point. -### A Publicly Editable Resource -We've made the entire Elements Project website a [publicly editable -resource][github], and even added simple buttons to most pages that link -directly to graphical editors for quick fixes. We want the Elements Project to -be a community resource, including the highlighting of projects that make use of -Elements, or are otherwise deployed on a sidechain. +In the coming weeks, we'll be publishing an early draft of a proposal for a +fully decentralized, two-way peg and merge-mined sidechains, which will enable +us to test other types of sidechain functionality. -Contributing to the Elements Project website should be very familiar to most -developers, but the graphical editor makes it accessible to all. If you'd like -to contribute, head over to [the Contributing guide][contributing]. +Sidechains are an emerging technology, and this work is in its early stages. The +code and working sidechain provide a basis for research and prototyping. We'll +undertake many of these efforts, and anticipate many others will happen +independent of Blockstream with over 30 major financial institutions launching +blockchain innovation projects, as well as interest in this tech from other +Bitcoin and blockchain-based ventures. -### Sidechain Developer Community -We've created [a new public Slack chat][slack] dedicated to connecting -developers working on Elements-related projects. Slack is a convenient medium -for communication with a broader community, and does not supplant the in-depth -technical discussion that takes place in [the #sidechains-dev channel on -IRC][irc]. In fact, we've even opened up IRC access (SSL only) to the -Sidechains Developer Slack, for which you can find connection details on [the -Sidechains Gateway configuration page][sidechains-gateways]. +**Here be dragons:** While much of the underlying science isn't new, this is an +alpha code release. We've intentionally focused on a Testnet sidechain and +strongly urge others to avoid implementations that involve bitcoin or other +real-world assets. Fiduciary code like this requires significant peer review +before moving onto production environments. -
-

Our public Slack is the fastest way to get connected with other contributors to the Elements Project. We'll send an invitation to your email address.

- Join the Community -
-
- -### Next Steps -Segregated Witness has been deployed on [the `alpha` sidechain for some -time][alpha], but as the first Element that is likely to make its way into -Bitcoin Core, it is important that it undergoes rigorous review. Discussion is -ongoing in [the Developer Mailing list][sidechains-list], but you can use it today by [getting -connected to the `alpha` network][alpha-moving-coins]. - -Until then, [join the Sidechains chat][slack] and get acquainted with your fellow -developers! - -[elements]: https://www.elementsproject.org/ -[slack]: https://chat.elementsproject.org/ -[confidential-transactions]: https://www.elementsproject.org/elements/confidential-transactions -[segregated-witness]: https://www.elementsproject.org/elements/segregated-witness -[sidechains-gateways]: https://sidechains.slack.com/account/gateways -[element-list]: https://www.elementsproject.org/elements/ -[github]: https://github.com/ElementsProject/elementsproject.org -[contributing]: https://www.elementsproject.org/contributing/ -[scaling-bitcoin-hong-kong]: https://www.scalingbitcoin.org/hongkong2015 -[irc]: https://www.elementsproject.org/contributing/#irc -[alpha]: https://www.elementsproject.org/sidechains/alpha -[alpha-build]: https://www.elementsproject.org/sidechains/alpha#Build_Instructions -[alpha-moving-coins]: https://www.elementsproject.org/sidechains/alpha#Moving_coins_between_Testnet_and_Alpha -[sidechains-list]: https://lists.linuxfoundation.org/mailman/listinfo/sidechains-dev +Sidechain Elements is available under the MIT open source license, along with +initial documentation, on Blockstream's code repo. We'll make ourselves +available to work with developers, and we invite the technical community to join +the discussion and get involved in moving sidechains and distributed ledger +technology forward. Complete info and links can be found on our new +[Developers](https://blockstream.com/developers/) page. diff --git a/source/_posts/the-federated-peg-in-elements-alpha.md b/source/_posts/the-federated-peg-in-elements-alpha.md deleted file mode 100644 index 3c42853..0000000 --- a/source/_posts/the-federated-peg-in-elements-alpha.md +++ /dev/null @@ -1,159 +0,0 @@ -title: The Federated Peg in Elements Alpha -date: 2016-02-29 23:30:04 ---- -The federated peg is the mechanism we use in Elements Alpha and Liquid to transfer coins from Bitcoin to sidechain and back. -While the high level design has been described in the [sidechains whitepaper](https://blockstream.com/sidechains.pdf) this post focuses on the actual implementation. - -The federated component means that the transferred coins are locked on the main chain using a multisig output controlled by a federation of signers instead of an SPV-lock. -The peg mechanism doesn't require more than introducing two new opcodes to the Script language and is -designed to ensure that it can be easily soft-forked into Bitcoin in order to evolve to the full SPV peg. - - - -### OP_WITHDRAWPROOFVERIFY (OP_WPV) -Let's start with Alpha's genesis block. -It looks very much unlike Bitcoin's genesis block because it creates exactly one output with a value of 21 million. -The output has the following scriptPubKey: - -{% codeblock %} -6fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d6190000000000 -9eac001049d5c38ece8996485418421f4a01e2d7 -OP_WITHDRAWPROOFVERIFY -{% endcodeblock %} - -This output is called *withdraw lock* because it represents the coins in the main chain which can be unlocked with a withdrawal. -OP_WITHDRAWPROOFVERIFY (OP_WPV) is a new opcode. -Note that there is no mining block reward in Alpha, so our only chance to obtain coins in Alpha at this point is to spend this withdraw lock. -Let's create a transaction we call *withdrawal transaction* that does just that. - -OP_WPV expects the following elements on the stack: -1. HASH160(secondScriptPubKey), the secondScriptPubKey is used to extend checks -2. genesis block hash of the chain the withdraw is coming from -3. the coinbase tx within the locking block -4. the index within the locking tx's outputs we are claiming -5. the locking tx itself -6. the merkle block structure which contains the block in which the locking transaction is present -7. The contract which we are expected to send coins to -8. The scriptSig used to satisfy the secondScriptPubKey -9. secondScriptPubKey - -The first two arguments are already provided by the scriptPubKey. They add chain specific information - in this case a scripthash we will explain later and bitcoin's genesis block hash. - -The next arguments provide a 'locking transaction'. -This is the main chain transaction that locks coins in order to withdraw them on the sidechain. -Figure 1 shows the relationship between the transaction types we've seen so far. - - peg figure - -The withdrawal transaction spends OP_WPV locked coins by referring to a lock on the other chain. -Instead of using OP_WPV, the main chain lock is a multisig output controlled by the federation. -Note the symmetry of vocabulary: coins which are currently unlocked in the main chain are locked in the sidechain and vice versa. - -The script interpreter tests if the destination of the locking transaction is really the federation. It further checks that the locking tx and coinbase tx are contained in the merkle block structure and reads the block height from the coinbase. -Elements Alpha uses an asymmetric peg and therefore a full Alpha node is expected to be a full validator of the parent chain as well. -In order to verify that the locking transaction is in the Bitcoin blockchain, Alpha connects to bitcoind via RPC (this is turned on with command line argument `-blindtrust=false`) and calls `getblock` with the merkle block's hash to check if it is has at least 10 confirmations (*confirmation period*). -In the future, OP_WPV will in addition accept an SPV proof to check without relying on bitcoind if the block has received enough confirmations (under some assumptions about the distribution of hash rate). - -Next, OP_WPV expects the destination *contract* consisting of a 16 byte nonce and a 20 byte script hash that represents the receiver of the withdrawal transaction. -The interpreter checks that the locking transaction commits to the contract using the [pay-to-contract (P2C)](https://arxiv.org/pdf/1212.3257.pdf) construction. -P2C allows the sender of the locking tx to transparently specify the destination script hash, such that the validators can check the intended recipient of the withdraw. This works by deriving a new keypair for contract `x`: `privkey = old_privkey + H(x), pubkey = old_pubkey + H(x)*G`. - -So, in summary, a user who wants to spend an OP_WPV locked output would first create a P2SH address on the side chain and assemble a main chain locking tx that sends the desired value to the federation. Then the user would embed her script hash (in the form of a contract) into the locking transaction and broadcast it. As soon as the confirmation period is over, the user can spend OP_WPV by providing the locking tx and the contract. - - -### Withdraw output -OP_WPV is a new type of opcode which has access to the outputs of the transaction that spends it. -In the case of OP_WPV, it checks that the transaction has two outputs: an output we call *withdraw output* and a OP_WPV-locked output to represent the change. -Next, the interpreter compares the output values, verifies that there is no more value in the -withdraw output than in the parent chain lock and that the remaining value goes back into -the lock output. -This change can then be unlocked later with another withdrawal transaction similar to the transaction we are creating here. - -A withdraw output has the following scriptPubKey: -{% codeblock %} -OP_IF - - - - - - - OP_REORGPROOFVERIFY -OP_ELSE - 144 - OP_CHECKSEQUENCEVERIFY - OP_DROP - OP_HASH160 - - OP_EQUAL -OP_ENDIF -{% endcodeblock %} - -Let's first look at the ELSE branch. -[OP_CHECKSEQUENCEVERIFY](https://github.com/bitcoin/bips/blob/master/bip-0112.mediawiki) ensures that this branch is only executable if the withdraw output is buried at least 144 blocks deep in the blockchain (*contest period*). -After the contest period the withdraw output effectively becomes a regular P2SH script. -The interpreter additionally makes sure that the destination scriptHash is exactly the scriptHash from the contract that was committed to in the locking transaction. - -Successful execution of the first branch requires providing a *fraud proof* to the second new opcode, OP_REORGPROOFVERIFY (OP_RPV). -Therefore, during the contest period the withdraw output allows any node to provide a fraud proof, spend the output and consequently collect a fraud bounty. - -### OP_REORGPROOFVERIFY (OP_RPV) -OP_RPV is intended to correct invalid states of two types: double spends of a parent chain lock and parent chain reorganisations. -You might have realized already that the former situation is indeed not covered by OP_WPV alone. In fact, it is possible that withdrawal transactions which refer to the same parent chain lock make it into the chain. -Figure 2 shows the resolution of such a double spend attempt. - - peg figure - -OP_RPV allows to spend the withdraw output when a fraud proof is provided. It consists of the original withdraw transaction, the double spending withdraw transaction and a merkle block for each. The reference to the main chain lock is already given by the withdraw output. -In consequence, the interpreter then checks that there is indeed a double spend, both merkle blocks are valid and contain the transactions, and that the double spending withdraw transaction is newer than the original withdraw transaction. -Because blockchain consensus in Elements Alpha is determined by a federation of signers, the interpreter only requires the blocks to have valid signatures. -If Alpha was backed by PoW, OP_RPV would require SPV proofs to verify that the blocks are at the specified height similar to the SPV extension in OP_WPV's case. - -Just like OP_WPV, OP_RPV peeks into the outputs of the transaction spending it. The transaction must have one output that uses OP_WPV to re-lock the withdraw output value minus the fraud bounty. The fraud bounty can be claimed by the prover. - -As the name implies, OP_RPV does not only come into play when there is a double spend, but also when the parent chain reorganizes. -In such a situation, the locking transaction is either in another block or completely missing in the chain. -In any case, the withdraw output should be invalidated by a reorganisation proof. -This is not yet implemented in Alpha, but in principle the prover would provide an SPV proof that there exists a chain with sufficiently more work which does *not* include the block the withdrawal was coming from. - -If alphad is started with the `tracksidechain=all` command line argument it stores all previously spent main chain lock outputs in order to issue fraud proofs if a double spend occurs. - -Lastly, let's have a look at the curious secondScriptPubKey, which is expected to be the 9th argument to OP_WPV and is committed to in a withdraw lock (1st argument). -The secondScriptPubKey is executed with a stack that contains the result of the scriptSig execution and information about the withdrawal transaction, i.e. transaction fee, fraud bounty, the OP_CSV locktime (from the withdrawoutput’s scriptPubKey ELSE case) and a constant dummy byte string. -In Elements Alpha, the secondScriptPubKey for the Bitcoin lock is `OP_DROP 144 OP_LESSTHANOREQUAL`, which effectively ensures that contest period has passed. -The secondScriptPubKey does not inspect the result the of the secondScriptSig, so the default scriptSig in this case is just a one byte push. -This mechanism could in principle enforce additional chain specific limits on transaction fee and fraud bounty or more complex rules. - - -### Withdrawing from the sidechain -The mechanism behind sending coins from the sidechain to the main chain is - as far as the Alpha code is concerned - relatively simple. -Figure 3 shows the sequence of transactions during a withdrawal to the main chain. - - peg figure - -The federated lock on the main chain is a m of n multisignature output. -Functionaries who hold the lock run a program we call *watchman* which communicates to alphad via RPC and is responsible for releasing the lock when a withdraw request appears on the sidechain. -Note that due to the P2C payments, the federation is is not aware of a lock as long as the corresponding withdraw transaction has not taken place. This is because only the withdraw transaction reveals the data necessary - the contract - to derive pub- and privkey of the lock. - -Withdraw requests take the form of a lock output, so a transfer from side- to main chain would be initiated by a new transaction with the following scriptPubKey: -{% codeblock %} - -OP_DROP - - -OP_WITHDRAWPROOFVERIFY -{% endcodeblock %} -The script puts the coin in a regular sidechain lock and additionally communicates the main chain destination. This instructs the functionaries to spend their lock and credit the intended receiver. - -Behind the scenes watchman follows a round-based distributed protocol (using a separate network) to select a round-leader, who is responsible for collecting withdraw requests and creating a corresponding main chain withdraw transaction. -The other functionaries check that the transaction correctly spends the withdraw requests (i.e. it goes to the correct destination, the sidechain lock has at least n confirmations, etc.) and sign it. -If enough signatures can be collected, the withdrawal transaction is valid and broadcast to the bitcoin network. - -The federation has to pay the transaction fees, so there are several ways for users to donate, like creating OP_RETURN outputs on the sidechain or sending coins directly to the federation's address (instead of P2C). - - -### Conclusion -Alpha's peg mechanism allows to freely transfer coins between Bitcoin and federated sidechains. Main chain locks are controlled by a federation whereas sidechain locks are secured by main chain consensus ("asymmetric peg") and sidechain consensus. - -The new opcodes OP_WPV and OP_RPV can be easily adapted to allow a symmetric peg instead of requiring full validation of the main chain and additionally to support PoW as the sidechain consensus algorithm. -This capability and the fundamental design decision to follow the 'Zen of Bitcoin' by avoiding non-local state in the script interpreter opens the door to soft-forking the peg mechanism into Bitcoin itself. diff --git a/source/case-studies/gem.md b/source/case-studies/gem.md index 459578f..e69de29 100644 --- a/source/case-studies/gem.md +++ b/source/case-studies/gem.md @@ -1,23 +0,0 @@ ---- -title: Gem's Use of Elements & Sidechains -description: Learn about how Gem is using Elements in their sidechain implementation. -source: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/case-studies/gem.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/case-studies/gem.md ---- - - -
-
-
- Matt Smith - -
-

Our interest is mostly in the asset issuance implementation I've been discussing with Jorge. We're currently prototyping blockchain-based systems that track ownership of arbitrary asset classes. While we're also working with other technologies that apply asset issuance as a protocol on top of a blockchain network like OpenAssets, there are features required for some applications that we can only get out of native, consensus-enforced asset management.

- -

Additionally, we use Confidential Transactions for (among other things) implementing a subset of the access controls in those systems, and having a working implementation of CT (which is compatible with asset management) is an huge boon.

- -

Finally, we're exploring use of the two-way peg itself, demonstrated by Alpha, to build interoperability into these systems from the beginning. Cross-organizational compatibility of asset tracking systems comes for free as long as those systems are build on a chain with a sufficiently expressive scripting language and that's a big win.

-
-
-
-
diff --git a/source/case-studies/index.md b/source/case-studies/index.md index 19cbed1..a965834 100644 --- a/source/case-studies/index.md +++ b/source/case-studies/index.md @@ -1,35 +1,7 @@ --- title: Who is using Elements? description: Case studies of Elements Project users and deployments. -source: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/case-studies/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/case-studies/index.md --- - -### Gem -
- -
-
-
-
- Matt Smith - -
-

We use Confidential Transactions for (among other things) - implementing a subset of the access controls in those systems, and - having a working implementation of CT (which is compatible with asset - management) is an huge boon.

-
-
-
-
-
-
- -Learn about Gem's Use Case - -
- ### Liquid, by Blockstream Blockstream has used several Elements, including [Confidential Transactions](/elements/confidential-transactions) and [Segregated Witness](/elements/segregated-witness), to construct the first commercial sidechain. The Liquid sidechain offers rapid transfer and settlement between Bitcoin exchanges, bypassing the 10 minute confirmation limit imposed by the Bitcoin blockchain. diff --git a/source/contributing/index.md b/source/contributing/index.md index 89b76bd..426a585 100644 --- a/source/contributing/index.md +++ b/source/contributing/index.md @@ -1,28 +1,48 @@ --- -title: Get Involved. -subtitle: Contributing to the Elements Project -source: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/contributing/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/contributing/index.md +title: Get Involved --- - -
+## Contributing to the Elements Project +

Join the Community.

-

Our public Slack is the fastest way to get connected with the Elements Project community. We'll send an invitation to your email address.

+

Our public Slack is the fastest way to get connected with other contributors to the Elements Project. We'll send an invitation to your email address.

Get an Invite -
-Most technical discussion takes place in [#sidechains-dev on Freenode](http://webchat.freenode.net/?channels=%23sidechains-dev). For other discussions, including ideas and even meetups, the Slack community has several rooms dedicated to these items. There is also the #irc room, which bridges input directly from the channel on Freenode. - -Other resources are listed below. - #### Source Code * https://github.com/ElementsProject/elements - contains isolated feature and dev sidechains braches * [branch alpha](https://github.com/ElementsProject/bitcoin/tree/alpha) - testnet dev sidechain demo #### Development Discussion -* Slack Community: [sidechains.slack.com](https://sidechains.slack.com) * Development Discussion List: [sidechains-dev list](https://lists.linuxfoundation.org/mailman/listinfo/sidechains-dev) * Freenode IRC: #sidechains-dev [[webchat](http://webchat.freenode.net/?channels=%23sidechains-dev)] * Bug Reports: Please submit issues to [github](https://github.com/ElementsProject/elements/issues). * Pull Requests: Please submit pull requests to [github](https://github.com/ElementsProject/elements/pulls). + + +#### Build Instructions +``` +# https://github.com/bitcoin/bitcoin/tree/master/doc +# Please refer to the Bitcoin documentation to install the required build dependencies/ +git clone https://github.com/ElementsProject/elements +cd elements +git checkout alpha +./autogen.sh +./configure +make +# If your build was successful, you will find src/alphad, src/alpha-cli and src/qt/alpha-qt + +``` + +The Data Directory of the alpha testnet dev sidechain lives within your existing Bitcoin [Data Directory](https://en.bitcoin.it/wiki/Data_directory). For example, in Linux `~/.bitcoin/alphatestnet3` contains the Alpha blocks, indicies and wallet. + +#### Moving coins between Testnet and Alpha +See [alpha-README.md](https://github.com/ElementsProject/elements/blob/alpha/alpha-README.md) for instructions on how to transfer testnet coins to the alpha network and back. Note that there is a lengthy confirmation and contest period that you must wait for a peg transfer to complete. + +* [testnet-faucet](https://testnet-faucet.elementsproject.org/) +* [alpha-faucet](https://alpha-faucet.elementsproject.org/) + +For your convenience, these faucets allow you to quickly obtain coins on either the testnet or alpha network without the lengthy wait for the confirmation and contest safety periods. + +# FAQ +* **Is this an altcoin?** No. The key thing to understand about sidechains is value is transferred to/from the main chain. No new coins are created and the total money supply remains constant. +* ADDME diff --git a/source/elements/asset-issuance/confidential-assets.md b/source/elements/asset-issuance/confidential-assets.md deleted file mode 100644 index 1a400c4..0000000 --- a/source/elements/asset-issuance/confidential-assets.md +++ /dev/null @@ -1,180 +0,0 @@ ---- -title: Confidential Assets -description: Extend security to multiple asset types while obscuring which ones are in use in specific transactions. ---- - -## Summary - -*Principal Investigator: Andrew Poelstra* - -The security of any blockchain ledger comes down to public verifiability of -two properties of every transaction: that they are authorized by all required -parties, and that they do not affect the total currency supply. In Bitcoin, -the latter property is so simple to check that it often goes unremarked: add -up the total output amount and total input amount and compare them. With the -development of [Confidential Transactions (CT)](/confidential-transactions/), -however, this security property is front and center, as it must be preserved -despite all amounts being cryptographically blinded. - -Several blockchain technologies have gone beyond Bitcoin to support multiple -asset types on the same chain. This allows a wider set of users to share the -security properties of the same chain, and also enables new use cases, such -as multi-asset transactions which effect atomic exchanges. Enabling this is -as simple as labelling each transaction output with a publicly visible "asset -tag"; however, this would expose information about users' financial behavior, -undermining the privacy benefits of CT. **Confidential Assets (CA)** is a -technology to support for multiple asset types while blinding all asset tags, -preserving the privacy of CT while extending the power and expressibility of -blockchain transactions. - -As in CT, Confidential Assets allows anybody to cryptographically verify that -a transaction is secure: the transaction is authorized by all required parties -and no asset is created, destroyed or transmuted. However, only the -participants in the transaction are able to see which asset types were used -and in what amounts. - -In a multi-asset chain, it may make sense in some contexts for assets of a -specific type to be created or destroyed. This is accomplished by means of -*issuance transactions*, which create new asset tags and a specified amount -of this asset. Later reissuance or deissuance may be done by proving ownership -of *issuance tokens*, which are related (but distinct) assets. Issuance tokens -may be created alongside a given asset type, or not, if the asset should not -support reissuance. - -Issuance transactions are unique in that they are not required to balance to -zero. However, if they issue a public amount, it is still verifiable that -exactly this amount, no more and no less, was actually issued. - -## Technology Behind Confidential Assets - -### Asset Tags and Rangeproofs - -To describe the technology behind CA, we start with the (Pedersen commitments -that [form the basis of Confidential Transactions](/confidential-transactions/): -``` -commitment = xG + aH -``` -where `G` is a standard generator of an elliptic curve and `H` is a second -generator for which nobody knows the discrete log with respect to `G`. We call -such a generator nothing-up-my-sleeve, or NUMS. - -In CT, this was described as committing to `a` coins with a blinding factor of -`x`. We observe that if we refer to the generator `H` as a coin we can read the -term `aH` algebraically as "`a` coins". When `H` is our only generator this is -merely a semantic trick. But suppose we add another NUMS generator `I`, and -consider the two commitments -``` -commitment_1 = xG + aH -commitment_2 = xG + aI -``` -Now we can think of `H` and `I` as representing two distinct assets, and we see -that these two commitments, while committing to the same amount, are commitments -to different assets. - -Consider now a complete transaction with two inputs of distinct asset types -and two outputs, like so - -``` -in1 = xG + aH, H --\ /-- uG + cH, H = out1 - |---| -in2 = yG + bI, I --/ \-- vG + dI, I = out2 -``` -In CT, where we had only one generator, we required the equation -``` -out1 + out2 - in1 - in1 = 0 -``` -to hold, which it would if and only if the transaction balanced. As it turns -out, this same equation works even with multiple assets: -``` -0 = out1 + out2 - in1 - in1 - = (uG + cH) + (vG + dI) - (xG + aH) - (yG + bI) - = (u + v - x - y)G + (c - a)H + (d - b)I -``` -Since `H` and `I` are both NUMS points, the only way for this equation to hold -is if each individual term is 0, and in particular, if `c = a` and `b = d`. In -other words, this equation holds only if the total amount of asset `H` is the -same on the input side as on the output side **and** the total amount of asset -`I` is the same on the input and output side. - -This extends naturally to more than two asset tags; in fact, it is possible to -support an unlimited number of distinct asset types, as long as each one can -be assigned a unique NUMS generator. - -As in CT, this simple equation is insufficient because it is possible for amounts -to overflow, effectively allowing negative-valued outputs. As in CT, this can be -solved by attaching a rangeproof to each output, in exactly the same way. The only -difference is that the verifier must use the appropriate asset tag in place of -the fixed generator `H`. - -### Blinded Asset Tags and Asset Surjection Proofs - -The above discussion assumed every transaction output had a NUMS generator, or -asset tag, associated to it, and that outputs of the same asset type would use -the same tag. This does not satisfy our privacy goals because it is visible -what type of asset every output represents. - -This can be solved by replacing each asset tag with a _blinded asset tag_ of -the form -``` -A = H + rG -``` -Here `H` is an asset tag from above and `r` is a secret random value. Anybody -who knows `r` can tell what asset this tag represents, but to anyone else it -will appear to be a uniformly random elliptic curve point. We see that any -commitment to a value with `A` is also a commitment to the same value with -`H`, so our "outputs minus inputs equals zero" rule will continue to work -when validating transactions: -``` -commitment_A = xG + aA = xG + a(H + rG) = (x + ra)G + aH = commitment_H -``` -The introduction of this blinding factor does not affect the user's ability -to produce a rangeproof, though it does make the algebra slightly more -complicated when constructing the transaction to balance out to zero. - -However, since every blinded asset tag looks uniformly random, how can -verifiers be sure that the underlying asset tags are legitimate? It turns -out that the "sum to zero" rule is not sufficient to prevent abuse. For -example, consider the "blinded asset tag" -``` -A' = -H + rG -``` -Any amount of the blinded asset `A'` will actually correspond to a _negative_ -amount of asset `H`, which an attacker could use to offset an illegal -increase of the money supply. - -To solve this problem we introduce an _asset surjection proof_, which is a -cryptographic proof that within a transaction, every output asset type is -the same as some input asset type, while blinding which outputs correspond -to which inputs. - -The way this works is simple. If `A` and `B` are blinded asset tags which -commit to the same asset tag `H`, say, then -``` -A - B = (H + aG) - (H + bG) = (a - b)G -``` -will be a signature key with corresponding secret key `a - b`. So for a -transaction output `out1`, we can use a ring signature (proof that one of -several secret keys is known that keeps secret which one) with the keys -`out1 - in1`, `out1 - in2`, and so on for every input in the transaction. -If `out1` has the same asset tag as one of the inputs, the transaction -signer will know the secret key corresponding to one of these differences, -and be able to produce the ring signature. - -The asset surjection proof consists of this ring signature. - -### Future Work - -Because algebraically, Confidential Assets is such a straightforward -extension of Confidential Transactions, many of the tools developed for -use with CT can be used with few modifications with CA, giving them the -power to confidently and confidentially handle multi-asset transactions. -Examples of such technologies are - -- ValueShuffle (add link, also check with Tim if the name has changed) -- [MimbleWimble](http://diyhpl.us/~bryan/papers2/bitcoin/mimblewimble.txt) -- [Scriptless Scripts](https://download.wpsoftware.net/bitcoin/wizardry/mw-slides/2017-03-mit-bitcoin-expo/slides.pdf) - -We are looking forward to the future, as many exciting developments -continue to appear. - - diff --git a/source/elements/asset-issuance/index.md b/source/elements/asset-issuance/index.md index 6028064..6cd44f7 100644 --- a/source/elements/asset-issuance/index.md +++ b/source/elements/asset-issuance/index.md @@ -1,99 +1,21 @@ ---- -title: Asset Issuance -description: Create new assets on a sidechain, with optional confidentiality. -image: /img/asset-issuance.svg -branch: elements-0.14.1 -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/asset-issuance/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/asset-issuance/index.md ---- +#### Basic Asset Issuance +*Principal Investigator: Jorge Timón* + * [feature branch multi-asset-0.10](https://github.com/ElementsProject/elements/tree/multi-asset-0.10) - branch of ongoing assets dev -
-

Want the cryptographic breakdown?

-

Read Andrew Poelstra's deep dive on Confidential Assets.

-
+Users can issue their own assets which represent fungible ownership of the underlying asset type representing by the newly created units, which could theoretically represent any asset including vouchers, coupons, currencies, deposits, bonds, shares, etc (subject to the respective jurisdiction’s regulatory requirements. -Users can issue their own confidential assets which represent fungible ownership -of the underlying asset type representing by the newly created units, which -could theoretically represent any asset including vouchers, coupons, currencies, -deposits, bonds, shares, etc. (subject to the respective jurisdiction’s -regulatory requirements). +This opens the door for building trustless exchanges, options, and other advanced smart contracts involving those arbitrary assets and the “hostcoin” (a native asset whose ID is equal to the hash of the genesis block or chain ID; in Alpha’s case, it is the federated-peg coin which is backed by testnet coins, see “Deterministic peg” section). -These assets can optionally be "blinded", causing the data in the transactions -(including amount and asset type) to be cryptographically obfuscated in such a -way that only the participating parties can see. Participants may choose to -reveal a "blinding key", which grants visibility into the transaction. +All outputs are tagged with their asset identifier. Consensus rules are modified so that the total inputs and outputs are checked separately per asset. +A new transaction type is added for creating issued assets (asset definition transactions). Like coinbase transactions, asset definition transactions (the new transaction type) have a null input, but unlike coinbases, asset definition transactions have more inputs in addition to that first null input. This difference not only helps us distinguish between the two: it also guarantees a source of entropy for the asset id (which is the sha256d hash of the transaction). Within an asset definition transaction, any number of outputs with 0 as asset ID can be included with any amount and they will be treated as the initial unspent outputs for the newly created asset. -This opens the door for building trustless exchanges, options, and other -advanced smart contracts involving those arbitrary assets and a "hostcoin". - -### Issuing Assets -Use the all-new `issueasset` RPC command. Here, we're issuing 1000 new tokens, -and creating 200 "reissuance" tokens. -``` -$ elements-cli issueasset 1000 200 -> { - "txid": "13a2357b0a51114fae92127f7afc74847acf07f87e1bb4849715d1c75dbc9a92", - "vin": "0", - "entropy": "4dcc890a6fc4f593c609ffaa295940acb244904c1439aa9cb9d8192440b41da4", - "asset": "8854427e5ffcb0b837e85832b901b1135cc4ac766f537e2a7f07b71a76c5b9cf", - "token": "ca270d5552e81d15e4f45e41ff2d9c7e456599a7678286b80f8b41cae179b26a" -} -``` - -You can add convenient names for these assets by passing `-assetdir` to Elements -Core, which accepts a `hexidstring:label` map of the assets to their labels. - -#### Re-issuance -Re-issuing an asset is effectively a provable inflation in the asset type. To -do this, use `reissueasset`. Let's issue 20 of our tokens: - -``` -elements-cli reissueasset 8854427e5ffcb0b837e85832b901b1135cc4ac766f537e2a7f07b71a76c5b9cf 20 -{ - "txid": "6b20c853521346d5bda3fe9e006292260cf409054224f920f3abf6297aca8176", - "vin": 1 -} - -$ elements-cli getwalletinfo -> { - "walletversion": 130000, - "balance": { - "funcoin": 1020.00000000 - }, - "unconfirmed_balance": { - }, - "immature_balance": { - }, - "txcount": 1117, - "keypoololdest": 1490389457, - "keypoolsize": 100, - "paytxfee": 0.00000000, - "hdmasterkeyid": "f5ff0a90ac04830fde2f952cae9e076f9c2b4d39" -} -``` - -### How it works -All outputs are tagged with an asset commitment. Like CT, the consensus rules -are such that instead of checking that amounts are balanced, the value -commitments are checked for balance. A new transaction type is added for -creating issued assets (asset definition transactions). Asset definition -transactions have explicit `assetIssuance` fields embedded within transaction -inputs, up to one issuance per input, which denote the issuance of both the -asset itself and the reissuance tokens if desired. Embedding issuances within an -input allows us to re-use the entropy as a NUMS for the asset type itself. - -This technology is similar to colored coins in many ways, but explicit and -consensus-enforced tagging has many advantages: +This technology is similar to colored coins in many ways, but explicit and consensus-enforced tagging has many advantages: * Supports SPV wallets much more efficiently. * Allows more complex consensus-enforced contracts. * Benefits from other consensus-enforced extensions (ie confidential transactions would not be compatible with colored coins on top of Alpha). * Opens the door for further consensus-enforced extensions that rely on the chain being able to operate with multiple assets. -Currently only the hostcoin can be used to pay fees, but it should be possible -to pay fees of different asset types simultaneously. - - +Currently only the hostcoin can be used to pay fees, but it should be possible to pay fees of different asset types simultaneously. +In this first version all units of a given type must be issued within the asset definition transaction. In future versions it will be possible to define assets with a dynamic supply that can be increased after the definition, allowing the issuer to create new units. +Future versions can also implement consensus enforced interest that would be interesting for p2p lending and issuance of assets with built-in demurrage (negative interest) among other things. diff --git a/source/elements/asset-issuance/investigation.md b/source/elements/asset-issuance/investigation.md deleted file mode 100644 index e14eb32..0000000 --- a/source/elements/asset-issuance/investigation.md +++ /dev/null @@ -1,20 +0,0 @@ -*Principal Investigator: Jorge Timón* - * [alpha-0.10-multi-asset](https://github.com/ElementsProject/elements/tree/alpha-0.10-multi-asset) - branch of ongoing assets dev - -Users can issue their own assets which represent fungible ownership of the underlying asset type representing by the newly created units, which could theoretically represent any asset including vouchers, coupons, currencies, deposits, bonds, shares, etc (subject to the respective jurisdiction’s regulatory requirements. - -This opens the door for building trustless exchanges, options, and other advanced smart contracts involving those arbitrary assets and the “hostcoin” (a native asset whose ID is equal to the hash of the genesis block or chain ID; in Alpha’s case, it is the federated-peg coin which is backed by testnet coins, see “Deterministic peg” section). - -All outputs are tagged with their asset identifier. Consensus rules are modified so that the total inputs and outputs are checked separately per asset. -A new transaction type is added for creating issued assets (asset definition transactions). Like coinbase transactions, asset definition transactions (the new transaction type) have a null input, but unlike coinbases, asset definition transactions have more inputs in addition to that first null input. This difference not only helps us distinguish between the two: it also guarantees a source of entropy for the asset id (which is the sha256d hash of the transaction). Within an asset definition transaction, any number of outputs with 0 as asset ID can be included with any amount and they will be treated as the initial unspent outputs for the newly created asset. - -This technology is similar to colored coins in many ways, but explicit and consensus-enforced tagging has many advantages: - -* Supports SPV wallets much more efficiently. -* Allows more complex consensus-enforced contracts. -* Benefits from other consensus-enforced extensions (ie confidential transactions would not be compatible with colored coins on top of Alpha). -* Opens the door for further consensus-enforced extensions that rely on the chain being able to operate with multiple assets. - -Currently only the hostcoin can be used to pay fees, but it should be possible to pay fees of different asset types simultaneously. -In this first version all units of a given type must be issued within the asset definition transaction. In future versions it will be possible to define assets with a dynamic supply that can be increased after the definition, allowing the issuer to create new units. -Future versions can also implement consensus enforced interest that would be interesting for p2p lending and issuance of assets with built-in demurrage (negative interest) among other things. \ No newline at end of file diff --git a/source/elements/bitmask-sighash-modes/index.md b/source/elements/bitmask-sighash-modes/index.md index 03f0b24..d859e02 100644 --- a/source/elements/bitmask-sighash-modes/index.md +++ b/source/elements/bitmask-sighash-modes/index.md @@ -1,11 +1,4 @@ ---- -title: Bitmask Sighash Modes -description: Allow arbitrary, miner-rewritable bitmasks of transaction inputs and outputs. -image: /img/bitmask-sighash-modes.svg -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/bitmask-sighash-modes/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/bitmask-sighash-modes/index.md ---- - +#### Bitmask Sighash Modes *Principal Investigator: Glenn Willen* * [feature-bitmasksighash](https://github.com/ElementsProject/elements/tree/feature_bitmasksighash) - EXAMPLE branch of Bitmask Sighash modes diff --git a/source/elements/confidential-transactions/addresses.md b/source/elements/confidential-transactions/addresses.md index 88711f6..3a8b8d9 100644 --- a/source/elements/confidential-transactions/addresses.md +++ b/source/elements/confidential-transactions/addresses.md @@ -2,53 +2,5 @@ title: Confidential Addresses --- -The most visible implication of Confidential Transactions is the introduction of -a new default address type, confidential addresses: -``` -CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi -``` - -The most obvious differences are that it starts with ``CT`` and is longer than -usual. This is due to the inclusion of a public blinding key prepended to the -base address. In the Elements Wallet, the blinding key is derived by using the -wallet's master blinding key and unblinded P2PKH address. Therefore the receiver -alone can decrypt the sent amount, and can hand it to auditors if needed. On the -sender's side, ``sendtoaddress`` will use this pubkey to transmit the necessary -info to the receiver, encrypted, and inside the transaction itself. The sender's -wallet will also record the amount and hold this in the ``wallet.dat`` metadata -as well as the ``audit.log`` file. - -``` -$ elements-cli validateaddress CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi -> { - "isvalid": true, - "address": "CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi", - "scriptPubKey": "76a91448a67bbdaf57b6f55b50f02fcaacfa079900853588ac", - "confidential_key": "02483237addc73befdb9b851f948c1488cbb7cf1a59ba8af36be1c479e0f6e8bc7", - "unconfidential": "QTE8CaT6FcJEqkCR4ZGdoUJfas57eDqY6q", - "ismine": true, - "iswatchonly": false, - "isscript": false, - "pubkey": "0347b013d415f7dc964cfadd0bb0627c48ae6ae27a58cdd37d71990eaf8f38c60c", - "iscompressed": true, - "account": "" -} -``` - -As you can see the unconfidential P2PKH address starts with a `Q`. P2SH start -with `H`. Most RPC calls outside of ``getnewaddress`` (e.g., ``listunspent``) -will return the unblinded version of addresses. If you provide an unconfidential -address to ``validateaddress`` it will show the confidential address. - -You **must** use the confidential address in ``sendtoaddress``, ``sendfrom``, -``sendmany`` and ``createrawtransaction`` if you want to create confidential -transactions. Therefore, when you want to receive confidential transactions you -must give the *confidential* address to the sender. For all other RPC's except -``dumpblindingkey`` it does not matter whether the confidential or -unconfidential address is provided. - -
-

Did you know?

-

By sharing the blinding key used in the construction of a single confidential transaction, users can share access to the transaction's details. Read more about selective disclosure »

-
\ No newline at end of file +TODO: explain them. diff --git a/source/elements/confidential-transactions/index.md b/source/elements/confidential-transactions/index.md index eee10cd..b40467f 100644 --- a/source/elements/confidential-transactions/index.md +++ b/source/elements/confidential-transactions/index.md @@ -1,14 +1,12 @@ --- title: Confidential Transactions -description: Preserve security while simultaneously obscuring transaction values. -image: /img/confidential-transactions.svg -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/confidential-transactions/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/confidential-transactions/index.md +description: Obscure the transaction value using the Confidential Transactions Element. +source: https://github.com/ElementsProject/elementsproject.github.io/blob/hexo/source/elements/confidential-transactions/index.md +edit: https://github.com/ElementsProject/elementsproject.github.io/edit/hexo/source/elements/confidential-transactions/index.md --- - One of the most powerful new features being explored in Elements is Confidential -Transactions. This keeps the amounts transferred visible only to participants -in the transaction (and those they designate), while still guaranteeing that no +Transactions. This keeps the amounts transferred visible only to participants in +the transaction (and those they designate), while still guaranteeing that no more coins can be spent than are available in a cryptographic way. This goes a step beyond the usual privacy offered by Bitcoin's blockchain, which @@ -19,93 +17,344 @@ protection, thieves and scammers can focus their efforts on known high-value targets, competitors can learn business details, and negotiating positions can be undermined. -Watch Blockstream CTO Gregory Maxwell explaining Confidential Transactions at Coinbase: - -
- -Read on to see how Confidential Transactions can be used, or jump straight to the math. - -
-

Did you know?

-

By sharing the blinding key used in the construction of a single confidential transaction, users can share access to the transaction's details. Read more about selective disclosure »

-
- -### Using Confidential Transactions -The payment flow when using the Confidential Transactions Element is nearly -identical to Bitcoin Core on the surface: - -``` -$ elements-cli getnewaddress -> CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi - -$ elements-cli sendtoaddress CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi 0.005 -> 82b2c5122207e5f33e7adadc6a4aab16a170e16028f0b0cf2c04f9d17d6f0321 -// ^ this is the transaction id -``` - -The key difference from Bitcoin is the addition of cryptographic privacy. These -transactions differ in that the the amounts transferred are kept visible only to -participants in the transaction (and those they designate). - -
- -
-

Confidential Addresses

-

Confidential Addresses may be new to you. Learn about Confidential Addresses »

-
-
- -The ``createrawtransaction`` API in Elements works similar to Bitcoin's raw -transactions with the following differences: - -1. The intent to create a confidential output is indicated by using a confidential address for the destination. -2. The ``createrawtransaction`` RPC has the additional key ``nValue`` per input which must be set to the value of the input. The value can be determined for example with the ``listunspent`` RPC. -3. After calling ``createrawtransaction`` the user must call ``blindrawtransaction`` on the transaction if a confidential input or output address is involved. -4. If at least one of the inputs is confidential, at least one of the outputs must be confidential. Note that it is perfectly fine to create a 0-valued confidential output if otherwise there would be no confidential output. -5. If all inputs are unconfidential, the number of confidential outputs must be ``0`` or ``>= 2``. Again, it's fine to create a 0-valued confidential output. - -The following example spends a confidential and an unconfidential output and -creates a confidential and unconfidential output. Due to the size of the -transaction it is not displayed here but saved in the variable ``TX`` - -``` -TX=`elements-cli createrawtransaction '[{"txid": "421079661b117b659af3431096ce2118043396e3647e523e413cd626fa798df7", "vout": 0, "nValue": 0.001}, {"txid": "17aa26d29582a9a26f02033918aaf9823d33458239074a0d7ee638b247f1fa2c", "vout": 0, "nValue": 0.001}]' '{"XoRDiv9z12ECsYCNjtHjDvV1Nn4KSBa6xRfHT1c3nKY1CwDiz5rzSMZL7QCgvuF1T5Kq43o1fMqBxbWQ": 0.001, "QLsHc5DgnpMjPaDSuEF5gXt7ccgmLtgh2N": 0.0005}'` -TX=`elements-cli blindrawtransaction $TX` -TX=`elements-cli signrawtransaction $TX | jq -r '.hex'` -elements-cli sendrawtransaction $TX -``` - -### Limitations -The implementation of Confidential Transactions as it appears in Elements has -some important limitations to be aware of. - -For example, the implementation only hides a certain number of the digits of the -amount of each transaction output, dependent on the range proof's "blinding -coverage" at a desired precision level. Subsequently, there is a 'minimum -confidential amount' that around 0.0001 BTC, and a 'maximum confidential amount' -that is 232 times the minimum amount. - -Digits smaller than the minimum will be revealed to observers; for example, if -the minimum is 0.0001 BTC, a transaction output of 123.456789 BTC will look like -"?.????89 BTC". The tiny amount of information about the value leaked in this -way is unlikely to be important, but be aware that this could allow observers to -'follow' coins by linking subsequent transactions with identical amounts. All -values can be rounded to the minimum to avoid revealing information in this way -if preferred. - -A transaction output larger than the maximum will reveal the order of magnitude -of the amount to observers, _and_ will reveal additional digits at the bottom of -the amount. - -For example, if the maximum is 500k BTC, then all outputs under -that amount will look the same, but an output between 500k and 5M BTC will be -visible as such to observers (but not the exact amount within that range), and -will also reveal one additional digit of the low end of the amount. Revealing -the range in this way could be a very significant privacy leak; splitting such -extremely large transactions to keep them under the maximum confidential amount -is strongly recommended. - -
-

Want to learn more?

-

Gregory Maxwell's original investigation into Confidential Transactions has the mathy details!

-
+The most visible implication of Confidential Transactions is the introduction of +a new address type, [confidential +addresses](/confidential-transactions/addresses). These are longer than usual as +they also includes a blinding key for the values. Several sidechains, including +[alpha](/sidechains/alpha), use this address type as the default. + +### Designated Access +By sharing the blinding key used in the construction of a single confidential +transaction, users can share access to the details of an individual transaction. + +--- + +### Investigation +Principal Investigator: [Gregory Maxwell](/contributors/gmaxwell) +The security of the Bitcoin ledger is made possible by universal verification: +each participant individually and autonomously verifies that each transaction is +valid, without trusting any third party. An unfortunate side effect is that all +the transaction data must be conspicuously public so it can be verified, which +is at odds with the normal expectation of privacy for traditional monetary +instruments. + +Insufficient financial privacy can have serious security and privacy +implications for both commercial and personal transactions. Without adequate +protection, thieves and scammers can focus their efforts on known high-value +targets, competitors can learn business details, and negotiating positions can +be undermined. Since publishing often requires spending money, lack of privacy +can chill free speech. Insufficient privacy can also result in a loss of +fungibility--where some coins are treated as more acceptable than others--which +would further undermine Bitcoin's utility as money. + +Bitcoin partially addresses the privacy problem by using pseudonymous +addresses. If someone does not know which users own which addresses, +the privacy impact is reduced. But any time you transact with someone +you learn at least one of their addresses. From there, you can trace out +other connected addresses and estimate the values of their transactions +and holdings. For example, suppose your employer pays you with Bitcoin +and you later spend those coins on your rent and groceries. Your landlord +and the supermarket will both learn your income, and could charge you +higher prices as your income changes or target you for theft. + +There are existing deployed techniques that further improve privacy +in Bitcoin (such as CoinJoin, which merges the transaction history of +users by making joint payments), but the utility of these techniques is +reduced by the fact that it's possible to track amounts. + +There have been proposed cryptographic techniques to improve privacy +in Bitcoin-like systems, but so far all of them result in breaking +"pruning" (section 7 of Bitcoin.pdf) and result in participants +needing a perpetually growing database to verify new transactions, +because these systems prevent learning which coins have been spent. Most +proposed cryptographic privacy systems also have poor performance, high +overhead, and/or require new and very strong (and less well understood) +cryptographic assumptions. + +Confidential Transactions improves the situation by making the transaction +amounts private, while preserving the ability of the public network +to verify that the ledger entries still add up. It does this without +adding any new basic cryptographic assumptions to the Bitcoin system, +and with a manageable level of overhead. + +CT is possible due to the cryptographic technique of additively +homomorphic commitments. As a side-effect of its design, CT also enables +the additional exchange of private "memo" data (such as invoice numbers +or refund addresses) without any further increase in transaction size, +by reclaiming most of the overhead of the CT cryptographic proofs. + + +## The technology behind Confidential Transactions: A high level technical primer + + +This work was originally proposed by Adam Back on +Bitcointalk in his 2013 thread "bitcoins with homomorphic value" +[https://bitcointalk.org/index.php?topic=305791.0]. To build CT I had to +implement several new cryptosystems which work in concert, and invented +a generalization of ring signatures and several novel optimizations to +make the result reasonably efficient. + +The basic tool that CT is based on is a Pedersen commitment. + +A commitment scheme lets you keep a piece of data secret but commit to +it so that you cannot change it later. A simple commitment scheme can +be constructed using a cryptographic hash: + + commitment = SHA256( blinding_factor || data ) + +If you tell someone only the commitment then they cannot determine +what data you are committing to (given certain assumptions about the +properties of the hash), but you can later reveal both the data and the +blinding factor and they can run the hash and verify that the data you +committed to matches. The blinding factor is present because without one, +someone could try guessing at the data; if your data is small and simple, +it might be easy to just guess it and compare the guess to the commitment. + +A Pedersen commitment works like the above but with an additional +property: commitments can be added, and the sum of a set of commitments +is the same as a commitment to the sum of the data (with a blinding key +set as the sum of the blinding keys): + + C(BF1, data1) + C(BF2, data2) == C(BF1 + BF2, data1 + data2) C(BF1, + data1) - C(BF1, data1) == 0 + +In other words, the commitment preserves addition and the commutative +property applies. + +If data_n = {1,1,2} and BF_n = {5,10,15} then: + + C(BF1, data1) + C(BF2, data2) - C(BF3, data3) == 0 + +and so on. + +Our specific Pedersen commitments are constructed using elliptic curve +points. [The reader need not understand elliptic curve cryptography, +beyond accepting the black box behaviors I describe here.] + +Normally an ECC pubkey is created by multiplying a generator for the group +(G) with the secret key (x): + Pub = xG + +The result is usually serialized as a 33-byte array. + +ECC public keys obey the additively homomorphic property mentioned before: + + Pub1 + Pub2 = (x1 + x2 (mod n))G. + +(This fact is used by the BIP32 HD wallet scheme to allow third parties +to generate fresh Bitcoin addresses for people.) + +The Pedersen commitment is created by picking an additional generator +for the group (which we'll call H) such that no one knows the discrete +log for H with respect to G (or vice versa), meaning no one knows an +x such that xG = H. We can accomplish this by using the cryptographic +hash of G to pick H: + + H = to_point(SHA256(ENCODE(G))) + +Given our two generators we can build a commitment scheme like this: + + commitment = xG + aH + +Here x is our secret blinding factor, and a is the amount that we're +committing to. You can verify just using the commutative property of +addition that all the relationships given for an additively homomorphic +commitment scheme hold. + +The Pedersen commitments are information-theoretically private: for any +commitment you see, there exists some blinding factor which would make +any amount match the commitment. Even an attacker with infinite computing +power could not tell what amount you committed to, if your blinding factor +was truly random. They are computationally secure against fake commitment, +in that you can't actually compute that arbitrary mapping; if you can +it means you can find the discrete log of the generators with respect +to each other, which means that the security of the group is compromised. + +With this tool in hand we can go and replace the normal 8-byte integer +amounts in Bitcoin transactions with 33-byte Pedersen commitments. + +If the author of a transaction takes care in picking their blinding +factors so that they add up correctly, then the network can still verify +the transaction by checking that its commitments add up to zero: + + (In1 + In2 + In3 + plaintext_input_amount*H...) - + (Out1 + Out2 + Out3 + ... fees*H) == 0. + +This requires making the fees in a transaction explicit, but that's +generally desirable. + +The commitment and its checking are quite simple. Unfortunately, without +additional measures this scheme is insecure. + +The problem is that the group is cyclic, and addition is mod P (a 256-bit +prime number that defines the order of the group). As a result, addition +of large values can 'overflow' and behave like negative amounts. This +means that a sums-to-zero behavior still holds when some outputs are +negative, effectively allowing the creation of 5 coins from nothing: + + (1 + 1) - (-5 + 7) == 0 + +This would be interpreted as "someone spends two bitcoins, gets a '-5' +bitcoin out that they discard out, and a 7 bitcoin output". + +In order to prevent this, when there are multiple outputs we must prove +that each committed output is within a range which cannot overflow +(e.g. [0, 2^64)). + +We could just disclose the amounts and blinding factors so that the +network could check, but this would lose all of the privacy. So, +instead, we need to prove that a committed amount is within the range +but reveal nothing else about it: we need an additional cryptosystem +to prove the range of a Pedersen commitment. We use a scheme similar +to Schoenmakers' binary decomposition but with many optimizations +(including not using binary). + +To build this we start with a basic EC signature. If a signature is +constructed so that the 'message' is the hash of the pubkey, the signature +proves that the signer knew the private key, which is the discrete log +of the pubkey with respect to some generator. + +For a 'pubkey' like P = xG + aH, no one knows the discrete log of P +with respect to G because of the addition of H, because no one knows +an x for xG = H----_unless_ a is 0. If a is zero then P = xG and the +discrete log is just x; someone could sign for that pubkey. + +A pedersen commitment can be proven to be a commitment to a zero by +just signing a hash of the commitment with the commitment as the public +key. Using the public key in the signature is required to prevent setting +the signature to arbitrary values and solving for the commitment. The +private key used for the signature is just the blinding factor. + +Going further, let's say I want to prove C is a commitment to 1 without +telling you the blinding factor. All you do is compute + + C' = C - 1H + +and ask me to provide a signature (with respect to G) with pubkey C'. If +I can do that, the C must be a commitment to 1 (or else I've broken the +EC discrete log security). + +To avoid giving away the amount we need yet another cryptographic +construct: a ring signature. A ring signature is a signature scheme +where there are two (or more) pubkeys and the signature proves that the +signer knows the discrete log of at least one of the pubkeys. + +So with that we can construct a scheme where I prove a commitment that +C is either 0 or 1--we call this an "OR proof". + +First, I give you C, and you compute C': + + C' = C - 1H + +Then I provide a ring signature over {C, C'}. + +If C was a commitment to 1 then I do not know its discrete log, but +C' becomes a commitment to 0 and I do know its discrete log (just the +blinding factor). If C was a commitment to 0 I know its discrete log, +and I don't for C'. If it was a commitment to any other amount, none +of the result will be zero and I won't be able to sign. + +This works for any pair of numbers, just by suitably pre-processing the +amounts that are put into the ring... or even for more than two numbers. + +Say I want to prove to you that C is in the range [0, 32). Now that we +have an OR proof, imagine I send you a collection of commitments and OR +proofs for each of them: + +C1 is 0 or 1 C2 is 0 or 2 C3 is 0 or 4 C4 is 0 or 8 C5 is 0 or 16. + +If I pick the blinding factors for C1..5 correctly then I can arrange +it so that C1 + C2 + C3 + C4 + C5 == C. Effectively I have built up +the number in binary, and a 5-bit number can only be in the range [0,32). + +Numerous optimizations are required to make this more efficient: + +First, I propose a new ring +signature formulation, a Borromean ring signature[*], which is especially +efficient: it requires only 32 bytes per pubkey, plus 32 bytes which +can be shared by many separate rings. This is has twice the asymptotic +efficiency of previously proposed constructions for this application. + +[*] https://github.com/Blockstream/borromean_paper/raw/master/borromean_draft_0.01_34241bb.pdf + +Instead of expressing the amount directly, CT amounts are expressed +using a decimal floating point where the digits are multiplied by a +base 10 exponent. This means that you can prove large amounts with +small proofs, so long as they have few significant digits in base 10: +e.g., 11.2345 and .0112345 can have the same size proof, even though +one number is a thousand times larger. + +There is also a non-private "minimum amount" sent, which allows a smaller +proof to cover a larger range if the user doesn't mind leaking some +information about the minimum amount (which might already be public for +external reasons); this also allows the least significant digits to be +non-zero when an exponent is used. Minimum amounts are supported by first +subtracting the minimum, then proving that the result is non-negative. + +The mantissa of the floating point is encoded using rings of size 4 (base +4) rather than binary, because this minimizes the number of commitments +sent while not using any more signature data than base 2. + +The final mantissa digit commitment can be skipped, backwards constructing +it from the value being proven and the other digits, etc. + +Finally, by careful use of derandomized signing in the prover, it's +possible for the receiver of the coins--who shares a secret with the +sender, due to ECDH key agreement with the receivers pubkey--to 'rewind' +the proof and use it to extract a message sent by the sender which is 80% +of the size of the proof. We use this to signal the value and blinding +factor to the receiver, but it could also be used to carry things like +reference numbers or refund addresses. + +The result is that a proof for a 32-bit value is 2564 bytes, and +simultaneously may convey 2048 bytes of message. A 32-bit proof can +cover a range of 42.94967296 BTC with 1e-8 precision, or 429.4967296 +BTC with 1e-7 precision, and so on. My implementation is able to verify +over 1300 32-bit range proofs per second on an i7-4770R, and there are +many performance optimizations still possible. + +The implementation supports proofs of any mantissa size or exponent, with +the parameters controlled by the sender. Performance and size are linear +in the number of mantissa bits, and odd numbers of bits are supported +(by switching to radix-2 for the last digit). + +In Elements, the range proofs are only required in cases where there are +multiple confidential value outputs (including fees). Transactions that +merge multiple confidential amounts into a single output do not need range +proofs since the fact that all the inputs were in range is sufficient. + +By sharing the scanning key used to establish the shared secret used by +the rewindable range proofs, this approach is completely compatible with +watching wallets; users can share these keys with auditors to enable +them to view their transaction amounts. + +Future work may use the fact that proofs can support a minimum value to +also allow skipping the range proofs when there is a single confidential +output even when fees are being paid, or allow nodes to skip or delay +verifying most range proofs by using fraud proofs. + +The system presented here depends on no new fundamental cryptographic +assumptions, only the hardness of the discrete log problem in the +secp256k1 group and a random oracle assumption, just like the normal +signatures in Bitcoin. + +While the size of the range proofs are non-trivial, they are still an +order of magnitude smaller and faster to verify than some alternatives +(like Zerocoin), and most of their space can be reclaimed to communicate +additional data between users, a feature which is often requested but +hard to justify in a public broadcast network. Similar to signatures, +the range proofs can be placed on separate tree branches in blocks to +allow clients that don't care about (e.g. historical ones) to skip +receiving them. + +Most importantly, this scheme is compatible with pruning and does not make +the verification state for Bitcoin grow forever. It is also compatible +with CoinJoin and CoinSwap, allowing for transaction graph privacy as +well while simultaneously fixing the most severe limitation of these +approaches to privacy (that transaction amounts compromise their privacy). + +Unlike some other proposals, this system is not just speculation or pure +cryptography without integration with the Bitcoin system. + +Confidential Transactions is enabled in Elements and used by default by +all ordinary transactions. diff --git a/source/elements/confidential-transactions/investigation.md b/source/elements/confidential-transactions/investigation.md deleted file mode 100644 index 3824506..0000000 --- a/source/elements/confidential-transactions/investigation.md +++ /dev/null @@ -1,359 +0,0 @@ ---- -title: Confidential Transaction, the Initial Investigation ---- -### Investigation -Principal Investigator: [Gregory Maxwell](/contributors/gmaxwell) - -The security of the Bitcoin ledger is made possible by universal verification: -each participant individually and autonomously verifies that each transaction is -valid, without trusting any third party. An unfortunate side effect is that all -the transaction data must be conspicuously public so it can be verified, which -is at odds with the normal expectation of privacy for traditional monetary -instruments. - -Insufficient financial privacy can have serious security and privacy -implications for both commercial and personal transactions. Without adequate -protection, thieves and scammers can focus their efforts on known high-value -targets, competitors can learn business details, and negotiating positions can -be undermined. Since publishing often requires spending money, lack of privacy -can chill free speech. Insufficient privacy can also result in a loss of -fungibility--where some coins are treated as more acceptable than others--which -would further undermine Bitcoin's utility as money. - -Bitcoin partially addresses the privacy problem by using pseudonymous -addresses. If someone does not know which users own which addresses, -the privacy impact is reduced. But any time you transact with someone -you learn at least one of their addresses. From there, you can trace out -other connected addresses and estimate the values of their transactions -and holdings. For example, suppose your employer pays you with Bitcoin -and you later spend those coins on your rent and groceries. Your landlord -and the supermarket will both learn your income, and could charge you -higher prices as your income changes or target you for theft. - -There are existing deployed techniques that further improve privacy -in Bitcoin (such as CoinJoin, which merges the transaction history of -users by making joint payments), but the utility of these techniques is -reduced by the fact that it's possible to track amounts. - -There have been proposed cryptographic techniques to improve privacy -in Bitcoin-like systems, but so far all of them result in breaking -"pruning" (section 7 of Bitcoin.pdf) and result in participants -needing a perpetually growing database to verify new transactions, -because these systems prevent learning which coins have been spent. Most -proposed cryptographic privacy systems also have poor performance, high -overhead, and/or require new and very strong (and less well understood) -cryptographic assumptions. - -Confidential Transactions improves the situation by making the transaction -amounts private, while preserving the ability of the public network -to verify that the ledger entries still add up. It does this without -adding any new basic cryptographic assumptions to the Bitcoin system, -and with a manageable level of overhead. - -CT is possible due to the cryptographic technique of additively -homomorphic commitments. As a side-effect of its design, CT also enables -the additional exchange of private "memo" data (such as invoice numbers -or refund addresses) without any further increase in transaction size, -by reclaiming most of the overhead of the CT cryptographic proofs. - - -## The technology behind Confidential Transactions: A high level technical primer - - -This work was originally proposed by Adam Back on -Bitcointalk in his 2013 thread "[bitcoins with homomorphic value] -(https://bitcointalk.org/index.php?topic=305791.0)". To build CT I had to -implement several new cryptosystems which work in concert, and invented -a generalization of ring signatures and several novel optimizations to -make the result reasonably efficient. - -The basic tool that CT is based on is a Pedersen commitment. - -A commitment scheme lets you keep a piece of data secret but commit to -it so that you cannot change it later. A simple commitment scheme can -be constructed using a cryptographic hash: - -``` -commitment = SHA256( blinding_factor || data ) -``` - -If you tell someone only the commitment then they cannot determine -what data you are committing to (given certain assumptions about the -properties of the hash), but you can later reveal both the data and the -blinding factor and they can run the hash and verify that the data you -committed to matches. The blinding factor is present because without one, -someone could try guessing at the data; if your data is small and simple, -it might be easy to just guess it and compare the guess to the commitment. - -A Pedersen commitment works like the above but with an additional -property: commitments can be added, and the sum of a set of commitments -is the same as a commitment to the sum of the data (with a blinding key -set as the sum of the blinding keys): - -``` -C(BF1, data1) + C(BF2, data2) == C(BF1 + BF2, data1 + data2) -C(BF1, data1) - C(BF1, data1) == 0 -``` - -In other words, the commitment preserves addition and the commutative -property applies. - -If data_n = {1,1,2} and BF_n = {5,10,15} then: - -``` -C(BF1, data1) + C(BF2, data2) - C(BF3, data3) == 0 -``` - -and so on. - -Our specific Pedersen commitments are constructed using elliptic curve -points. [The reader need not understand elliptic curve cryptography, -beyond accepting the black box behaviors I describe here.] - -Normally an ECC pubkey is created by multiplying a generator for the group -(G) with the secret key (x): - -``` -Pub = xG -``` - -The result is usually serialized as a 33-byte array. - -ECC public keys obey the additively homomorphic property mentioned before: - -``` -Pub1 + Pub2 = (x1 + x2 (mod n))G. -``` - -(This fact is used by the BIP32 HD wallet scheme to allow third parties -to generate fresh Bitcoin addresses for people.) - -The Pedersen commitment is created by picking an additional generator -for the group (which we'll call H) such that no one knows the discrete -log for H with respect to G (or vice versa), meaning no one knows an -x such that xG = H. We can accomplish this by using the cryptographic -hash of G to pick H: - -``` -H = to_point(SHA256(ENCODE(G))) -``` - -Given our two generators we can build a commitment scheme like this: - -``` -commitment = xG + aH -``` - -Here x is our secret blinding factor, and a is the amount that we're -committing to. You can verify just using the commutative property of -addition that all the relationships given for an additively homomorphic -commitment scheme hold. - -The Pedersen commitments are information-theoretically private: for any -commitment you see, there exists some blinding factor which would make -any amount match the commitment. Even an attacker with infinite computing -power could not tell what amount you committed to, if your blinding factor -was truly random. They are computationally secure against fake commitment, -in that you can't actually compute that arbitrary mapping; if you can -it means you can find the discrete log of the generators with respect -to each other, which means that the security of the group is compromised. - -With this tool in hand we can go and replace the normal 8-byte integer -amounts in Bitcoin transactions with 33-byte Pedersen commitments. - -If the author of a transaction takes care in picking their blinding -factors so that they add up correctly, then the network can still verify -the transaction by checking that its commitments add up to zero: - -``` -(In1 + In2 + In3 + plaintext_input_amount*H...) - - (Out1 + Out2 + Out3 + ... fees*H) == 0. -``` - -This requires making the fees in a transaction explicit, but that's -generally desirable. - -The commitment and its checking are quite simple. Unfortunately, without -additional measures this scheme is insecure. - -The problem is that the group is cyclic, and addition is mod P (a 256-bit -prime number that defines the order of the group). As a result, an addition -of large values can 'overflow' and behave like negative amounts. This -means that a sums-to-zero behavior still holds when some outputs are -negative, effectively allowing the creation of 5 coins from nothing: - -``` -(1 + 1) - (-5 + 7) == 0 -``` - -This would be interpreted as "someone spends two bitcoins, gets a '-5' -bitcoin out that they discard out, and a 7 bitcoin output". - -In order to prevent this, when there are multiple outputs we must prove -that each committed output is within a range which cannot overflow -(e.g. [0, 2^64)). - -We could just disclose the amounts and blinding factors so that the -network could check, but this would lose all of the privacy. So, -instead, we need to prove that a committed amount is within the range -but reveal nothing else about it: we need an additional cryptosystem -to prove the range of a Pedersen commitment. We use a scheme similar -to Schoenmakers' binary decomposition but with many optimizations -(including not using binary). - -To build this we start with a basic EC signature. If a signature is -constructed so that the 'message' is the hash of the pubkey, the signature -proves that the signer knew the private key, which is the discrete log -of the pubkey with respect to some generator. - -For a 'pubkey' like P = xG + aH, no one knows the discrete log of P -with respect to G because of the addition of H, because no one knows -an x for xG = H----_unless_ a is 0. If a is zero then P = xG and the -discrete log is just x; someone could sign for that pubkey. - -A pedersen commitment can be proven to be a commitment to a zero by -just signing a hash of the commitment with the commitment as the public -key. Using the public key in the signature is required to prevent setting -the signature to arbitrary values and solving for the commitment. The -private key used for the signature is just the blinding factor. - -Going further, let's say I want to prove C is a commitment to 1 without -telling you the blinding factor. All you do is compute - -``` -C' = C - 1H -``` - -and ask me to provide a signature (with respect to G) with pubkey C'. If -I can do that, the C must be a commitment to 1 (or else I've broken the -EC discrete log security). - -To avoid giving away the amount we need yet another cryptographic -construct: a ring signature. A ring signature is a signature scheme -where there are two (or more) pubkeys and the signature proves that the -signer knows the discrete log of at least one of the pubkeys. - -So with that we can construct a scheme where I prove a commitment that -C is either 0 or 1--we call this an "OR proof". - -First, I give you C, and you compute C': - -``` -C' = C - 1H -``` - - -Then I provide a ring signature over {C, C'}. - -If C was a commitment to 1 then I do not know its discrete log, but -C' becomes a commitment to 0 and I do know its discrete log (just the -blinding factor). If C was a commitment to 0 I know its discrete log, -and I don't for C'. If it was a commitment to any other amount, none -of the result will be zero and I won't be able to sign. - -This works for any pair of numbers, just by suitably pre-processing the -amounts that are put into the ring... or even for more than two numbers. - -Say I want to prove to you that C is in the range [0, 32). Now that we -have an OR proof, imagine I send you a collection of commitments and OR -proofs for each of them: - -``` -C1 is 0 or 1 C2 is 0 or 2 C3 is 0 or 4 C4 is 0 or 8 C5 is 0 or 16. -``` - -If I pick the blinding factors for C1..5 correctly then I can arrange -it so that C1 + C2 + C3 + C4 + C5 == C. Effectively I have built up -the number in binary, and a 5-bit number can only be in the range [0,32). - -Numerous optimizations are required to make this more efficient: - -First, I propose a new ring -signature formulation, a Borromean ring signature[*](https://github.com/Blockstream/borromean_paper/raw/master/borromean_draft_0.01_34241bb.pdf), which is especially -efficient: it requires only 32 bytes per pubkey, plus 32 bytes which -can be shared by many separate rings. This is has twice the asymptotic -efficiency of previously proposed constructions for this application. - -Instead of expressing the amount directly, CT amounts are expressed -using a decimal floating point where the digits are multiplied by a -base 10 exponent. This means that you can prove large amounts with -small proofs, so long as they have few significant digits in base 10: -e.g., 11.2345 and .0112345 can have the same size proof, even though -one number is a thousand times larger. - -There is also a non-private "minimum amount" sent, which allows a smaller -proof to cover a larger range if the user doesn't mind leaking some -information about the minimum amount (which might already be public for -external reasons); this also allows the least significant digits to be -non-zero when an exponent is used. Minimum amounts are supported by first -subtracting the minimum, then proving that the result is non-negative. - -The mantissa of the floating point is encoded using rings of size 4 (base -4) rather than binary, because this minimizes the number of commitments -sent while not using any more signature data than base 2. - -The final mantissa digit commitment can be skipped, backwards constructing -it from the value being proven and the other digits, etc. - -Finally, by careful use of derandomized signing in the prover, it's -possible for the receiver of the coins--who shares a secret with the -sender, due to ECDH key agreement with the receivers pubkey--to 'rewind' -the proof and use it to extract a message sent by the sender which is 80% -of the size of the proof. We use this to signal the value and blinding -factor to the receiver, but it could also be used to carry things like -reference numbers or refund addresses. - -The result is that a proof for a 32-bit value is 2564 bytes, and -simultaneously may convey 2048 bytes of message. A 32-bit proof can -cover a range of 42.94967296 BTC with 1e-8 precision, or 429.4967296 -BTC with 1e-7 precision, and so on. My implementation is able to verify -over 1300 32-bit range proofs per second on an i7-4770R, and there are -many performance optimizations still possible. - ---- - -The implementation supports proofs of any mantissa size or exponent, with -the parameters controlled by the sender. Performance and size are linear -in the number of mantissa bits, and odd numbers of bits are supported -(by switching to radix-2 for the last digit). - -In Elements, the range proofs are only required in cases where there are -multiple confidential value outputs (including fees). Transactions that -merge multiple confidential amounts into a single output do not need range -proofs since the fact that all the inputs were in range is sufficient. - -By sharing the scanning key used to establish the shared secret used by -the rewindable range proofs, this approach is completely compatible with -watching wallets; users can share these keys with auditors to enable -them to view their transaction amounts. - -Future work may use the fact that proofs can support a minimum value to -also allow skipping the range proofs when there is a single confidential -output even when fees are being paid, or allow nodes to skip or delay -verifying most range proofs by using fraud proofs. - -The system presented here depends on no new fundamental cryptographic -assumptions, only the hardness of the discrete log problem in the -secp256k1 group and a random oracle assumption, just like the normal -signatures in Bitcoin. - -While the size of the range proofs are non-trivial, they are still an -order of magnitude smaller and faster to verify than some alternatives -(like Zerocoin), and most of their space can be reclaimed to communicate -additional data between users, a feature which is often requested but -hard to justify in a public broadcast network. Similar to signatures, -the range proofs can be placed on separate tree branches in blocks to -allow clients that don't care about (e.g. historical ones) to skip -receiving them. - -Most importantly, this scheme is compatible with pruning and does not make -the verification state for Bitcoin grow forever. It is also compatible -with CoinJoin and CoinSwap, allowing for transaction graph privacy as -well while simultaneously fixing the most severe limitation of these -approaches to privacy (that transaction amounts compromise their privacy). - -Unlike some other proposals, this system is not just speculation or pure -cryptography without integration with the Bitcoin system. - -Confidential Transactions is enabled in Elements and used by default by -all ordinary transactions. \ No newline at end of file diff --git a/source/elements/confidential-transactions/selective-disclosure.md b/source/elements/confidential-transactions/selective-disclosure.md deleted file mode 100644 index d343d07..0000000 --- a/source/elements/confidential-transactions/selective-disclosure.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Using Confidential Transactions for Selective Disclosure ---- - -The [Confidential Transactions][confidential-transactions] element offers cryptographic privacy over the amounts of an asset used in -transactions on a sidechain. There are many use cases for selectively disclosure some parts of -a transaction, for example to an auditor. - -### The Blinding Key -The "Blinding Key" is a shared value between the participants that grants them -access to the cryptographically-concealed amount. By sharing this key (out of -band), external parties will have the ability to "decrypt" the transaction. - -In order to execute a third-party audit of transaction amounts, the blinding key -can be exported by the receiver and passed on to the auditor. - -#### Retrieving the Blinding Key for a Particular Address -``` -$ elements-cli dumpblindingkey CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi -> 5fd02f714d52b68bbbfef3b8e6d83be646fad1de5150e83d26a28496e00a2146 -``` - -An auditor may then import the address and blinding key with -``importblindingkey`` to observe watch-only amounts. - -``` -$ elements-cli importaddress CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi -$ elements-cli listtransactions "*" 1 0 true -> [] - -$ elements-cli importblindingkey CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi 5fd02f714d52b68bbbfef3b8e6d83be646fad1de5150e83d26a28496e00a2146 -$ elements-cli listtransactions "*" 1 0 true -> [ - { - "involvesWatchonly": true, - "account": "", - "address": "QTE8CaT6FcJEqkCR4ZGdoUJfas57eDqY6q", - "category": "receive", - "amount": 0.00500000, - "label": "", - "vout": 1, - "confirmations": 35, - "blockhash": "708f969b4fb1c705b82fa3ed309abc7a3d9b0e87aa6e5d17542bb7ee04c8e1f1", - "blockindex": 1, - "blocktime": 1488223140, - "txid": "82b2c5122207e5f33e7adadc6a4aab16a170e16028f0b0cf2c04f9d17d6f0321", - "walletconflicts": [ - ], - "time": 1488223140, - "timereceived": 1488225018, - "bip125-replaceable": "no", - "blindingfactors": "0000000000000000000000000000000000000000000000000000000000000000:71260137a80039dd8cee330d9f7bba625697dc53098cf54d625242946f26997b:" - } -] -``` - -You may also inspect an address in full: -``` -$ elements-cli validateaddress CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi -> { - "isvalid": true, - "address": "CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi", - "scriptPubKey": "76a91405d5c237c5f2d90cfa22a22b75a1d1c1ede021a088ac", - "confidential_key": "03b0f93d729839d3d96bfd7e20f11c7c6ae2016644d0d4cded6332dbfb61ed9067", - "unconfidential": "2dZxbqgzXvANyj9SmyRR9LX3R2k8hg4iUWa", - "ismine": true, - "iswatchonly": false, - "isscript": false, - "pubkey": "031f17ad1acce63acf2d04cc59cb24423ab30f9345dd17476fd2380b02f878295d", - "iscompressed": true, - "account": "", - "hdkeypath": "m/0'/0'/10'", - "hdmasterkeyid": "f5ff0a90ac04830fde2f952cae9e076f9c2b4d39" -} - -``` - -[confidential-transactions]: /elements/confidential-transactions - diff --git a/source/elements/deterministic-pegs/index.md b/source/elements/deterministic-pegs/index.md index 40a52fe..897a621 100644 --- a/source/elements/deterministic-pegs/index.md +++ b/source/elements/deterministic-pegs/index.md @@ -1,15 +1,6 @@ ---- -title: Deterministic Pegs -description: Deterministic Pegs allow cross-chain transactions to be constructed in a decentralized fashion. Tokens can be moved from one blockchain to another. -image: /img/deterministic-pegs.svg -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/deterministic-pegs/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/deterministic-pegs/index.md ---- - +#### Deterministic Pegs *Principal Investigator: Matt Corallo* Deterministic pegs allow Elements Alpha to carry redeemable testnet coins without any modifications to testnet itself. Transfers into Alpha are validated by all full nodes, optionally with the assistance of an RPC call to a testnet node to validate blockchain membership without the presence of compressed SPV proofs in testnet. Transfers out of Alpha are performed by a federation of functionaries which are trusted to hold the coins for Alpha. Sidechains, like other alternative chains, can also be secured by merge-mining. However during a bootstrap period of introduction of a new chain, unless the start of merge mining were very well synchronised, there will be a period of lower hashrate. During the early stages of this bootstrap the chain could have low enough hashrate to present a security risk even against a modest powered attacker. Given the challenges of synchronising something as organic and decentralised by design as bitcoin mining, we therefore need a mechanism to bootstrap chain security. We start in this release with a threshold of functionaries and are plan for a later version to phase in merge-mining. - -A detailed explanation of the implementation in Elements Alpha can be found in the [blog](/posts/the-federated-peg-in-elements-alpha/). diff --git a/source/elements/index.md b/source/elements/index.md index 1030d6d..44a09be 100644 --- a/source/elements/index.md +++ b/source/elements/index.md @@ -1,206 +1,56 @@ --- -title: "The Periodic Table of Elements" -source: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/index.md +title: Elements --- - +![Sidechain Elements logo](http://i.imgur.com/Vbhiqop.png) Elements is an open source collaborative project where we work on a collection of experiments to more rapidly bring technical innovation to Bitcoin. Elements are features that are proposed and developed in this technical community that in arbitrary combinations can be fashioned into sidechains. -## Current Elements -These are the features currently available in [Elements Core][github], the -open-source reference implementation for sidechains. For projects built with -the latest version of Elements, such as [Liquid][liquid], you can expect them to -support each of these features. +[![Greg Maxwell's Sidechain Elements Intro Video](http://i.imgur.com/AsSENaW.png)](http://www.blockstream.com/developers/) -For a list of proposed Elements, see the bottom of this document. +## Current Elements +These are the features under currently under investigation as part of the Alpha dev sidechain. -
- -
- -
-
-
-
Ai
-
Asset Issuance
-
-
-
- - - -
-
- +
+ +#### [Confidential Transactions](/elements/confidential-transactions) +The Confidential Transactions Element keeps the amounts transferred in a +blockchain-backed transaction visible only to participants in that transaction, +while still guaranteeing that no more coins can be spent than are available in a +cryptographic way. + +Learn More » + +#### [Segregated Witness](/elements/segregated-witness) + +#### [Relative Lock Time](/elements/relative-lock-time) + +#### [Schnorr Signature Validation](/elements/schnorr-signatures) + +#### [New opcodes](/elements/opcodes) + +#### [Signature Covers Value](/elements/signature-covers-value) + +#### [Deterministic Pegs](/elements/deterministic-pegs) + +#### [Signed blocks](/elements/signed-blocks) + ## Proposed Elements -These are some of the features currently under development, but are not yet ready for deployment on a public sidechain. +These are some of the features currently under development, but are yet ready for testing in dev sidechain. - +#### [Basic Asset Issuance](/elements/asset-issuance) -[github]: https://github.com/ElementsProject/elements -[liquid]: /sidechains/liquid +#### [Bitmask Sighash Modes](/elements/bitmask-sighash-modes) diff --git a/source/elements/new/index.md b/source/elements/new/index.md deleted file mode 100644 index 1189241..0000000 --- a/source/elements/new/index.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: Add a New Element -description: Submit your contribution for inclusion in the Periodic Table! -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/new/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/new/index.md ---- - -People wishing to submit new Elements should first propose their idea or document to [the Sidechains mailing list][sidechains-dev]. After discussion, they should submit a pull request to modify [the Periodic Table of Elements][periodic-table] to include the new Element. - -[periodic-table]: /elements -[sidechains-dev]: https://lists.linuxfoundation.org/mailman/listinfo/sidechains-dev diff --git a/source/elements/opcodes/index.md b/source/elements/opcodes/index.md index fbb3b48..5216440 100644 --- a/source/elements/opcodes/index.md +++ b/source/elements/opcodes/index.md @@ -1,18 +1,9 @@ ---- -title: New Opcodes -description: Introduces DETERMINISTICRANDOM and CHECKSIGFROMSTACK, in addition to re-enabling several scripts previously enabled in Bitcoin. -image: /img/new-opcodes.svg -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/opcodes/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/opcodes/index.md ---- - +#### New opcodes *Principal Investigator: Patrick Strateman* Alpha enables several new script opcodes, in addition to the ones already supported by Bitcoin. * Disabled opcodes. Bitcoin used to support a wider range of Script opcodes than exist now. Many were disabled for security reasons in 2010, and require a hard fork to re-enable them. Some of them had significant risks (unbounded memory usage), but not all of them. Alpha reintroduces these safe but disabled opcodes. They include string concatenation and substrings, integer shifts, and several bitwise operations. -* A new [DETERMINISTICRANDOM operation][deterministic-random] which produces a random number within a range from a seed. +* A new DETERMINISTICRANDOM operation which produces a random number within a range from a seed. * A new CHECKSIGFROMSTACK operation which verifies a signature against a message on the stack, rather than the spending transaction itself. These new opcodes have several use cases, including double-spent protection bonds, lotteries, merkle tree constructions to allow 1-of-N multisig with huge N (thousands), and probabilistic payments. - -[deterministic-random]: https://github.com/ElementsProject/elements/blob/alpha/src/script/interpreter.cpp#L1252-L1305 diff --git a/source/elements/relative-lock-time/index.md b/source/elements/relative-lock-time/index.md index 2ef858e..f962f4c 100644 --- a/source/elements/relative-lock-time/index.md +++ b/source/elements/relative-lock-time/index.md @@ -1,11 +1,4 @@ ---- -title: Relative Lock Time -description: Allows a transaction to be time-locked, preventing its use in a new transaction until a relative time change is achieved. -image: /img/time-lock.svg -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/relative-lock-time/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/relative-lock-time/index.md ---- - +#### Relative Lock Time *Principal Investigator: Mark Friedenbach* The consensus-enforced semantics of the sequence number field is modified to enable a signed transaction input to remain invalid for a defined period of time after confirmation of its corresponding output, for the purpose of supporting consensus-enforced transaction replacement features. diff --git a/source/elements/schnorr-signatures/index.md b/source/elements/schnorr-signatures/index.md index 93b3b7d..a95e26c 100644 --- a/source/elements/schnorr-signatures/index.md +++ b/source/elements/schnorr-signatures/index.md @@ -1,11 +1,4 @@ ---- -title: Schnorr Signature Validation -description: A new way of constructing signatures for transactions, both improving efficiency of validating a transaction and offering new modes of multi-signature. -image: /img/confidential-transactions.svg -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/schnorr-signatures/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/schnorr-signatures/index.md ---- - +#### Schnorr Signature Validation *Principal Investigator: Patrick Strateman* Instead of DER-encoded ECDSA signatures over the secp256k1 curve, the CHECKSIG and related operators now use densely packed Schnorr signatures over the same curve. The advantages are: @@ -15,5 +8,3 @@ Potential support for batch validation (up to a factor 2 speedup to verify group Stronger security proof. * Provably no inherent signature malleability, while ECDSA has a known malleability, and lacks a proof that no other forms exist. Note that Witness Segregation already makes signature malleability not result in transaction malleability, however. * Slightly faster to sign/verify than ECDSA. - -Andrew Poelstra lists more advantages on [the MimbleWimble mailing list](https://lists.launchpad.net/mimblewimble/msg00086.html). diff --git a/source/elements/segregated-witness/index.md b/source/elements/segregated-witness/index.md index d48ffe0..53ae4a2 100644 --- a/source/elements/segregated-witness/index.md +++ b/source/elements/segregated-witness/index.md @@ -1,25 +1,9 @@ ---- -title: Segregated Witness -description: Reduce the required space for transactions in a block by a factor of 4. -image: /img/segregated-witness.svg -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/segregated-witness/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/segregated-witness/index.md ---- - +#### Segregated Witness *Principal Investigator: Pieter Wuille* -With Segregated Witness, the specification of a transaction’s effects on the -ledger is separated from the data necessary to prove its validity (called a -witness in cryptography). This completely eliminates all known forms of -transaction malleability, and allows significant blockchain pruning -optimizations. - -In Bitcoin, transactions contain both information about the effect on the ledger -(UTXOs being spent, addresses, and amounts involved) and data proving that the -transaction is authorized (input signatures). For Witness Segregation, -transaction IDs are redefined to only depend on the effect information, and -blocks commit separately to the witness data. This has several advantages: +In Alpha, the specification of a transaction’s effects on the ledger is separated from the data necessary to prove its validity (called a witness in cryptography). This completely eliminates all known forms of transaction malleability, and allows significant blockchain pruning optimizations. +In Bitcoin, transactions contain both information about the effect on the ledger (UTXOs being spent, addresses, and amounts involved) and data proving that the transaction is authorized (input signatures). For Witness Segregation, transaction IDs are redefined to only depend on the effect information, and blocks commit separately to the witness data. This has several advantages: * Bitcoin has seen some “Normalized Transaction ID” proposals, but these are effectively subsumed by Segregated Witness, which is both more efficient and more usable, as Normalized Transaction ID mechanisms still require rewriting dependent transactions after inputs are malleated. Such normalization is a necessary building block for higher-layer protocols such as Lightning. * As transaction IDs no longer cover the signatures, they remove all forms of transaction malleability, in a much more fundamental way than BIP62 aims to do. This results in a larger class of multi-clause contract constructs that become safe to use. * Potential for more efficient SPV output creation proofs (used by lightweight clients), as the signatures can be omitted from the transaction data without breaking the Merkle tree structure. diff --git a/source/elements/signature-covers-value/index.md b/source/elements/signature-covers-value/index.md index 5355b15..455b89d 100644 --- a/source/elements/signature-covers-value/index.md +++ b/source/elements/signature-covers-value/index.md @@ -1,11 +1,4 @@ ---- -title: Signature Covers Value -description: This allows the signature on a transaction to be invalidated if the inputs have been spent, making it faster and easier to validate a transaction, simply by checking its signature. -image: /img/signature-covers-value.svg -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/signature-covers-value/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/signature-covers-value/index.md ---- - +#### Signature Covers Value *Principal Investigator: Glenn Willen* The signatures verified by the CHECKSIG operators now cover the output value of spent inputs. This avoids the need for hardware signing devices to know the full previous transactions whose outputs are spent; if they are being lied to, the resulting signature is invalid anyway. diff --git a/source/elements/signed-blocks/index.md b/source/elements/signed-blocks/index.md index 4aed712..97fac23 100644 --- a/source/elements/signed-blocks/index.md +++ b/source/elements/signed-blocks/index.md @@ -1,25 +1,6 @@ ---- -title: Signed Blocks -description: Blocks can be cryptographically signed, allowing the creator of the block to verify their identity in the future. -image: /img/signed-blocks.svg -branch: elements-0.14.1 -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/elements/signed-blocks/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/elements/signed-blocks/index.md ---- - +#### Signed blocks *Principal Investigator: Jorge Timón* -SHA256d proof of work is replaced with the system’s scripting system, just -signing blocks instead of transactions. In other words, the Dynamic Membership -Multi-party Signature (DMMS) is replaced with a (Static Membership) Multi-party -Signature. This has also been described in the past as ["private chains"][frei]. - -The Elements Alpha release uses a threshold of functionaries as a protocol -adaptor and also to sign blocks of transactions. In a future release we plan to -replace the block-signing with merge-mining, though the functionaries remain to -communicate the transfer transactions to the main chain. The Signed Blocks -feature serves to provide transaction processing functionality until -merge-mining is implemented. Our intent is to later phase in the fully -decentralised 2-way peg mechanism to replace the functionaries. +SHA256d proof of work is replaced with the system’s scripting system, just signing blocks instead of transactions. In other words, the Dynamic Membership Multi-party Signature (DMMS) is replaced with a (Static Membership) Multi-party Signature. This has also been described in the past as “private chains” [http://freico.in/docs/freimarkets.pdf ]. -[frei]: http://freico.in/docs/freimarkets.pdf +The Elements Alpha release uses a threshold of functionaries as a protocol adaptor and also to sign blocks of transactions. In a future release we plan to replace the block-signing with merge-mining, though the functionaries remain to communicate the transfer transactions to the main chain. The Signed Blocks feature serves to provide transaction processing functionality until merge-mining is implemented. Our intent is to later phase in the fully decentralised 2-way peg mechanism to replace the functionaries. diff --git a/source/img/alpha.png b/source/img/alpha.png deleted file mode 100644 index 286bd70..0000000 Binary files a/source/img/alpha.png and /dev/null differ diff --git a/source/img/asset-issuance.svg b/source/img/asset-issuance.svg deleted file mode 100644 index cc25b8e..0000000 --- a/source/img/asset-issuance.svg +++ /dev/null @@ -1,67 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/source/img/bitmask-sighash-modes.svg b/source/img/bitmask-sighash-modes.svg deleted file mode 100644 index 715d942..0000000 --- a/source/img/bitmask-sighash-modes.svg +++ /dev/null @@ -1,34 +0,0 @@ - - - - - - - - - - - - - - - - diff --git a/source/img/confidential-transactions.svg b/source/img/confidential-transactions.svg deleted file mode 100644 index af9ad95..0000000 --- a/source/img/confidential-transactions.svg +++ /dev/null @@ -1,48 +0,0 @@ - - - - - - - - - - - - - - - - diff --git a/source/img/deterministic-pegs.svg b/source/img/deterministic-pegs.svg deleted file mode 100644 index 59a28c4..0000000 --- a/source/img/deterministic-pegs.svg +++ /dev/null @@ -1,68 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - diff --git a/source/img/forest.jpg b/source/img/forest.jpg deleted file mode 100644 index e170eb6..0000000 Binary files a/source/img/forest.jpg and /dev/null differ diff --git a/source/img/gem.png b/source/img/gem.png deleted file mode 100644 index 596afd2..0000000 Binary files a/source/img/gem.png and /dev/null differ diff --git a/source/img/hero-image.png b/source/img/hero-image.png deleted file mode 100644 index 2d9d0bc..0000000 Binary files a/source/img/hero-image.png and /dev/null differ diff --git a/source/img/liquid-logo.png b/source/img/liquid-logo.png deleted file mode 100644 index 3330b9c..0000000 Binary files a/source/img/liquid-logo.png and /dev/null differ diff --git a/source/img/martindale.png b/source/img/martindale.png deleted file mode 100644 index bc4ddee..0000000 Binary files a/source/img/martindale.png and /dev/null differ diff --git a/source/img/new-opcodes.svg b/source/img/new-opcodes.svg deleted file mode 100644 index e4d2485..0000000 --- a/source/img/new-opcodes.svg +++ /dev/null @@ -1,52 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/source/img/periodic-table-of-elements.png b/source/img/periodic-table-of-elements.png deleted file mode 100644 index 05e1d43..0000000 Binary files a/source/img/periodic-table-of-elements.png and /dev/null differ diff --git a/source/img/platonic-solids.png b/source/img/platonic-solids.png deleted file mode 100644 index f22801c..0000000 Binary files a/source/img/platonic-solids.png and /dev/null differ diff --git a/source/img/platonic-volumes.png b/source/img/platonic-volumes.png deleted file mode 100644 index e07829c..0000000 Binary files a/source/img/platonic-volumes.png and /dev/null differ diff --git a/source/img/rootstock-white.webp b/source/img/rootstock-white.webp deleted file mode 100644 index 5409ea0..0000000 Binary files a/source/img/rootstock-white.webp and /dev/null differ diff --git a/source/img/schnorr-signatures.svg b/source/img/schnorr-signatures.svg deleted file mode 100644 index 0194ad3..0000000 --- a/source/img/schnorr-signatures.svg +++ /dev/null @@ -1,33 +0,0 @@ - - - - - - - diff --git a/source/img/segregated-witness.svg b/source/img/segregated-witness.svg deleted file mode 100644 index d7a97a7..0000000 --- a/source/img/segregated-witness.svg +++ /dev/null @@ -1,32 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - diff --git a/source/img/sidechains/1.svg b/source/img/sidechains/1.svg deleted file mode 100644 index 7ed3368..0000000 --- a/source/img/sidechains/1.svg +++ /dev/null @@ -1,525 +0,0 @@ - -image/svg+xml \ No newline at end of file diff --git a/source/img/sidechains/2.svg b/source/img/sidechains/2.svg deleted file mode 100644 index fd06cde..0000000 --- a/source/img/sidechains/2.svg +++ /dev/null @@ -1,150 +0,0 @@ - -image/svg+xml \ No newline at end of file diff --git a/source/img/sidechains/3.svg b/source/img/sidechains/3.svg deleted file mode 100644 index 4680d6b..0000000 --- a/source/img/sidechains/3.svg +++ /dev/null @@ -1,150 +0,0 @@ - -image/svg+xml \ No newline at end of file diff --git a/source/img/sidechains/4.svg b/source/img/sidechains/4.svg deleted file mode 100644 index 9628be0..0000000 --- a/source/img/sidechains/4.svg +++ /dev/null @@ -1,150 +0,0 @@ - -image/svg+xml \ No newline at end of file diff --git a/source/img/sidechains/5.svg b/source/img/sidechains/5.svg deleted file mode 100644 index 58b2516..0000000 --- a/source/img/sidechains/5.svg +++ /dev/null @@ -1,159 +0,0 @@ - -image/svg+xmlR&D - \ No newline at end of file diff --git a/source/img/sidechains/6.svg b/source/img/sidechains/6.svg deleted file mode 100644 index 11cc29b..0000000 --- a/source/img/sidechains/6.svg +++ /dev/null @@ -1,150 +0,0 @@ - -image/svg+xml \ No newline at end of file diff --git a/source/img/sidechains/7.svg b/source/img/sidechains/7.svg deleted file mode 100644 index 501071b..0000000 --- a/source/img/sidechains/7.svg +++ /dev/null @@ -1,150 +0,0 @@ - -image/svg+xml \ No newline at end of file diff --git a/source/img/sidechains/8.svg b/source/img/sidechains/8.svg deleted file mode 100644 index dc6763a..0000000 --- a/source/img/sidechains/8.svg +++ /dev/null @@ -1,279 +0,0 @@ - -image/svg+xml \ No newline at end of file diff --git a/source/img/signature-covers-value.svg b/source/img/signature-covers-value.svg deleted file mode 100644 index 3103e2b..0000000 --- a/source/img/signature-covers-value.svg +++ /dev/null @@ -1,43 +0,0 @@ - - - - - - - - - - - - - - - - - - diff --git a/source/img/signed-blocks.svg b/source/img/signed-blocks.svg deleted file mode 100644 index 5b2bfc4..0000000 --- a/source/img/signed-blocks.svg +++ /dev/null @@ -1,35 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - diff --git a/source/img/the-federated-peg-in-elements-alpha/peg-fraud.png b/source/img/the-federated-peg-in-elements-alpha/peg-fraud.png deleted file mode 100644 index 82c7a26..0000000 Binary files a/source/img/the-federated-peg-in-elements-alpha/peg-fraud.png and /dev/null differ diff --git a/source/img/the-federated-peg-in-elements-alpha/peg-out.png b/source/img/the-federated-peg-in-elements-alpha/peg-out.png deleted file mode 100644 index cfec4cb..0000000 Binary files a/source/img/the-federated-peg-in-elements-alpha/peg-out.png and /dev/null differ diff --git a/source/img/the-federated-peg-in-elements-alpha/peg.png b/source/img/the-federated-peg-in-elements-alpha/peg.png deleted file mode 100644 index e4cbb04..0000000 Binary files a/source/img/the-federated-peg-in-elements-alpha/peg.png and /dev/null differ diff --git a/source/img/time-lock.svg b/source/img/time-lock.svg deleted file mode 100644 index 2715a13..0000000 --- a/source/img/time-lock.svg +++ /dev/null @@ -1,32 +0,0 @@ - - - - - - - - - - - - diff --git a/source/posts/index.md b/source/posts/index.md deleted file mode 100644 index bec3680..0000000 --- a/source/posts/index.md +++ /dev/null @@ -1,3 +0,0 @@ ---- -layout: blog ---- diff --git a/source/sidechains/alpha/building.md b/source/sidechains/alpha/building.md deleted file mode 100644 index a3dc9e0..0000000 --- a/source/sidechains/alpha/building.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Compiling the Alpha Sidechain Source Code -edit: https://github.com/ElementsProject/elementsproject.github.io/blob/relaunch/source/sidechains/alpha/building.md -source: https://github.com/ElementsProject/elementsproject.github.io/edit/relaunch/source/sidechains/alpha/building.md ---- - -## Build Instructions -If you've already forked [the Elements GitHub repository][elements-github], -getting started is easy. - -
-# https://github.com/bitcoin/bitcoin/tree/master/doc
-# Please refer to the Bitcoin documentation to install the required build dependencies/
-git clone https://github.com/ElementsProject/elements
-cd elements
-git checkout alpha
-./autogen.sh
-./configure
-make
-# If your build was successful, you will find src/alphad, src/alpha-cli and src/qt/alpha-qt
-
- -The Data Directory of the alpha testnet dev sidechain lives within your existing Bitcoin [Data Directory](https://en.bitcoin.it/wiki/Data_directory). For example, in Linux `~/.bitcoin/alphatestnet3` contains the Alpha blocks, indicies and wallet. - -[elements-github]: https://github.com/ElementsProject/elements diff --git a/source/sidechains/alpha/getting-started.md b/source/sidechains/alpha/getting-started.md deleted file mode 100644 index e3e0697..0000000 --- a/source/sidechains/alpha/getting-started.md +++ /dev/null @@ -1,308 +0,0 @@ ---- -title: Getting Started with the Alpha Sidechain -edit: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/sidechains/alpha/getting-started.md -source: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/sidechains/alpha/getting-started.md ---- - -You might have heard of Sidechains by now – a way to test new blockchain ideas, -while still being protected the security of the Bitcoin mining network. -Blockstream has been hard at work [turning this idea into a reality][presentation], -and recently they released [the Elements Project][elements], which puts a huge -list of powerful new tools into the hands of developers. One of those tools is -[alpha, a sidechain pegged to Bitcoin's testnet][alpha], which implements a -majority of the Elements to date. - -So what's the first thing we're going to do? Start playing with it, of course. - -## Compiling -You're going to need to grab a few dependencies before you can compile. If -you've already compiled Bitcoin before (a process I recommend everyone go -through), you probably have most of the required components – you can [skip -ahead to compiling Elements itself](#building-elements). For others, I'm going -to start with one of the most common developer setups, a modern Linux -distribution (Ubuntu in our case) and compiling everything from scratch. - -#### Getting the Compiler -Let's go ahead and get our basics complete. For now, that starts with getting -a compiler and all the build tools. In Ubuntu, this is provided by the -`build-essential` package: - -```bash -sudo apt-get install build-essential -``` - -We're also going to want a few extra tools, perhaps most notably `autoconf`: - -```bash -sudo apt-get install libtool autotools-dev autoconf pkg-config -``` - -#### Installing Dependencies -Bitcoin and Elements also require a list of dependencies you'll need installed -before you're able to compile, including `libssl`, `libboost`, and a number of -other `libboost-*` packages: - -_**Important!** Make sure to use `libdb4.8`, **not** `libdb5.1` or later! 5.1 will break certain functionality in Bitcoin and will not be conducive to a -successful build! An installation candidate for 4.8 can be made available by adding the Bitcoin PPA to your apt sources (see below)._ - -```bash -sudo add-apt-repository ppa:bitcoin/bitcoin && sudo apt-get update -``` - -```bash -sudo apt-get install libssl-dev libboost-all-dev libdb4.8-dev libdb4.8++-dev -``` - -_**Note:** `libboost-all-dev` is available on Ubuntu, but might not be so -convenient on other distributions. Your mileage may vary – try compiling and -simply installing the packages the compiler claims are missing._ - - -## Building Elements -We're ready to download and compile the main body of work that comprises -Elements. Like any other compiled package, we'll first acquire the source code, -then configure it for our environment, and finally compile it into some -executable binaries. - -_**Note:** personally, I prefer keeping everything in a distinct project folder. - To do this, I execute this first: `mkdir sidechains && cd sidechains` – you'll -likely be better organized in the long run if you start this way!_ - -Download the code via Git: -```bash -git clone https://github.com/ElementsProject/elements && cd elements -``` - -If you'd like, you can even fork the above repository on GitHub, and replace the -git URL with your personal one. This is generally my approach. - -You're now in the `elements` directory. Let's compile `bitcoin` itself, which -is a necessary component for any sidechain: -```bash -git checkout mainchain -./autogen.sh && ./configure && make -mv src/bitcoin{d,-cli,-tx} ../ -``` - -Give it a little while to configure and compile – this can take a significant -amount of time, depending on the speed of your computer. Once complete (so long -as there are no errors), you should be able to execute `ls ..` and see three -binaries – `bitcoind`, `bitcoin-cli`, and `bitcoin-tx`. You're ready to move -forward. - -Let's checkout the `alpha` branch, which contains Blockstream's proposed -improvements to Bitcoin to implement sidechains, and complete the same process: -```bash -git checkout alpha -./autogen.sh && ./configure && make -mv src/alpha{d,-cli,-tx} ../ -``` - -Again, provided there are no errors, `ls ..` should now include three additional -binaries: `alphad`, `alpha-cli`, and `alpha-tx` – these are the -Elements-specific binaries that implement sidechains, and expect to be able to -connect directly to the `bitcoind` instance you compiled earlier. - -Let's fire these babies up. - -## Running Elements -Now that we have working binaries for both Bitcoin and Elements, we can start -running them as nodes. We'll be joining them to `testnet3`, the latest testnet -on the Bitcoin network. - -You'll have to run two different binaries at once here - I'll leave that as an -exercise to the reader to manage, if I only insist that `tmux` provides a -wonderful split-screen capability within a single terminal! - -Firstly, it'll help to alias some variables to configure the authentication for -the RPC communication between the Elements and Bitcoin binaries: - -```bash -RPC_USER=user -RPC_PASS=pass -``` - -In screen one, let's get our Bitcoin daemon started: -```bash -./bitcoind -rpcuser=$RPC_USER -rpcpassword=$RPC_PASS -testnet -txindex -``` - -Since this will be the first time we've started our Bitcoin client, it will take -some time to synchronize (generally 2-3 hours). Let's go ahead and fire up the -Elements binary before we go grab some coffee, though – again, very similar to -before, but this time with the `alphad` binary: - -```bash -./alphad -rpcuser=$RPC_USER -rpcpassword=$RPC_PASS -testnet -rpcconnect=127.0.0.1 -rpcconnectport=18332 -tracksidechain=all -txindex -blindtrust=true -``` - -You'll notice some additional parameters, including `-tracksidechain` and -`-blindtrust`, but also some RPC parameters specifying where it can find a -"trustworthy" Bitcoin node. In this case, we're supplying our own node, which we -have compiled ourselves and know to be valid. - -When both clients complete their synchronization, you're now a fully functional Elements/Bitcoin pair on the `testnet3` network! Now's your chance to go grab -a coffee while we wait for that to complete. - -## Moving Money -Hopefully you've given both Elements and Bitcoin enough time to sync by now. -The next natural step is to try moving some money into the network – to do this, -we'll need some `testnet3` Bitcoin to spend into the sidechain to acquire our -sidechain's tokens, and then we can spend those sidechain tokens to re-acquire -our Bitcoin. - -### Compiling Tools -As this is intended as a developer preview, we don't have fancy interfaces for -moving money around – we'll need to build a few for ourselves. - -Up first is the `secp256k1` library, which exposes all of the standard k1 curve -functionality: -```bash -git clone https://github.com/bitcoin/secp256k1 -cd secp256k1 -./autogen.sh && ./configure --with-bignum=no && make -make DESTDIR=`pwd`/install install -cd .. -``` - -The only notable component here is that we're using `make install` with a target -directory – we'll use this now for static linking in `contracthashtool`: -```bash -git clone https://github.com/blockstream/contracthashtool -cd contracthashtool -make CXXFLAGS="-I../secp256k1/install/usr/local/include -L../secp256k1/install/usr/local/lib -static" -cd .. -``` - -One last tool and we're almost ready – let's get a copy of Jeff Garzik's RPC -client: -```bash -git clone https://github.com/jgarzik/python-bitcoinrpc -``` - -Now, we're ready to move money. - -### Magic -Let's generate a new sidechain wallet to store the tokens we're about to create -when we commit our testnet Bitcoin. Go ahead and run `cd elements` to get into -the appropriate folder. - -#### Funding Your Wallet -Since we just installed Bitcoin for the first time above, we probably don't have -any `testnet3` bitcoin. Blockstream has [their own testnet faucet][testnet -faucet] for this purpose; let's get our Bitcoin address and request some funds: -```bash -../bitcoin-cli -testnet -rpcuser=user -rpcpassword=pass getnewaddress -``` -You'll get an output of an address – make sure it starts with an `m` or an `n`, which -designates a testnet address–and plug that into [the `testnet3` bitcoin faucet -][testnet faucet] to request some coins. - -_**Note:** If you set a custom RPCUSER and RPCPASS in the earlier step, you'll -need to edit `./contrib/sidechain-manipulation.py` now to reflect those values somewhere -around lines 9 and 10._ -```bash -./contrib/sidechain-manipulation.py generate-one-of-one-multisig sidechain-wallet -``` - -You'll see something like this as an output: - -```bash -One-of-one address: 22E8QKHaTijFemPDwKvAk9qoTgagPfp8nBQiry87MMU1h2gQa8puPqVNtbNCN61ZUzfy1wDuXM1hS6o82 -P2SH address: 2NFEWvrCjPGFQn6smEAUA8ehVr46PrCc8C5 -``` - -Let's copy that P2SH address and use it to send some money: - -```bash -./contrib/sidechain-manipulation.py send-to-sidechain 2NFEWvrCjPGFQn6smEAUA8ehVr46PrCc8C5 1 -``` -Don't forget to replace the address with the one you generated above, and to -supply the amount you're sending. You should see an output something like this: -```bash -Sending 1 to 2NFEWvrCjPGFQn6smEAUA8ehVr46PrCc8C5... -(nonce: 94ffbf32c1f1c0d3089b27c98fd991d5) -Sent tx with id bf01b88710b6023125379510ebd84b373bee88217c80739a1144e5e92b4ee2d0 -``` -Take note of both the `nonce` and the transaction ID. We'll need them to stake -our claim to the corresponding sidechain tokens in a moment. - -Now, due to the nature of this sidechain implementation, you'll need to wait 10 -blocks on the testnet blockchain for this transaction to be redeemable in the -sidechain. This amounts to around 1.5 hours on `mainnet`, but shouldn't take -nearly this long on `testnet`. - -Once completed, let's go ahead and claim – don't forget to replace the `nonce` -and transaction ID values, in that order: - -```bash -./contrib/sidechain-manipulation.py claim-on-sidechain 2NCs5ufweTL8VHKNT6wrZMTkrnnmpZCy99j 94ffbf32c1f1c0d3089b27c98fd991d5 bf01b88710b6023125379510ebd84b373bee88217c80739a1144e5e92b4ee2d0 -``` - -Again, the output will look something like this: -```bash -Redeeming from utxo 0377d218c36f5ee90244e660c387002296f3e4d5cac8fac8530b07e4d3241ccf:0 (value 21000000, refund 20999999) -Success! -Resulting txid: eabe26aba6286e1ee439baedeb75094ec0bcdaf54ed9481d9d2183e8a6424755 -``` - -You've now got a spendable transaction on your sidechain! Well, it'll be -redeemable in 144 sidechain blocks to make sure any outstanding forks are -resolved, but we've just claimed our first tokens in the sidechain. - -We can now spend it using our 1-of-1 address from earlier: -```bash -./contrib/sidechain-manipulation.py spend-from-claim eabe26aba6286e1ee439baedeb75094ec0bcdaf54ed9481d9d2183e8a6424755 22E8QKHaTijFemPDwKvAk9qoTgagPfp8nBQiry87MMU1h2gQa8puPqVNtbNCN61ZUzfy1wDuXM1hS6o82 - Submitting tx to mempool... - Success! -``` - -## What's Going On Here? -In this initial release of Elements, we've implemented something called -"federated peg". Since the main Bitcoin codebase does not yet support some of -the necessary features to implement a full two-way peg, the `testnet` network -relies on a group of signatories (the "federation" part) to execute and verify -the redemption of testnet coins, while within Elements the network actually -utilizes a full two-way peg to redeem the outputs from testnet. - -Let's take a look at what happens now. - -### Redeeming Sidechain Tokens -To complete the loop, we need to get rid of our sidechain tokens, and restore -the original bitcoin we spent in creating them. In our federated peg, we rely -on the federation to verify these, but once bitcoin supports the types of smart -contracts we need, it'll be completely two-way in both directions. - -Generate yourself a mainchain wallet to receive the restored bitcoin: -```bash -./contrib/sidechain-manipulation.py generate-one-of-one-multisig mainchain-wallet -One-of-one address: mm8UW9YsjeHoVhXbHG4hEFKJt52P5iB7Vi -P2SH address: 2MzqiCCUwtKKEV9Kxiyvk8ZuNCFKbcbneva -``` - -Finally, provide the P2SH address you just created above to the -`send-to-mainchain` command, and the amount you wish to move (this can be any -subset of the amount you moved in earlier, but no more): -```bash -./contrib/sidechain-manipulation.py send-to-mainchain 2MzqiCCUwtKKEV9Kxiyvk8ZuNCFKbcbneva 1 -``` - -That's it! We've spun up both a Bitcoin node on the `testnet3` network, and an -Elements node on the `alpha` network. We've moved `testnet3` bitcoin into the -`alpha` sidechain, moved it around, and finally returned ourselves to `testnet3` -bitcoin. - -There's a ton of other things that Elements provides, including Segregated -Witness and Confidential Transactions. Now that you have an Elements node -running, you can explore these things and more on your own. We'll cover these -in more detail in the future! - -Until then, please share what you build and help us by reporting any issues you -find on [the official Elements GitHub repo][elements github]. We're excited to -see what you build! - -[presentation]: https://people.xiph.org/~greg/blockstream.gmaxwell.elements.talk.060815.pdf -[elements]: http://elementsproject.github.io -[alpha]: /sidechains/alpha -[testnet faucet]: https://testnet-faucet.elementsproject.org/ -[elements github]: https://github.com/ElementsProject/elements diff --git a/source/sidechains/alpha/index.md b/source/sidechains/alpha/index.md index 6b6478b..7f60fd5 100644 --- a/source/sidechains/alpha/index.md +++ b/source/sidechains/alpha/index.md @@ -1,61 +1,5 @@ ---- -title: Elements Alpha -edit: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/sidechains/alpha/index.md -source: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/sidechains/alpha/index.md ---- +# Elements: Alpha +## A test network for various Elements. +To make it easy for the community to test the latest Elements, this project combines the best of them into dev sidechains. The first release is Elements Alpha, a developer sidechain and network that introduces several new technologies on a sidechain, pegged to Bitcoin’s testnet. All code is open source, like Bitcoin itself, and others are encouraged to contribute to the project as we work to improve and add additional Elements. Elements Alpha is intended to be a technology demo and testing environment. Proposed Elements were not ready, and as a testnet development sidechain, this blockchain is intended to be short-lived and easily replaced as the technology evolves. -To make it easy for the community to test [the latest -Elements][latest-elements], they are deployed on a public sidechain (pegged to -Bitcoin's `testnet`), Elements Alpha. All code is open source, -like Bitcoin itself, and others are encouraged to contribute to the project as -we work to improve and add additional Elements. Elements Alpha is intended to -be a technology demo and testing environment, but the same tools and practices -used to interact with it will integrate with production networks. - - - -
- -
-

Compiling

-

Just trying to run an Alpha node to build your prototype? Jump straight to the -instructions.

-Compiling Alpha from Source -
- -
- -### Introduction - -Elements Alpha functions as a sidechain to Bitcoin’s `testnet`, though the peg -mechanism currently works through a centralized protocol adapter, as described -in [the Sidechains whitepaper][whitepaper]. It relies on an auditable federation -of signers to manage the testnet coins transferred into the sidechain via [the -"Deterministic Pegs" Element][deterministic-peg], and to produce blocks via [the -"Signed Blocks" Element][signed-blocks]. This makes it possible to immediately -explore the new chain’s possibilities, using different security trade-offs. We -plan to, in a later release, upgrade the protocol adapter to support fully -decentralized merge-mining of the sidechain, and ultimately to phase in the full -2-way peg mechanism. - -#### Moving coins between Testnet and Alpha -See [alpha-README.md](https://github.com/ElementsProject/elements/blob/alpha/alpha-README.md) for instructions on how to transfer testnet coins to the alpha network and back. Note that there is a lengthy confirmation and contest period that you must wait for a peg transfer to complete. - -* [testnet-faucet](https://testnet-faucet.elementsproject.org/) -* [alpha-faucet](https://alpha-faucet.elementsproject.org/) - -For your convenience, these faucets allow you to quickly obtain coins on either the testnet or alpha network without the lengthy wait for the confirmation and contest safety periods. - -# FAQ -* **Is this an altcoin?** No. The key thing to understand about sidechains is value is transferred to/from the main chain. No new coins are created and the total money supply remains constant. - -[elements-github]: https://github.com/ElementsProject/elements -[compiling]: /sidechains/alpha/compiling.html -[latest-elements]: /elements#latest -[whitepaper]: https://blockstream.com/sidechains.pdf -[deterministic-peg]: /elements/deterministic-pegs -[signed-blocks]: /elements/signed-blocks +Elements Alpha functions as a sidechain to Bitcoin’s testnet, though the peg mechanism currently works through a centralized protocol adapter, as described in the Sidechains whitepaper in appendix A. It relies on an auditable federation of signers to manage the testnet coins transferred into the sidechain (see the Deterministic Peg feature) and to produce blocks (see the Signed Block feature). This makes it possible to immediately explore the new chain’s possibilities, using different security trade-offs. We plan to, in a later release, upgrade the protocol adapter to support fully decentralized merge-mining of the sidechain, and ultimately to phase in the full 2-way pegging mechanism. diff --git a/source/sidechains/creating-your-own.md b/source/sidechains/creating-your-own.md deleted file mode 100644 index a352339..0000000 --- a/source/sidechains/creating-your-own.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Building A New Sidechain with Elements -edit: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/sidechains/creating-your-own.md -source: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/sidechains/creating-your-own.md ---- - -This step-by-step guide will walk you through building your own sidechain and -setting up a simple single-signer peg with a `regtest`-powered mainchain. This -configuration works to run a sidechain with a 1-of-1 functionary/blocksigner, -convenient for local development and testing. - -There are several other ways of deriving consensus on a sidechain. See [the -Deterministic Peg Element](/elements/deterministic-peg.html) for more details. - -#### Prerequisites -You'll need a working version of Elements. Follow [the Elements build -instructions](https://github.com/ElementsProject/elements/blob/elements-0.14.1/doc/build-unix.md) -to get set up. - -### Creating your own blockchain -Just like in Bitcoin, Elements can be started in `regtest` mode which allows to -easily create test chains and networks. - -1. Start Elements: - > `elementsd -regtest -daemon` -2. Create an alias for the RPC client: - > `alias ec="elements-cli -regtest"` -
- In Elements, blocks have to be signed by a quorum of the federation. However, just like in Bitcoin the conditions in regtest modes are not enforced, so you can simply create a block with `ec generate 1`. -
-3. Create a chain where we predetermine who is allowed to sign blocks. We start with creating a fresh keypair. - > ADDR=`ec getnewaddress` - > PUBKEY=`ec validateaddress $ADDR | jq -r '.pubkey'` - > PRIVKEY=`ec dumpprivkey $ADDR` -4. Create a 1-of-1 multisig script to use as a block requirement. - > SIGNBLOCKSCRIPT=`ec createmultisig 1 \[\"$PUBKEY\"\] | jq -r '.redeemScript'` -5. Stop the daemon and create a new chain using the blocksigner script - > ec stop - > rm -rf ~/.bitcoin/elementsregtest - > elementsd -regtest -daemon -signblockscript=$SIGNBLOCKSCRIPT - > ec importprivkey $PRIVKEY - > NEW_BLOCK=`ec getnewblockhex` - > BLOCKSIG=`ec signblock $NEW_BLOCK` -
- If there were multiple blocksigners, you'd need to distribute `NEW_BLOCK`, collect signatures, then call `combineblocksigs`. We'll leave this as an excercise to the reader. -
- > SIGNED_BLOCK=`ec combineblocksigs $NEW_BLOCK \[\"$BLOCKSIG\"\] | jq -r '.hex'` - * ensure that the output of combineblocksigs has "complete" true - > `ec getblockcount` - * check the current block count - > `ec submitblock $SIGNED_BLOCK` - > `ec getblockcount` - * check that the chain advanced by one block - -Block generation can be easily automated in a shell script. - -#### Congratulations! -Your chain is online and already accessible, just let other nodes connect to you: -``` -ec addnode -``` - -### Moving Bitcoin into your Sidechain -You might have figured out that while you are in `regtest` mode you own all -coins on the elements chain. Of course, in production you first have to use a -mechanism known as peg-in to move coins from the main chain to the elements -sidechain. Let's set up our own sidechain federation to handle the peg. - -1. Ensure that you have bitcoind 0.13.1 installed and elements as well as bitcoin are shut down. -2. Elements fully validates that peg-in transactions exists in Bitcoin. Therefore, it opens a RPC connection to bitcoind and checks that a particular block is in the chain and has the required confirmations. We need to ensure that the elements daemon is correctly talking to Bitcoin. - * The configuration of Elements is getting larger, so we best create a config file in a new data directory. - * `BETADATADIR=/tmp/elementsdatadir/` - * `mkdir $BETADATADIR` - * Put the following into $BETADATADIR/elements.conf - ``` - rpcuser=bitcoinrpc - rpcpassword=password - rpcport=8339 - daemon=1 - discover=0 - testnet=0 - regtest=1 - - mainchainrpchost=127.0.0.1 - mainchainrpcport=8338 - mainchainrpcuser=bitcoinrpc - mainchainrpcpassword=password - - validatepegin=1 - txindex=1 - ``` - * Now do the same for bitcoin - * `BITCOINDATADIR=/tmp/bitcoindatadir/` - * `mkdir $BITCOINDATADIR` - * put the following into $BITCOINDATADIR/bitcoin.conf - ``` - rpcuser=bitcoinrpc - rpcpassword=password - rpcport=8338 - daemon=1 - discover=0 - testnet=0 - regtest=1 - txindex=1 - ``` -* In the previous section we've used our own public key for the blocksigner script. We will use the same for the federation script. This is the script that owns the coins on the sidechain. -* Let's start bitcoin `bitcoind -datadir=$BITCOINDATADIR` and elements `elementsd -datadir=$BETADATADIR -signblockscript=$SIGNBLOCKSCRIPT -fedpegscript=$SIGNBLOCKSCRIPT` -* Let's update the elements-cli alias to use the new datadir - * `alias bc="elements-cli -datadir=$BETADATADIR"` - * `alias bitc="bitcoin-cli -datadir=$BITCOINDATADIR"` -* Create some coins on the main chain - * `bitc generate 101` -* We can't create a regular peg-in yet, because there are no WPV outputs in regtest mode. We first create them by `sendtomainchain `. Note that peg-outs don't work, because you have no pegoutwatcher running. -* Now you can perform the regular peg-in steps, by first calling `getpeginaddress` on elements then sending coins with bitcoin, then -- again on elements -- claiming coins with `claimpegin`. Ensure that both chains are mining all the time. diff --git a/source/sidechains/gem/index.md b/source/sidechains/gem/index.md deleted file mode 100644 index 5180265..0000000 --- a/source/sidechains/gem/index.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -title: Gem Health -description: Accounting Integrity for Healthcare -source: https://github.com/ElementsProject/elementsproject.org/blob/master/source/sidechains/gem/index.md -edit: https://github.com/ElementsProject/elementsproject.org/edit/master/source/sidechains/gem/index.md ---- - -Gem Health is a blockchain network for the global community of companies and individuals that take part in the continuum of care. Blockchain technology addresses the trade-off between personalized care and operational costs by connecting the ecosystem to universal infrastructure. Shared infrastructure allows us to create global standards without compromising privacy and security. diff --git a/source/sidechains/index.md b/source/sidechains/index.md index ad8e3be..7ef2c73 100644 --- a/source/sidechains/index.md +++ b/source/sidechains/index.md @@ -1,104 +1,17 @@ --- title: Sidechains -description: Combine multiple Elements into your own sidechain. -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/sidechains/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/sidechains/index.md --- -
-

Sidechains are independently deployed bundles of Elements in the real world. Sidechains can be used to test new features for Bitcoin, change network and security properties, and even stand alone as production networks.

+### Sidechains are convenient ways to test Elements. -

Creating Your Own Sidechain?

-

Want to pick your own set of Elements, and deploy your own blockchain?

+The Elements Project, supported by Blockstream, runs and maintains a number of +sidechains. - -
+## Experimental Chains +### [alpha](/sidechains/alpha) +### [beta](/sidechains/beta) -# Featured -Sidechains with a working network can be listed here. Add Yours » - -## Experimental Sidechains -These sidechains are in development and testing, or are explicitly intended for non-production use. - -
-
-
- -
-
-

[Alpha](/sidechains/alpha)

-

Alpha is the official Elements testnet. Pegged to Bitcoin's `testnet`, it includes most of [the stable Elements][stable-elements], and is a convenient way of prototyping your application before going to production.

-
- -
-
-
- -
-
-

[Rootstock](/sidechains/rootstock)

-

Rootstock is a sidechain that implements robust smart contracts. Rootstock is backwards-compatible with Ethereum, so scripts from the Ethereum ecosystem can run directly on a Bitcoin-backed sidechain.

-
- -
-
-
- -
-
-

[Gem](/sidechains/gem)

-

Gem Health is a network for developing applications and shared infrastructure for healthcare. We are building the fabric of a globally integrated healthcare continuum that’s designed to make healthcare more personal and affordable.

-
- -
-
-
- -
-
-

[Create Your Own](/sidechains/creating-your-own.html)

-

Working on something interesting? Add it here.

-
- -
-
- -## Production Sidechains -These sidechains are being used on the main Bitcoin network. - -
-
-
- -
-
-

[Liquid](/sidechains/liquid)

-

Liquid is the first commercial sidechain by Blockstream. It enables instant movement of funds between exchanges, without waiting for the delay of confirmation in the Bitcoin blockchain. It is available to users of participating Bitcoin exchanges.

-
- -
-
- - -[stable-elements]: https://elementsproject.org/elements#stable +## Production Chains +### [Liquid](/sidechains/liquid) +Run by Blockstream, Liquid is a production sidechain that is secured by +federated consensus rather than proof-of-work. diff --git a/source/sidechains/liquid/index.md b/source/sidechains/liquid/index.md index 7023f39..f6ef870 100644 --- a/source/sidechains/liquid/index.md +++ b/source/sidechains/liquid/index.md @@ -1,39 +1,18 @@ --- title: Liquid -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/sidechains/liquid/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/sidechains/liquid/index.md data: elements: ct --- -Liquid is a commercial sidechain that combines [Confidential Transactions](/elements/confidential-transactions) and -several other Elements to provide high-speed transactions between Bitcoin -Exchanges. +Liquid is a commercial sidechain that combines [Confidential Transactions]() and several other Elements to provide high-speed transactions between Bitcoin Exchanges. -Instead of proof of work (like in Bitcoin), Liquid depends on a distributed -group of "signatories", or functionaries, to create blocks. These functionaries -are hardened black boxes that enforce the rules of the network as long as they -are connected to the Internet. We have distributed these functionary boxes -across the world to a number of participants, known as "the functionary grid". +Instead of proof of work (like in Bitcoin), Liquid depends on a distributed group of "signatories", or functionaries, to create blocks. These functionaries are hardened black boxes that enforce the rules of the network as long as they are connected to the Internet. We have distributed these functionary boxes across the world to a number of participants, known as "the functionary grid". Liquid Functionary Consensus -When it is time to append a new block to the Liquid sidechain, the block is -signed by the first functionary in the grid, then handed to the next. Each time -the block is passed to the next functionary, it is checked by the code running -inside the black box to make sure it follows the rules, then is signed and -passed on to the next until a supermajority of nodes have signed the block. +When it is time to append a new block to the Liquid sidechain, the block is signed by the first functionary in the grid, then handed to the next. Each time the block is passed to the next functionary, it is checked by the code running inside the black box to make sure it follows the rules, then is signed and passed on to the next until a supermajority of nodes have signed the block. -Today, key players in the Bitcoin market, including exchanges, payment -processors, traders, and remitters, experience delays when moving bitcoin -between accounts in different locations. We refer to this as Interchange -Settlement Lag (ISL) – a host of liquidity inefficiencies including latency and -confirmation times that hinder the overall prospects of the Bitcoin ecosystem. -Dealing with these issues requires market participants to maintain multiple -balances and accounts across the market to avoid ISL, increasing overall capital -requirements and exposure to the possibility of counterparty risk. +Today, key players in the Bitcoin market, including exchanges, payment processors, traders, and remitters, experience delays when moving bitcoin between accounts in different locations. We refer to this as Interchange Settlement Lag (ISL) – a host of liquidity inefficiencies including latency and confirmation times that hinder the overall prospects of the Bitcoin ecosystem. Dealing with these issues requires market participants to maintain multiple balances and accounts across the market to avoid ISL, increasing overall capital requirements and exposure to the possibility of counterparty risk. -Liquid is a powerful sidechain with wide-reaching implications. To learn more, -[read the Liquid announcement](https://www.blockstream.com/2015/10/12/introducing-liquid/). +Liquid is a powerful sidechain with wide-reaching implications. To learn more, [read the Liquid whitepaper](https://blockstream.io). -Contact Blockstream To Learn More - +Read the Liquid Whitepaper diff --git a/source/sidechains/rootstock/index.md b/source/sidechains/rootstock/index.md deleted file mode 100644 index 909b1fc..0000000 --- a/source/sidechains/rootstock/index.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: Rootstock -description: Smart Contracts on a Bitcoin Sidechain -source: https://github.com/ElementsProject/elementsproject.github.io/blob/master/source/sidechains/rootstock/index.md -edit: https://github.com/ElementsProject/elementsproject.github.io/edit/master/source/sidechains/rootstock/index.md ---- -Rootstock is an open-source smart-contract platform that extends Bitcoin. The smart-contracts capability of rootstock enable numerous applications, such as micropayment channels, escrow services, crowdfunding, crypto-asset creation, decentralized remittances, IP protection, asset registry, voting systems, micro-lending, supply chain traceability, online reputation, digital identity, in-game currency, prediction markets and fair-playing. - -To create a smart-contract platform, Rootstock implements a Turing-complete deterministic replicated virtual machine. Also Rootstock provides an improved payment experience with near instant payment confirmation: it achieves currently 300 tps and confirms most payments in less than 20 seconds. The security of Rootstock is provided by the Bitcoin miners using the merged-mining technique. To be able to interact with Bitcoin, Rootstock implements a Bitcoin 2-Way peg (2WP). - -The 2WP allows bitcoins to be transferred to and from Rootstock at a fixed conversion rate. Rootstock 2WP design is a hybrid drivechain+federation/sidechain. The sidechain functionality is provided by a state-full SPV node (including multisig-wallet) running in a smart-contract. Rootstock is also backwards-compatible with Ethereum, so Ethereum distributed applications (DApps) can be easily ported to Rootstock and achieve greater security, faster execution and greater interoperability with Bitcoin. Rootstock is being actively developed by RSK Labs Ltd., which was founded in 2015 and which has received private funding from key players in the FinTech industry and Bitcoin ecosystem. The platform will be launched in Q3 2016. More information, including founder’s team, and white papers can be downloaded from http://www.rootstock.io/. diff --git a/themes/elements/layout/blog.jade b/themes/elements/layout/blog.jade index 0c843e0..3308294 100644 --- a/themes/elements/layout/blog.jade +++ b/themes/elements/layout/blog.jade @@ -4,21 +4,26 @@ prepend site-title | #{page.title} —  block content + + include partials/menu + .ui.main.text.container .ui.cards - - site.posts.reverse().each(function(page, i) { - .ui.fluid.card + - site.posts.each(function(post, i) { + a.ui.fluid.card(href="#{post.path}") .content + .header #{post.title} .meta - .right.floated.time #{page.date} - a.header(href="#{page.path}") #{page.title} + .right.floated.time #{post.date} .description - p !{page.excerpt} + p !{post.excerpt} .extra.content - .right.floated.meta - a.ui.button(href="#{page.path}") Read More - i.icon.chevron.right - if (page.author) - include partials/author - + if (post.author) + a.right.floated.author(href="/people/#{post.author}") + img.ui.avatar.image(src="/img/#{post.author}.png") + | #{post.author} + + .left.floated.star + i.icon.star + - }); diff --git a/themes/elements/layout/index.jade b/themes/elements/layout/index.jade index 3313846..b4975ca 100644 --- a/themes/elements/layout/index.jade +++ b/themes/elements/layout/index.jade @@ -1,20 +1,14 @@ extends layouts/elements -block masthead - style. - .masthead.segment { - min-height: 700px; - } - - .ui.inverted.vertical.center.aligned.masthead.segment(style="background: url('/img/hero-image.png'); background-size: 100%;") - .ui.container - .ui.large.secondary.inverted.pointing.menu - include partials/menu - a.right.toc.item - i.sidebar.icon - .ui.text.container(style="margin-top: -6em;") +block content + .pusher + .ui.inverted.vertical.masthead.center.aligned.segment + .ui.container + .ui.large.secondary.inverted.pointing.menu + + .ui.text.container h1.ui.inverted.header The Elements Project - h2 Extend Bitcoin with composable building blocks,
deployed to your very own sidechain. + h2 Extending Bitcoin with Sidechains //-form.ui.large.form(action="https://chat.elementsproject.org/invite", method="POST") .inline.field(style="margin-top: 1em;") @@ -23,79 +17,66 @@ block masthead | Join the Community i.icon.right.chevron - a.ui.huge.primary.button(href="/contributing/", style="margin-top: 2em; margin-bottom: -2em;") + a.ui.huge.primary.button(href="https://chat.elementsproject.org", style="margin-top: 1em;") | Join the Community i.icon.right.chevron -block content - .ui.vertical.stripe.segment - .ui.middle.aligned.stackable.grid.container - .row - .eight.wide.column - h3.ui.header Elements - p As open source, protocol-level technology, developers can use Elements to extend the functionality of Bitcoin and explore new applications of the Blockchain. - a.ui.button.primary.huge(href="/case-studies") See Who Is Using Elements - i.icon.right.chevron - .six.wide.right.floated.column - img.ui.medium.bordered.image(src="/img/periodic-table-of-elements.png") + .ui.vertical.stripe.segment + .ui.middle.aligned.stackable.grid.container + .row + .eight.wide.column + h3.ui.header Elements + p As open source, protocol-level technology, developers can use Elements to extend the functionality of Bitcoin and explore new applications of the Blockchain. + a.ui.button.primary.huge(href="/case-studies") See Who Is Using Elements + i.icon.right.chevron + .six.wide.right.floated.column + img.ui.medium.bordered.image(src="/img/square-image.png") - .ui.vertical.stripe.segment - .ui.three.column.center.aligned.divided.relaxed.stackable.grid.container - .row - .column - h4 Confidential Transactions - p The Confidential Transactions Element keeps the amounts transferred in a blockchain transaction visible only to participants in the transaction. - a.ui.button(href="/elements/confidential-transactions") - | Read the specs - i.icon.chevron.right - .column - h4 Segregated Witness - p The Segregated Witness Element eliminates all known forms of transaction malleability, and allows significant blockchain pruning optimizations. - a.ui.button(href="/elements/segregated-witness") - | Read the specs - i.icon.chevron.right - .column - h4 The Periodic Table - p Elements are open-source bundles that can be used alongside one another to construct new, novel applications using the Bitcoin blockchain. - a.ui.button.primary(href="/elements") - | Browse The Elements - i.icon.chevron.right + .ui.vertical.stripe.segment + .ui.three.column.center.aligned.divided.relaxed.stackable.grid.container + .row + .column + h4 Confidential Transactions + p The Confidential Transactions Element keeps the amounts transferred in a blockchain transaction visible only to participants in the transaction. + a.ui.button(href="/elements/confidential-transactions") + | Read the specs + i.icon.chevron.right + .column + h4 Segregated Witness + p The Segregated Witness Element eliminates all known forms of transaction malleability, and allows significant blockchain pruning optimizations. + a.ui.button(href="/elements/confidential-transactions") + | Read the specs + i.icon.chevron.right + .column + h4 The Periodic Table + p Elements are open-source bundles that can be used alongside one another to construct new, novel applications using the Bitcoin blockchain. + a.ui.button.primary(href="/elements") + | Browse The Elements + i.icon.chevron.right - .ui.vertical.stripe.segment - .ui.middle.aligned.stackable.grid.container - .row - .eight.wide.column - h3.ui.header Sidechains - p Sidechains are extensions to existing blockchains, enhancing their privacy and functionality by adding features like smart contracts and confidential transactions. - a.ui.button.primary.huge(href="/sidechains") Browse Known Sidechains - i.icon.right.chevron - .six.wide.right.floated.column - .sidechains.animated(style="position: absolute;") - .sidechain - img.medium.plain.spin(src="img/sidechains/5.svg", style="left: -3em; top: -19em;") - .sidechain - img.medium.plain.spin(src="img/sidechains/6.svg", style="left: 4em; top: -23em;") - .sidechain - img.medium.plain.spin(src="img/sidechains/7.svg", style="left: 3em; top: -14em;") + .ui.vertical.stripe.segment + .ui.middle.aligned.stackable.grid.container + .row + .eight.wide.column + h3.ui.header Sidechains + p The easiest way to get started with Elements is by using one of the experimental sidechains, such as alpha, or the newest network run by Blockstream, beta. + a.ui.button.primary.huge(href="/sidechains") Browse Known Sidechains + i.icon.right.chevron + .six.wide.right.floated.column + img.ui.medium.bordered.round.image(src="/img/square-image.png") - .ui.vertical.stripe.segment - .ui.equal.width.stackable.internally.celled.grid - .center.aligned.row - .column - h3.ui.header alpha - p Build your prototype on top of alpha, the first pegged sidechain. alpha includes all "production-ready" Elements, including Segregated Witness and Confidential Transactions. - a.ui.large.button(href="/sidechains/alpha") - | Learn About Alpha - i.icon.right.chevron - .column - h3.ui.header ??? - p You could list your sidechain here! If you've deployed your network to the public, you can add it via a simple pull request. - a.ui.large.button(href="/sidechains") - | Add Your Sidechain - i.icon.right.chevron - //-.column - h3.ui.header Liquid - p Liquid is a production-deployed sidechain that focuses on rapid settlement between exchanges. It runs in production, and can be used today. - a.ui.large.button(href="/sidechains/liquid") - | Learn About Liquid - i.icon.right.chevron + .ui.vertical.stripe.segment + .ui.equal.width.stackable.internally.celled.grid + .center.aligned.row + .column + h3.ui.header alpha + p Alpha is the first test sidechain that contains all in-development Elements. + a.ui.large.button(href="/sidechains/alpha") + | Learn About Alpha + i.icon.right.chevron + .column + h3.ui.header Liquid + p Liquid is a production-deployed sidechain that focuses on rapid settlement between exchanges. It runs in production, and can be used today. + a.ui.large.button(href="/sidechains/liquid") + | Learn About Liquid + i.icon.right.chevron diff --git a/themes/elements/layout/layouts/elements.jade b/themes/elements/layout/layouts/elements.jade index 72eef7a..460e75f 100644 --- a/themes/elements/layout/layouts/elements.jade +++ b/themes/elements/layout/layouts/elements.jade @@ -6,42 +6,17 @@ html(lang="en") body block header - .ui.large.top.fixed.hidden.inverted.menu + .ui.large.top.fixed.hidden.menu .ui.container - include ../partials/menu - .ui.vertical.inverted.sidebar.right.large.menu - .ui.center.aligned.inverted.header - include ../partials/menu - .pusher - block masthead - .ui.inverted.vertical.masthead.segment - .ui.container - .ui.large.secondary.inverted.pointing.menu - include ../partials/menu - a.right.toc.item - i.sidebar.icon + .active.item Home + .item Elements + .item Sidechains + + .right.menu + .item + a.ui.button test - .ui.container - .content - block content + block content - block footer - include ../partials/footer - - script. - window.addEventListener('load', function() { - // fix menu when passed - $('.masthead').visibility({ - once: false, - onBottomPassed: function() { - console.log('.masthead.onBottomPassed()') - $('.fixed.menu').transition('fade in'); - }, - onBottomPassedReverse: function() { - $('.fixed.menu').transition('fade out'); - } - }); - - // create sidebar and attach to menu open - $('.ui.sidebar').sidebar('attach events', '.toc.item'); - }); + block footer + include ../partials/footer diff --git a/themes/elements/layout/page.jade b/themes/elements/layout/page.jade index 0db1e8a..c61b026 100644 --- a/themes/elements/layout/page.jade +++ b/themes/elements/layout/page.jade @@ -4,19 +4,12 @@ prepend site-title | #{page.title} —  block content + + include partials/menu + .ui.main.text.container - .ui.right.floated.tiny.buttons - include partials/edit-self + include partials/edit-self - if (page.title) - h2 #{page.title} - if (page.image) - img.ui.image.right.floated.small(src="#{page.image}") - if (page.description) - h3 #{page.description} - if (page.branch) - a.ui.button.large.primary(href="https://github.com/ElementsProject/elements/tree/#{page.branch}") - i.icon.code - code #{page.branch} + h2 #{page.title} .content !{page.content} diff --git a/themes/elements/layout/partials/author.jade b/themes/elements/layout/partials/author.jade deleted file mode 100644 index 8747be1..0000000 --- a/themes/elements/layout/partials/author.jade +++ /dev/null @@ -1,3 +0,0 @@ -a.author(href="/people/#{page.author}") - img.ui.avatar.rounded.image(src="/img/#{page.author}.png") - | #{page.author} diff --git a/themes/elements/layout/partials/edit-self.jade b/themes/elements/layout/partials/edit-self.jade index a05f5c8..437806e 100644 --- a/themes/elements/layout/partials/edit-self.jade +++ b/themes/elements/layout/partials/edit-self.jade @@ -1,8 +1,9 @@ -if (page && page.edit && page.source) - a.ui.button.tooltipped(href="#{page.edit}", title="Launch an editor to change content on this page.") - i.icon.pencil - | edit this page - .or - a.ui.button.tooltipped(href="#{page.source}", title="View the original content used to generate this page.") - i.icon.code - | view the source +.ui.right.floated.buttons + if (page && page.edit && page.source) + a.ui.button.tooltipped(href="#{page.edit}", title="Launch an editor to change content on this page.") + i.icon.pencil + | edit this page + .or + a.ui.button.tooltipped(href="#{page.source}", title="View the original content used to generate this page.") + i.icon.code + | view the source diff --git a/themes/elements/layout/partials/footer.jade b/themes/elements/layout/partials/footer.jade index 3f6a1e0..52a414e 100644 --- a/themes/elements/layout/partials/footer.jade +++ b/themes/elements/layout/partials/footer.jade @@ -4,16 +4,16 @@ .three.wide.column h4.ui.inverted.header About .ui.inverted.link.list - a.item(href="https://github.com/ElementsProject") GitHub - a.item(href="https://github.com/ElementsProject/elementsproject.org") Source Code - - .five.wide.column - a(href="https://chat.elementsproject.org") - h4.ui.inverted.header Community - p(style="padding-top: 1em;") - script(async, defer, src="https://chat.elementsproject.org/slackin.js?large") - + a.item(href="/sitemap") Sitemap + a.item Contact Us + .three.wide.column + h4.ui.inverted.header Services + .ui.inverted.link.list + a.item(href="") Sidechains + a.item(href="") Consulting + .seven.wide.column h4.ui.inverted.header Copyright - p The Elements Project is a community endeavor, consisting of contributions from numerous crypographers and engineers. To contribute, visit our contribution guide. + p The Elements Project is © 2016 The Elements Foundation. + p All content is licensed CC-BY NC SA. diff --git a/themes/elements/layout/partials/head.jade b/themes/elements/layout/partials/head.jade index b71903e..ba9267b 100644 --- a/themes/elements/layout/partials/head.jade +++ b/themes/elements/layout/partials/head.jade @@ -21,18 +21,90 @@ link(rel="alternate", href=theme.rss ? theme.rss : config.root + "rss2.xml", tit //- Stylesheets != css("css/semantic.min.css") -!= css("css/elements.css") - -script(src="/javascript/jquery.js") -script(src="/javascript/semantic.min.js") - -script. - var _prum = [['id', '58834389f5d03ba702c9f35a'], - ['mark', 'firstbyte', (new Date()).getTime()]]; - (function() { - var s = document.getElementsByTagName('script')[0] - , p = document.createElement('script'); - p.async = 'async'; - p.src = '//rum-static.pingdom.net/prum.min.js'; - s.parentNode.insertBefore(p, s); - })(); +!= js("js/semantic.min.js") + +style. + .hidden.menu { + display: none; + } + + .masthead.segment { + min-height: 700px; + padding: 1em 0em; + } + .masthead .logo.item img { + margin-right: 1em; + } + .masthead .ui.menu .ui.button { + margin-left: 0.5em; + } + .masthead h1.ui.header { + margin-top: 3em; + margin-bottom: 0em; + font-size: 4em; + font-weight: normal; + } + .masthead h2 { + font-size: 1.7em; + font-weight: normal; + } + + .ui.vertical.stripe { + padding: 8em 0em; + } + .ui.vertical.stripe h3 { + font-size: 2em; + } + .ui.vertical.stripe .button + h3, + .ui.vertical.stripe p + h3 { + margin-top: 3em; + } + .ui.vertical.stripe .floated.image { + clear: both; + } + .ui.vertical.stripe p { + font-size: 1.33em; + } + .ui.vertical.stripe .horizontal.divider { + margin: 3em 0em; + } + + .quote.stripe.segment { + padding: 0em; + } + .quote.stripe.segment .grid .column { + padding-top: 5em; + padding-bottom: 5em; + } + + .footer.segment { + padding: 5em 0em; + } + + .secondary.pointing.menu .toc.item { + display: none; + } + + @media only screen and (max-width: 700px) { + .ui.fixed.menu { + display: none !important; + } + .secondary.pointing.menu .item, + .secondary.pointing.menu .menu { + display: none; + } + .secondary.pointing.menu .toc.item { + display: block; + } + .masthead.segment { + min-height: 350px; + } + .masthead h1.ui.header { + font-size: 2em; + margin-top: 1.5em; + } + .masthead h2 { + margin-top: 0.5em; + font-size: 1.5em; + } + } diff --git a/themes/elements/layout/partials/menu.jade b/themes/elements/layout/partials/menu.jade index 12de3d9..73e4455 100644 --- a/themes/elements/layout/partials/menu.jade +++ b/themes/elements/layout/partials/menu.jade @@ -1,9 +1,100 @@ -a.header.item(href="/") The Elements Project -a.item(href="/elements") Elements -a.item(href="/sidechains") Sidechains -a.item(href="/contributing") Community -a.item(href="/posts") Blog -.right.menu - a.item(href="https://github.com/ElementsProject/elements") - i.icon.github.alternate - | GitHub +script. + $(document) + .ready(function() { + + // fix main menu to page on passing + $('.main.menu').visibility({ + type: 'fixed' + }); + $('.overlay').visibility({ + type: 'fixed', + offset: 80 + }); + + // lazy load images + $('.image').visibility({ + type: 'image', + transition: 'vertical flip in', + duration: 500 + }); + + // show dropdown on hover + $('.main.menu .ui.dropdown').dropdown({ + on: 'hover' + }); + }) + ; + +style. + body { + background-color: #FFFFFF; + } + + .main.container { + margin-top: 7em; + } + + .main.menu { + margin-top: 4em; + border-radius: 0; + border: none; + box-shadow: none; + transition: + box-shadow 0.5s ease, + padding 0.5s ease + ; + } + .main.menu .item img.logo { + margin-right: 1.5em; + } + + .overlay { + float: left; + margin: 0em 3em 1em 0em; + } + .overlay .menu { + position: relative; + left: 0; + transition: left 0.5s ease; + } + + .main.menu.fixed { + background-color: #FFFFFF; + border: 1px solid #DDD; + box-shadow: 0px 3px 5px rgba(0, 0, 0, 0.2); + } + .overlay.fixed .menu { + left: 800px; + } + + .text.container .left.floated.image { + margin: 2em 2em 2em -4em; + } + .text.container .right.floated.image { + margin: 2em -4em 2em 2em; + } + + .ui.footer.segment { + margin: 5em 0em 0em; + padding: 5em 0em; + } + +.ui.fixed.inverted.menu + .ui.container + a.header.item(href="/") The Elements Project + a.item(href="/elements") Elements + a.item(href="/sidechains") Sidechains + a.item(href="/case-studies") Case Studies + a.item(href="/posts") Blog + .item + script(async, defer, src="https://chat.elementsproject.org/slackin.js") + + .right.menu + a.item(href="https://github.com/ElementsProject/elements") + i.icon.github.alternate + | GitHub + i.icon.chevron.right + + .ui.right.floated + a.item + i.icon diff --git a/themes/elements/layout/post.jade b/themes/elements/layout/post.jade index eddc7c8..c61b026 100644 --- a/themes/elements/layout/post.jade +++ b/themes/elements/layout/post.jade @@ -4,19 +4,12 @@ prepend site-title | #{page.title} —  block content - .ui.main.text.container - .ui.right.floated.tiny.buttons - include partials/edit-self + + include partials/menu .ui.main.text.container - h2 #{page.title} - .meta posted - if (page.author) - | by - include partials/author - | on - abbr.time #{page.date} + include partials/edit-self - hr + h2 #{page.title} .content !{page.content} diff --git a/themes/elements/source/css/elements.css b/themes/elements/source/css/elements.css deleted file mode 100644 index 743dd6e..0000000 --- a/themes/elements/source/css/elements.css +++ /dev/null @@ -1,226 +0,0 @@ -.content { - padding-bottom: 1em; - padding-top: 1em; -} - -.pusher { - display: flex; - min-height: 100vh; - flex-direction: column; -} - -.pusher > .footer { - flex: 1; -} - -.masthead .ui.secondary.inverted.pointing.menu { - border: 0; -} - -.hidden.menu { - display: none; -} - -.masthead.segment { - /* min-height: 15em; */ - padding: 1em 0em; -} -.ui.secondary.menu .item>img:not(.ui) { - margin-right: 1em; - max-height: 2em; - max-width: 2em; - margin-top: -1em; - margin-bottom: -1em; -} -.ui.menu .logo.item>img:not(.ui) { - margin-right:1em; -} -.masthead .ui.menu .ui.button { - margin-left: 0.5em; -} -.masthead h1.ui.header { - margin-top: 0.5em; - margin-bottom: 0em; - font-size: 4em; - font-weight: normal; -} -.masthead h2 { - font-size: 1.7em; - font-weight: normal; -} -.masthead .ui.menu { - margin: 0; -} -.ui.secondary.menu .header.item { - border-right: 0; -} -.ui.inverted.menu .logo.item { - font-weight: bold; -} -.masthead .ui.secondary.pointing.menu { - border-bottom: 0; -} - -.ui.vertical.stripe h3 { - font-size: 2em; -} -.ui.vertical.stripe .button + h3, -.ui.vertical.stripe p + h3 { - margin-top: 3em; -} -.ui.vertical.stripe .floated.image { - clear: both; -} -.ui.vertical.stripe p { - font-size: 1.33em; -} -.ui.vertical.stripe .horizontal.divider { - margin: 3em 0em; -} - -.quote.stripe.segment { - padding: 0em; -} -.quote.stripe.segment .grid .column { - padding-top: 5em; - padding-bottom: 5em; -} - -.footer.segment { - padding: 5em 0em; -} - -.secondary.pointing.menu .toc.item { - display: none; -} - -.sidebar .header a { - color: white; -} - -.sidebar .header a img { - margin: 1em; -} - -@media only screen and (max-width: 700px) { - .ui.fixed.menu { - display: none !important; - } - .secondary.pointing.menu .item:not(.logo), - .secondary.pointing.menu .menu { - display: none; - } - .secondary.pointing.menu .toc.item { - display: block; - } - .masthead.segment { - /*min-height: 350px;*/ - } - .masthead h1.ui.header { - font-size: 2em; - margin-top: 1.5em; - } - .masthead h2 { - margin-top: 0.5em; - font-size: 1.5em; - } -} - -pre { - overflow:inherit; -} - -.hljs { - padding: inherit; -} - -.sidechains * { - display: inline-block; -} - -.sidechains * img { - padding: 0; - position: absolute; - top: -22em; -} - -.sidechains * img.spin { - -webkit-animation: spin 30s infinite linear; -} - -.sidechains * img.backspin { - -webkit-animation: backspin 30s infinite linear; -} - -@-webkit-keyframes spin { - 0% {-webkit-transform: rotate(0deg);} - 100% {-webkit-transform: rotate(360deg);} -} -@-webkit-keyframes backspin { - 0% {-webkit-transform: rotate(360deg);} - 100% {-webkit-transform: rotate(0deg);} -} - - -/* old styles */ -/* TODO: remove them */ -td.gutter { - display: none; -} - -.hidden.menu { - display: none; -} - -.masthead.segment { - /*min-height: 700px;*/ - padding: 1em 0em; -} -.masthead .logo.item img { - margin-right: 1em; -} -.masthead .ui.menu .ui.button { - margin-left: 0.5em; -} -.masthead h1.ui.header { - margin-top: 3em; - margin-bottom: 0em; - font-size: 4em; - font-weight: normal; -} -.masthead h2 { - font-size: 1.7em; - font-weight: normal; -} - -.ui.vertical.stripe { - padding: 8em 0em; -} -.ui.vertical.stripe h3 { - font-size: 2em; -} -.ui.vertical.stripe .button + h3, -.ui.vertical.stripe p + h3 { - margin-top: 3em; -} -.ui.vertical.stripe .floated.image { - clear: both; -} -.ui.vertical.stripe p { - font-size: 1.33em; -} -.ui.vertical.stripe .horizontal.divider { - margin: 3em 0em; -} - -.quote.stripe.segment { - padding: 0em; -} -.quote.stripe.segment .grid .column { - padding-top: 5em; - padding-bottom: 5em; -} - -.footer.segment { - padding: 5em 0em; -}