Therefore, there is no unified absolute ordering of all messages within a thread--but there is an ordering of all messages emitted by a each participant

Again, the discloser can retain the ‘Admit’ message as non-repudiable digital proof that the disclosee has admitted the disclosure of the ACDC

For a given AID, Duplicity refers to the existence of two or more versions of inconsistent instances of a KEL.

Events in the TEL are sealed (anchored) in a Key Event Log (KEL) using seals.

r can provide an API where transaction events or their seal references and their KEL seal references can be looked up by the SAID of the ACDC associated with the transaction event

NOT

When an Edge block does not include a SAID, d field, then the node, n field must appear as the first field in the block.

Notable is the fact that no top-level type fields exist in an ACDC. This is because the Schema, s, field itself is the type field for the ACDC and its parts

where each Edge block is a leaf of a branch

Without the entropy provided the UUID, u, field, an adversary may be able to reconstruct the block contents merely from the SAID of the block and the Schema of the block using a rainbow or dictionary attack on the set of field values allowed by the Schema

where K ≤ L

The specific details of this recovery are explained later (see Section 11.6). In gener-al, the witnessing policy is that the first seen version of an event always wins, that is, the firstverified version is witnessed (signed, stored, acknowledged and maybe disseminated) and allother versions are discarded

It’s just a chain of custody

a little bit about consensus algorithms

but I also have one: a verifiable data tree, not just a chain. So in my view, a verifiable data tree is the solution, not a shared blockchain

blockchains are too expensive, too complex, too hard to scale, and too slow-moving in their governance

Open identity systems should stay agnostic to all silos and blockchains

consensus network called KERI

the message payload inside an IP packet includes aunique identifier provided by the identity system that is exclusive to the sender of the packet

Also more recently theTrusted Computing Group (TCG) uses the term “implicit identity” and “embedded certificateauthority” to describe the process whereby device identifiers are automatically generated by theassociated computing device [143]

Any selective disclosure is potentially ineffective unless per-formed within the confines of a contractually protected disclosure that imposes an incentive onthe disclosee (verifier) to protect that disclosure (counter-incentive against the exploitation ofthat discloser).

that a given DID is guarded by M-of-N signature policies, for example

This makes the DID functionally equivalent to a did:key value, and visually similar, except that a peer DID will have the numeric algorithm as a prefix, before the multibase encoded, multicodec-encoded public key

In order to do this, a form of network-wide election takes place, where the node with the numerically highest ed25519 public key will win

Even though the Pinecone address space is considered to be global in scope, it is important to note that there is no true “single” Pinecone network. It is possible for multiple disjoint and disconnected Pinecone network segments to exist

In some cases, source addresses could be sealed/encrypted, although this is not implemented today

implement a better federation routing algorithm than full-mesh routing

Power DAG

yggdrasil

but limiting the conference to 7 or 8 participants given all the duplication of the sent video required. In Element Call Beta 2, end-to-end encryption was enabled; easy, given it’s just a set of 1:1 calls.

instead it’s more of a QoSed incremental sync

So if the network roundtrip time to your server is even 100ms, and Sliding Sync is operating infinitely quickly, you’re still going to end up showing a placeholders for a few frames

Faster Joins (lazy-loading room state when your server joins a room)

The European Union’s Digital Markets Act (DMA) is a huge step in that direction - regulation that mandates that if the large centralised messaging providers are to operate in the EU, they must interoperate

111,873,374 matrix IDs on the public network, spanning 17,289,201 rooms, spread over 64,256 servers

All API endpoints within the specification are versioned individually. This means that /v3/sync (for example) can get deprecated in favour of /v4/sync without affecting /v3/profile at all. A server supporting /v4/sync would keep serving /v3/profile as it always has

For example, if /test were to be introduced in v1.1 and deprecated in v1.2, then it can be removed in v1.3.

vX.Y

Users may publish arbitrary key/value data associated with their account

Usage of an IS is not required in order for a client application to be part of the Matrix ecosystem. However, without one clients will not be able to look up user IDs using 3PIDs

Each state event updates the value of a given key.

file transfers

Thus if one event is before another, then it must have a strictly smaller depth

Every event graph has a single root event with no parent

Events exchanged in the context of a room are stored in a directed acyclic graph (DAG) called an “event graph”.

type values MUST be uniquely globally namespaced following Java’s package naming conventions, e.g. com.example.myapp.event

In a mobile client, it might be acceptable to reuse the device if a login session expires, provided the user is the same

each device gets its own copy of the decryption keys

each of which would be its own device

signing the message in the context of the graph for integrity

Room data is replicated across all of the homeservers whose users are participating in a given room

and shares data with the wider Matrix ecosystem by synchronising communication history with other homeservers and their clients

Use of 3rd Party IDs (3PIDs) such as email addresses, phone numbers, Facebook accounts to authenticate, identify and discover users on Matrix

Managing user accounts (registration, login, logout)

Extensible user profile management (avatars, display names, etc)

Extensible user management (inviting, joining, leaving, kicking, banning) mediated by a power-level based user privilege system

REST

JSON

The user should know precisely where their data is stored

no single points of control over conversations or the network as a whole

Sending and receiving extensible messages

across a global open network of federated servers and services

Eventually-consistent cryptographically secure synchronisation of room state

However, certain algo-rithms executed on the MEG do not scale well with thenumber of parent events, i.e., they can become very re-source intensive, especially when old parts of the MEGare referenced as parents [8]. In practice, the maximumnumber of parent events therefore has to be restrictedto a finite value d.

Fig. 2

Equivocation and Omission remain as the only optionsfor an attack on CRDT layer

the MEG builds up a Hash-based DAG (HashDAG) data structure

The protocol flow is therefore modified as follows

Given a set of n agents, at most f of which arefaulty and the rest are correct, a fault-resilient supermajority, or supermajorityfor short, is any fraction of agents greater than n+f2 . For example, if f = 0 thena simple majority is a supermajority, and if f < 13 then 23 is a supermajority

푏 the first demonstration of 푞 being Byzantine

the blocklace stores notonly valid blocks but also blocks that constitute a proof thattheir creator is Byzantine

Thus only the valid subset of theblocks will be considered as state by the replicated abstrac-tion (the CRDT).

Thus the harm a Byzantine agent may cause is limited to afinite prefix of the computation

On the contrary, sets ofrandomly generated numbers or sets of signed-hashes (inthe case of a blocklace) do not allow such a compact repre-sentation

Virtual chain axiom

Conclusions

For example, in WOOT [ 33]and YATA [ 32 ], an insertion operation must referencethe IDs of the predecessor and successor elements, andthe algorithms depend on the predecessor appearingbefore the successor in the sequence. The order ofthese elements is not apparent from the IDs alone, sothe algorithm must inspect the CRDT state to checkthat the predecessor and successor references are valid

but Byzantine nodes maynot set this metadata correctly

The 3f + 1 assumption meansthese protocols cannot be deployed in open peer-to-peersystems, since they would be vulnerable to Sybil attacks [ 15].

blockchains [ 5 ]

If authentication of updates is desired, i.e. if it is importantto know which node generated which update, then updatescan additionally be cryptographically signed. However, thisis not necessary for achieving Strong Eventual Consistency

When updates are generatedconcurrently and then merged, the next update containsmultiple predecessors

Consequently, if updateu2 depends on update u1, it could happen that somenodes deliver u1 before u2 and hence process bothupdates correctly, but other nodes may try to deliveru2 and fail because they have not yet delivered u1. Thissituation also leads to divergence.

Say a Byzantine node generates twodifferent updates u1 and u2 that create two differentitems with the same ID. If a node has already deliveredu1 and then subsequently delivers u2, the update u2will be rejected, but a node that has not previously de-livered u1 may accept u2. Since one node accepted u2and the other rejected it, those nodes fail to converge,even if we have eventual delivery

Unfortunately, version vectors are not safe in the presenceof Byzantine nodes, as shown in Figure 1. This is because aByzantine node may generate several distinct updates withthe same sequence number, and send them to different nodes(this failure mode is known as equivocation). Subsequently,when correct nodes p and q exchange version vectors, theymay believe that they have delivered the same set of updatesbecause their version vectors are identical, even though theyhave in fact delivered different updates.

This algorithm has the downside thatmany updates may be sent to nodes that have already re-ceived them from another node, wasting network bandwidth

In some cases, a causal de-livery algorithm additionally ensures that when one updatehas a dependency on an earlier update, the earlier update isdelivered before the later update on all replicas

The network is not necessarily com-plete, i.e. it is not required for every node to be able to com-municate with every other node

they must either exer-cise centralised control over which nodes are allowed to jointhe network

This, in turn, requires either having knowledge of thecurrent replica-set or using an external source of truth (i.e. ablockchain), a system constraint that we did not have before

Operations are easy to define, asthey just need to be commutative, so that the resulting state willbe the same in every replica regardless of the order in whichthey have received the operations

wecan sign the broadcast messages, thus leaving signatures outof the Merkle-DAG

Comparing version vectors betweenpayloads is an inclusion check without the need to perform aDAG-walking

It is clear thatthis approach will bring some benefits

Smart Merge is built on a customized adaptation of Myer's diff algorithm and Google's diff-match-patch

Please note that it is impossible to revoke a device

initial

¬∃b′ ∈ blocklace : (b′ ̸ = b ∧ b′.creator = b.creator ∧ observes(b′, b))

received_orders

Once a recipient has received one copy of a message, they MUST ignore subsequent copies that arrive, such that resends are idempotent

When Alice and Bob are both bidding in an auction protocol, each of them marks their first bid with sender_order: 1, their second bid with sender_order: 2, and so forth.

sender_order

We suggest that the messaging standards all erred by treating public-key encryption and digital signatures as if they were fully independent operations

When B receives A's signed & encrypted message, B can't know how many hands it has passed through, even if B trusts A to be careful.

But in reality, when Charlie gets Alice's message via Bob, Charlie very likely will assume that Alice sent it to him directly

In this case, Alice will be blamed conclusively for Bob's exposure of their company's secrets.

Here, Bob has misled Charlie to believe that ``Alice loves Charlie.''

forces the sender to talk “on the record”

centralized servers and certificate authorities perpetuate a power and UX imbalance between servers and clients that doesn’t fit with peer-oriented DIDComm Messaging

web security is provided at the transport level (TLS); it is not an independent attribute of the messages themselves

The Broadcast Channel API allows basic communication between browsing contexts (that is, windows, tabs, frames, or iframes) and workers on the same origin.

withtokens provided by their IdP.

The new device needs to receive the secret s withoutleaking it to any third party

Finally, EL PASSO supports multi-device scenarios. It en-ables users to easily register new devices (e.g., laptop, phone,tablet) and supports easy identity recovery in case of the theftof one device. It natively supports 2FA: An RP may requestand assess that users connect from two different devices inorder to sign on their services (multi-device support).

intra-RP linkability

Commonly, this is accomplished through a pub-licly available list of credential statuses (either listing the revokedor valid credentials).

Trust anchors affirm the provenance of identitiesand public attributes (DIDDocs)

Alternatively, a simple public key canserve as an identifier, eliminating the DID/DIDDoc abstraction2

according to my entire history

Adding time todigital social contracts is an anticipated future extension

If one user marks a word as bold and another user marks the same word as non-bold, thereis no final state that preserves both users’ intentions and also ensures convergence

If the context has changed

Rather than seeing document history as a linear sequence of versions,we could see it as a multitude of projected views on top of a database of granular changes

Another approach is to maintain all operations for a particular document version in anordered log, and to append new operations at the end when they are generated. To mergetwo document versions with logs 𝐿1 and 𝐿2 respectively, we scan over the operations in𝐿1, ignoring any operations that already exist in 𝐿2; any operations that do not exist in 𝐿2are applied to the 𝐿1 document and appended to 𝐿1 in the order they appear in 𝐿2.

Peritext works bycapturing a document’s edit history as a log of operations

but since a given client never uses the same counter value twice, the combination ofcounter and nodeId is globally unique

Another area for future exploration is moving and duplicating text within a document. If twopeople concurrently cut-paste the same text to different places in a document, and then furthermodify the pasted text, what is the most sensible outcome?

span can be deleted once causalstability [2] has ensured that there will be no more concurrent insertions into that span

Fig. 4

For example, a developer mightdecide that colored text marks should be allowed to overlap, with the overlap region rendering ablend of the colors

No

Conflicts occur not only with colors; even simple bold formatting operations canproduce conflicts

Consider assigning colored highlighting to some text

Furthermore, as with plain text CRDTs, this model only preserves low-level syntactic intent,and manual intervention will often be necessary to preserve semantic intent based on a humanunderstanding of the text

With this strategy, the rendered result is

The key idea is to store formatting spans alongside the plaintext character sequence,linked to a stable identifier for the first and last character of each span, and then to derive the final formattedtext from these spans in a deterministic way that ensures concurrent operations commute

Privacy is realized by the group founder creating a specialkeypair for the group and secretly sharing the private group key with every new group member.When a member is removed from a group or leaves it, the founder has to renew the group’s keypair

However, by doing so the sender mayreveal additional information through the block’s hash pointers, e.g. the identities of other groupmembers

reserved words

A group creator can invite other agents to become members and remove members atwill.

Thegrassroots WhatsApp-like protocol WL employs a hypergraph (a graph in which an edge mayconnect any number of vertices). A hyperedge connecting agents 𝑃 ⊂ Π means that the agents in 𝑃are members in a group represented by the hyperedge

SMS

has an IPaddress

Inpractice, an agent is an app running on a smartphone

Federated systems aimto distribute control, but federated servers are still controlled autocratically

Note that Grassroots Social Networking requires dissemination, and Grassroots Cryptocurrenciesrequire also equivocation exclusion, but neither require consensus. Consensus is needed only byhigher-level applications that employ “on-chain” governance such as grassroots social contracts [7 ],the grassroots counterpart of miner-operated smart contracts, and grassroots representative assem-blies (in preparation).

and if located behind a firewall that preventssmartphones from communicating directly,

In particular, adeep-fake payload that is not attributed to its source can be promptly filtered as spam

However, sinceevery block in GSN is signed, when one breaches privacy within the protocol the breach carriestheir signature so the culprit can be identified.

A rather elaborate set of protocols and infrastructure (named STUN, TURN, TURNS, ICE)is needed to overcome these Internet limitations.

Furthermore, each block sent includes the most recent IP address of the sender,allowing agents to keep track of their friend’s changing IP addresses.

Every so often, an agent 𝑝sends to every friend 𝑞 every block 𝑝 knows and believes that 𝑞 needs, based on the last blockreceived from 𝑞.

Agents communicate only with their friends

However, their exclusion is not required in social networking, and hence social networking protocolscan be simpler than payment systems protocols

Grassroots Social Networking safety implies that each member can be held accountable to theirown utterances, as well as to utterances that they forward. As Grassroots Social Networking hasno controlling entity that can be held accountable in case members of the social network breakthe law, accountability and law enforcement in Grassroots Social Networking are more similarto real life then to the social networks we are familiar with.

In WhatsApp, members of a group must trust the serviceto correctly identify the member who authored an utterance, and utterances forwarded from onegroup to another have no credible attribution or context

In existing social networks, utterances by members do not carry intrinsic attribution orprovenance. Hence, Twitter members must trust the social network operator to correctly identifythe authorship of a tweet

As a screenshot with a tweet could easily be a fake, an author of a tweetcan later repudiate it simply by deleting it, and no proof that the tweet ever existed can be provided,except perhaps by the operator itself.

Naturally, an actual Grassroots Social Networking application may integratethe two protocols to provide both public feeds and private groups

The WhatsApp-like network has private groups, members of each group being both the authors andfollowers of its feed

The Twitter-like network has public feeds

friendsneed

, free of third-party control

The consensus is reached in the same way as fortransactions i.e. using hasgraph consensus algorithm. The onlydifference is, that the concerning events in the hashgraph nowcontain other type of data instead of transactions

DL

Composing Implementations

This implies that any correct run of the imple-mentation that stutters indefinitely has infinitely many opportunities to activatethe specification. Under the standard assumption that an opportunity that ispresented infinitely often is eventually seized, a live implementation does notdeadlock as it eventually activates the specification.

Live

Complete

Safe

implementedtransition system (henceforth – specification),

An implementation is correct if it is safe, complete and live.

Given two transition systems T S = (S, s0, T ) and T S′ = (S′, s′0, T ′) an im-plementation of T S by T S′ is a function σ : S′ → S where σ(s′0) = s0.

empty if s = s′

Also note that T and T f are not necessarydisjoint, for the same reason that even a broken clock shows the correct houronce in a while

We denote by s ∗−→ s′ ∈ T the existence of a correctcomputation (empty if s = s′) from s to s′

A transition in T f \ T is faulty, and a computation is faulty if it

A transition s → s′ ∈ T is correct, and a computation of correct transitionsis correct.

a run of T S is a computation that starts froms0.

A computation of T S is a sequenceof transitions s −→ s′ −→ · · · ,

Atransition system T S = (S, s0, T, T f ) consists of a set of states S, an initialstate s0 ∈ S, a set of (correct) transitions T ⊆ S2 and a set of faulty transitionsT f ⊆ S2. If T f = ∅ then it may be omitted

the transitions over S are all pairs (s, s′) ∈ S2, also written s → s′.

Given a set S, referred to asstates,

◦

and σ32 :S3 → S3

→

TL;DR: Decoupling data dissemination from metadata ordering is the key mechanism to allow scalable and high throughput consensus systems. Moreover, using an efficient implementation of a DAG to abstract the network communication layer from the (zero communication overhead) consensus logic allows for embarrassingly simple and efficient implementations (e.g., more than one order of magnitude throughput improvement compared to Hotstuff).

Every p-block with a payment in r-coins by a correct trader p ̸ = ris eventually approved or disapproved by an r-block [provided p and r are friends or have acommon friend in SG(B)]a.

An r-block b that repays a redemption claim with comment (redeem, P ), P =[p1, p2, . . . , pk], k ≥ 1, has a payment in pi-coins, i ∈ [k], provided the balance of r does notinclude any pj -coins for any 1 ≤ j < i at the time of creating b, and has a payment in r-coins,r /∈ P , provided the balance of r does not include any P -coins at the time of creating b

An r-block b with an empty payment and comment (disapprove, h′) pointsto an r-coin payment block b′, where h′ points to the reason for disapproval: To b′, if it isunbalanced, or to a block b′′ equivocating with b′

An r-block b with an empty payment and comment approve points to balancedr-coin payments block b′, where b does not observe a block equivocating with b′

Given a blocklace B and two agents p, r ∈ Π, the r-coins balance of p in B isthe sum of r-coins payments accepted by p in B minus the sum of r-coins payments issued by p in B.

Finality: A p-block consumes a non-p-block b′ with a payment to p only if r approves b′.

and only if r does not have enough p1 coins then r pays any remainder inp2 coins, and only if r does not have enough p2 coins then r pays to p any remainder in r-coins

not letting

consisting of r-coins, which can be thought of as IOUs issued and signed by r

The black agent mints a black coin, increasing its balance from 3 to 4 coins

C

and the red agent acceptsthe payment, increasing its balance to 6 black coins.

The black agent approves the payment