| Authors | Dilley, Johnny; Poelstra, Andrew; Wilkins, Jonathan; Piekarska, Marta; Gorlick, Ben; Friedenbach, Mark |
|---|---|
| Year | 2016 |
| Project | Liquid Network |
| License | MIT |
| Official Source | https://blockstream.com/strong-federations.pdf |
This page is an educational summary and analysis of an official whitepaper or technical paper, written for reference purposes. It is not a verbatim reproduction. CryptoGloss does not claim authorship of the original work. All intellectual property rights remain with the original author(s). The official document is linked above.
The Strong Federations paper, authored by Johnny Dilley, Andrew Poelstra, Jonathan Wilkins, and colleagues at Blockstream in 2016, introduces the technical design of the Liquid Network — a federated Bitcoin sidechain designed for fast, confidential asset settlement between exchanges, market makers, and institutional traders.
The central contribution is Strong Federations: a multi-party signing scheme using Hardware Security Modules (HSMs) and a Byzantine fault-tolerant round-robin block proposal protocol, enabling a Bitcoin peg without a central custodian while providing stronger security guarantees than simple multisig.
> Whitepaper (PDF): blockstream.com/strong-federations.pdf
Publication and Context
By 2016, Bitcoin’s limitations for exchange use cases were clear:
- 10-minute blocks with 6-confirmation finality meant hours of wait time before funds were tradeable at an exchange
- Public transactions were undesirable for large institutional trades (front-running risk)
- Settlement between exchanges required slow on-chain BTC transfers
The Liquid Network targeted exchanges (Bitfinex, Kraken, BTSE, etc.) as primary users. A member exchange could receive BTC from a customer, peg it into Liquid as L-BTC, trade instantly on Liquid, and return L-BTC to another exchange — all within minutes rather than hours.
Blockstream researchers had previously published Sidechains (Back et al., 2014) describing the general concept; Strong Federations is the production implementation of a federated peg design first discussed in that paper.
Strong Federation Design
Functionary Set
- Watchman: Monitor Bitcoin for peg-in transactions; sign releases for peg-outs
- Blocksigner: Produce and sign Liquid blocks
The federation uses a threshold signature scheme: a configurable M-of-N threshold (e.g., 11-of-15) of functionaries must sign each block and each peg-out transaction. No single functionary can steal funds or halt the network unilaterally.
Hardware Security Modules (HSMs)
Round-Robin Block Proposal
- A block proposer (rotating) creates a block proposal
- Pre-commit signatures are collected from K-of-N functionaries
- A final block is signed and published
- Block time: ~1 minute (configurable, vs. Bitcoin’s ~10 minutes)
- Finality: 2 Liquid confirmations (~2 minutes)
Peg-In and Peg-Out
Peg-in (Bitcoin → Liquid):
- User sends BTC to a federation-controlled multisig address on Bitcoin
- After 102 Bitcoin block confirmations (~17 hours), the user receives L-BTC on Liquid
- The 102-block delay protects against Bitcoin reorgs
Peg-out (Liquid → Bitcoin):
- User submits a peg-out request on Liquid (burning L-BTC)
- Federation functionaries sign the Bitcoin release transaction
- BTC arrives on Bitcoin within ~24 hours
The peg-out is the critical trust assumption: peg-out requires the federation to cooperate. If the federation is compromised or majority-hostile, L-BTC can be permanently frozen (not stolen — the HSMs prevent theft, but the BTC can be locked).
Confidential Transactions and Confidential Assets
Liquid implements two major transaction privacy features developed by the Blockstream research team:
Confidential Transactions (CT): Transaction amounts are hidden using Pedersen commitments — cryptographic commitments that allow network nodes to verify amounts are non-negative (no inflation) without seeing the actual amounts. Blinding factors are shared between sender and receiver using ECDH key exchange.
Confidential Assets: Asset type is also hidden. Liquid supports multiple assets (L-BTC, security tokens, stablecoins) and CT hides not only the amount but also which asset is being transferred in a transaction.
Both features use range proofs (Bulletproofs in later versions) to prove amounts are valid without revealing them.
Key Technical Properties
| Property | Value |
|---|---|
| Block time | ~1 minute |
| Finality | ~2 minutes (2 blocks) |
| Peg-in wait | 102 Bitcoin blocks (~17 hours) |
| Peg-out wait | ~24 hours |
| Federation threshold | 11-of-15 (current default) |
| Transaction privacy | Confidential Transactions (CT) |
| Asset types | L-BTC + issued assets |
| Mainnet launch | September 2018 |
Reality Check
Liquid is a working production network with real exchange members. Its privacy and speed improvements are genuine — CT and 1-minute blocks are meaningful advantages.
However:
- Federated trust: Liquid is decidedly not “trustless.” The federation controls peg-outs. This is explicitly acknowledged — Strong Federations are stronger than a single custodian, not trustless like Bitcoin.
- Limited adoption: Despite exchange members, Liquid daily volume and L-BTC supply have remained modest. Most BTC transfer between exchanges continues on-chain or via Lightning.
- Long peg-in delay: 102-block confirmation (~17 hours) for peg-in is impractical for many use cases and is a significant UX friction.
- HSM dependence: The security model relies on HSMs being correctly programmed and physically secure — an assumption that requires trusting hardware vendors.
Legacy
Strong Federations contributed substantially to privacy cryptography in blockchain: CT (Pedersen commitments + range proofs) and Confidential Assets were innovative in 2016 and influenced later privacy systems. The Bulletproofs range proof (published by Bünz et al. in 2017, also from the Blockstream/Stanford research ecosystem) improved CT efficiency significantly. Liquid also introduced issued assets — the earliest production implementation of non-BTC assets on a Bitcoin-based sidechain.
Related Terms
Research
- Dilley, J., Poelstra, A., Wilkins, J., Piekarska, M., Gorlick, B., & Friedenbach, M. (2016). Strong Federations: An Interoperable Blockchain Solution to Centralized Third Party Risks. Blockstream.
— Primary whitepaper; describes functionary roles, HSMs, round-robin block signing, and the federated peg design.
- Back, A., Corallo, M., Dashjr, L., Friedenbach, M., Maxwell, G., Miller, A., Poelstra, A., Timón, J., & Wuille, P. (2014). Enabling Blockchain Innovations with Pegged Sidechains. blockstream.com.
— Predecessor paper; introduced the general sidechain concept and two-way peg theory that Liquid implements as a federated peg.
- Bünz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., & Maxwell, G. (2018). Bulletproofs: Short Proofs for Confidential Transactions and More. IEEE S&P 2018.
— Bulletproofs range proofs; the efficient range proof construction later integrated into Liquid’s CT implementation, replacing earlier larger proofs.