<blockquote>
  <p>I have no idea what that means. What is "fed-peg"? Why is that needed?</p>
</blockquote>

<p>When you're creating a sidechain, you need a way to move Bitcoins from the main network to your sidechain. This is pretty straightforward. Counterparty, Ethereum, and NXT had various ways of doing this. (Admittedly, none of these allowed people to turn Bitcoin into the assets on these networks after they started, but I suspect that's due to economic reasons rather than technical ones.)</p>

<p>The more complicated, and more important issue, is how you move Bitcoins that are on the sidechain back into the main network. I've heard multiple proposals on how to do this, but all of them are either  </p>

<ul>
<li>insecure,</li>
<li>centralized,</li>
<li>or require very complicated changes to the Bitcoin protocol. </li>
</ul>

<p>This approach is centralized.</p>

<p>The idea with that you have several authorities, each of whom has a private key. Those private keys together control a multisignature account. When you move Bitcoins onto the sidechain, you deposit them into the multisignature account. When you want to move them back to the main chain, you do so on the sidechain; those federated authorities will independently validate that transaction. Then, all of them sign a withdrawal from the multisignature account to the main network address you specified in your sidechain transaction.</p>

<p>The blockstream paper suggests a 3 of 5 multisignature account. The issue with this is that if 3 of those keys are compromised (or if 3 of them collude) then they can take all of the money out of the multisignature account.</p>

<blockquote>
  <p>Does it change in any way the security of the main chain?</p>
</blockquote>

<p>No. It doesn't modify the main network. Future incarnations might, though. There's not enough detail about those possible future systems to answer that at present.</p>

<blockquote>
  <p>How does it differ from decentralized PoW?</p>
</blockquote>

<p>The federated authorities have two roles in this system: gating transactions into the system by producing timestamped blocks, (something normally done by miners) and the previously mentioned multisignature account.</p>

CC BY-SA 3.0
2015-06-09T20:55:16.123Z
2015-09-09T22:59:31.630Z
2015-09-09T22:59:31.630Z
Nick ODell
<p>Federated peg is described in Appendix A of the sidechain whitepaper, <a href="https://blockstream.com/sidechains.pdf" rel="nofollow noreferrer">https://blockstream.com/sidechains.pdf</a> . I don't completely understand the details but here is an overview. In order to implement sidechains in the ideal fashion, the Bitcoin protocol must be modified. It is difficult to gain consensus for such a modification. However, in the meantime, "federated peg" is proposed as a temporary measure for implementing sidechains.</p>

<p>The idea of sidechains is to set up a system that allows you to effectively transfer Bitcoins from the main chain onto the sidechain, and then later transfer those Bitcoins back from the sidechain onto the main chain. While the Bitcoins are 'effectively' in the sidechain, from the perspective of the main chain they are just sitting in some address ('locked'). I like to imagine that the 'locked' Bitcoins on the main chain are 'sleeping' deep in a trance, projecting their 'astral body' into the 'astral plane' of the sidechain. When they finish their business on the sidechain they can then later 'return to their body' and 'wake up' on the main chain.</p>

<p>With federated peg, in order to transfer the Bitcoins from the main chain to the sidechain, you transfer it to an address on the main chain and give control of that address to a small set of trusted parties using a multisignature transaction (eg perhaps you choose 5 trusted parties and then use a 3 of 5 multisig; then in order to move the coins back to the main chain, 3 out of 5 of them will have to agree). These trusted third parties are called 'functionaries' in the paper.</p>

<p>Then, on the sidechain, the trusted third parties inform the sidechain that you have just transferred in those Bitcoins. The 'astral bodies' of your Bitcoins can then be transferred to others on the sidechain. Perhaps at some time in the future, a future owner of some or all of these 'astral bodies' wants to move them back to the main chain. This person informs the trusted third parties (the functionaries) of the main chain address that e wishes to send the coins to, and attaches a proof-of-ownership showing that they are the current owner of the 'astral bodies' on the sidechain. The functionaries inspect the proof-of-ownership and if it is valid, they then delete (or otherwise remove from circulation) the astral bodies from the sidechain, and use their multisignature authority on the 'locked' coins on the main chain to unlock them and send them to the requested address.</p>

<p>This method is called 'federated peg', presumably because it is a type of 'peg' (connection between coins on the main chain and coins on the sidechain) enforced by a 'federation' of trusted third parties (functionaries). This method requires trust in the trusted third parties (functionaries) because if 3 of 5 of them collude (or however many of them there are), or get their keys stolen, then the 'locked' Bitcoins can be stolen on the main chain. However, the goal is for this to just be a temporary measure, until such time as consensus is gained to modify the Bitcoin protocol to implement sidechains using a different method, called 'SPV peg'. After that, you would be able to stop using 'federated peg' and use 'SPV peg' instead; unlike federated peg, SPV peg allows you to transfer Bitcoins between chains without trusting anyone.</p>

<p>'Federated peg' does not modify the Bitcoin protocol or require the cooperation (or even knowledge) of anyone outside of the users of the sidechain, so it has no impact on the security of the main chain.</p>

CC BY-SA 3.0
2015-11-02T04:34:56.070Z
2017-04-21T07:03:50.530Z
2017-04-21T07:03:50.530Z
bshanks
<p>It means that, unfortunately, they still can't figure out how to make a sidechain work without either a central authority or its own independently-mined chain (i.e. a full-fledged altcoin).</p>

<p>This is sad, because it was the one thing they kept promising sidechains would bring us.</p>

<p>But yet we're still back where we started: if you want a cryptocurrency with a feature bitcoin doesn't have, and you don't want a central trusted authority (like Ripple), you need to start an altcoin.  Sidechains have not changed anything here.</p>

CC BY-SA 3.0
2015-06-09T16:42:59.493Z
Well, I still don't understand what does it *actually* mean and how is the pegging done.
Karel Bílek
CC BY-SA 3.0
2015-06-09T16:44:17.370Z
Well there's a trusted third party whose public key is hardwired into the code.  Any difficult questions that come up or disagreements, basically the trusted party decides the answer.  Same as Ripple pretty much.
DebtLadenEbolaZombie
CC BY-SA 3.0
2015-06-09T16:57:06.657Z
Here, check out https://github.com/ElementsProject/elements/blob/alpha/contrib/fedpeg/constants.py -- basically you must "rippleize" the sidechain by hardwiring its central authority's public key on line 15.  Without it, no sidechain.
DebtLadenEbolaZombie
CC BY-SA 3.0
2015-10-18T20:16:05.713Z
I think that's why they started lightning.. because they weren't getting anywhere with sidechains.. and now we have to bear their blocking of the block size increase.. -.-
tobi
CC BY-SA 3.0
2015-11-02T04:41:23.587Z
Afaict it's not that they "can't figure out" how to make sidechains work without a central authority, it's just that their primary proposal (SPV peg) requires a modification to the Bitcoin protocol, which requires gaining consensus. So, as a temporary solution in the meantime, they propose "federated peg". The plan outlined in the paper is to persuade others of the safety and desirability of SPV peg and then switch to that later. (I am not taking a position on whether an SPV peg is actually safe and desirable, I'm just saying that the paper presents it as such).
bshanks
CC BY-SA 3.0
2015-11-02T04:54:41.937Z
Although afaict it's true that SPV peg has not yet been IMPLEMENTED; but i think the proposers would claim that it has been 'figured out' but just not yet implemented (not sure about this).
bshanks
CC BY-SA 3.0
2015-06-09T16:42:14.423Z
2015-06-09T17:30:33.723Z
2015-06-09T17:30:33.723Z
DebtLadenEbolaZombie
<p>A tiny bit of detail on this was added as an "Appendix A" to the <a href="http://updates.blockstream.com/sidechains.pdf" rel="nofollow">sidechains paper</a> at some point:</p>

<blockquote>
  <p>By adopting some additional security assumptions at the expense of the
  low trust design objective, it is possible to do an initial
  deployment in a completely permissionless way. The key observation is
  that any enhancement to Bitcoin Script can be implemented externally
  by having a trusted federation of mutually distrusting functionaries
  evaluate the script and accept by signing for an ordinary
  multisignature script. That is, the functionaries act as a protocol
  adaptor by evaluating the same rules we would have wanted Bitcoin to
  evaluate, but cannot for lack of script enhancements. Using this we
  can achieve a federated peg.</p>
</blockquote>

<p>Basically it's a cabal of "trusted miners".</p>

<p>Since the main bitcoin chain miners don't understand the sidechain's cool new features they can't validate those blocks.  So the sidechain has to be run Ripple-style where there is a pool of trusted miners and one of them has to sign off on each block.  These trusted miners (which they call "functionaries") hold special private keys, and the corresponding public keys are hardwired into the source code.  These central authorities have the power to block the chain's progress, exclude transactions, or even freeze accounts.</p>

CC BY-SA 3.0
2015-06-09T19:10:06.270Z
Is there some reason why you made two answers instead of editing your first answer?
Nick ODell
CC BY-SA 4.0
2019-10-19T05:19:31.940Z
@NickODell it enables him/her to "sidechain" his answer.
Chan-Ho Suh
CC BY-SA 3.0
2015-06-09T18:22:34.573Z
2015-06-09T18:22:34.573Z
DebtLadenEbolaZombie
<p>I am reading about side-chains, and what I read in <a href="https://blockstream.com/2015/06/08/714/" rel="noreferrer">this article</a> is:</p>

<blockquote>
  <p>The initial sidechain included in Sidechain Elements works on a
  federated security model; while it’s still peer-to-peer and
  consensus-based, security for the blockchain is provided by a set of
  predefined functionaries in an arrangement called a Fed-Peg. A number
  of academic groups and individual contributors have agreed to run the
  Sidechain Elements Fed-Peg, including blockchain groups at Stanford,
  MIT, and Princeton. The sidechain does not include mining or
  proof-of-work at this point.</p>
</blockquote>

<p>I have no idea what that means. What is "fed-peg"? Why is that needed? Does it change in any way the security of the main chain? How does it differ from decentralized PoW? </p>

<sidechains>
What is "fed-peg" and "predefined functionaries" with sidechains?
Karel Bílek
# What is "fed-peg" and "predefined functionaries" with sidechains?

(Asked by: username_0 on 2015-06-09)

I am reading about side-chains, and what I read in [this article](https://blockstream.com/2015/06/08/714/) is:

> The initial sidechain included in Sidechain Elements works on a
> federated security model; while it’s still peer-to-peer and
> consensus-based, security for the blockchain is provided by a set of
> predefined functionaries in an arrangement called a Fed-Peg. A number
> of academic groups and individual contributors have agreed to run the
> Sidechain Elements Fed-Peg, including blockchain groups at Stanford,
> MIT, and Princeton. The sidechain does not include mining or
> proof-of-work at this point.

I have no idea what that means. What is "fed-peg"? Why is that needed? Does it change in any way the security of the main chain? How does it differ from decentralized PoW?

**Tags:** sidechains


---

## 4 answers

### Answer by username_1 on 2015-06-09. Score: 4

> I have no idea what that means. What is "fed-peg"? Why is that needed?

When you're creating a sidechain, you need a way to move Bitcoins from the main network to your sidechain. This is pretty straightforward. Counterparty, Ethereum, and NXT had various ways of doing this. (Admittedly, none of these allowed people to turn Bitcoin into the assets on these networks after they started, but I suspect that's due to economic reasons rather than technical ones.)

The more complicated, and more important issue, is how you move Bitcoins that are on the sidechain back into the main network. I've heard multiple proposals on how to do this, but all of them are either

* insecure,
* centralized,
* or require very complicated changes to the Bitcoin protocol.

This approach is centralized.

The idea with that you have several authorities, each of whom has a private key. Those private keys together control a multisignature account. When you move Bitcoins onto the sidechain, you deposit them into the multisignature account. When you want to move them back to the main chain, you do so on the sidechain; those federated authorities will independently validate that transaction. Then, all of them sign a withdrawal from the multisignature account to the main network address you specified in your sidechain transaction.

The blockstream paper suggests a 3 of 5 multisignature account. The issue with this is that if 3 of those keys are compromised (or if 3 of them collude) then they can take all of the money out of the multisignature account.

> Does it change in any way the security of the main chain?

No. It doesn't modify the main network. Future incarnations might, though. There's not enough detail about those possible future systems to answer that at present.

> How does it differ from decentralized PoW?

The federated authorities have two roles in this system: gating transactions into the system by producing timestamped blocks, (something normally done by miners) and the previously mentioned multisignature account.


---

### Answer by username_2 on 2015-11-02. Score: 3

Federated peg is described in Appendix A of the sidechain whitepaper, <https://blockstream.com/sidechains.pdf> . I don't completely understand the details but here is an overview. In order to implement sidechains in the ideal fashion, the Bitcoin protocol must be modified. It is difficult to gain consensus for such a modification. However, in the meantime, "federated peg" is proposed as a temporary measure for implementing sidechains.

The idea of sidechains is to set up a system that allows you to effectively transfer Bitcoins from the main chain onto the sidechain, and then later transfer those Bitcoins back from the sidechain onto the main chain. While the Bitcoins are 'effectively' in the sidechain, from the perspective of the main chain they are just sitting in some address ('locked'). I like to imagine that the 'locked' Bitcoins on the main chain are 'sleeping' deep in a trance, projecting their 'astral body' into the 'astral plane' of the sidechain. When they finish their business on the sidechain they can then later 'return to their body' and 'wake up' on the main chain.

With federated peg, in order to transfer the Bitcoins from the main chain to the sidechain, you transfer it to an address on the main chain and give control of that address to a small set of trusted parties using a multisignature transaction (eg perhaps you choose 5 trusted parties and then use a 3 of 5 multisig; then in order to move the coins back to the main chain, 3 out of 5 of them will have to agree). These trusted third parties are called 'functionaries' in the paper.

Then, on the sidechain, the trusted third parties inform the sidechain that you have just transferred in those Bitcoins. The 'astral bodies' of your Bitcoins can then be transferred to others on the sidechain. Perhaps at some time in the future, a future owner of some or all of these 'astral bodies' wants to move them back to the main chain. This person informs the trusted third parties (the functionaries) of the main chain address that e wishes to send the coins to, and attaches a proof-of-ownership showing that they are the current owner of the 'astral bodies' on the sidechain. The functionaries inspect the proof-of-ownership and if it is valid, they then delete (or otherwise remove from circulation) the astral bodies from the sidechain, and use their multisignature authority on the 'locked' coins on the main chain to unlock them and send them to the requested address.

This method is called 'federated peg', presumably because it is a type of 'peg' (connection between coins on the main chain and coins on the sidechain) enforced by a 'federation' of trusted third parties (functionaries). This method requires trust in the trusted third parties (functionaries) because if 3 of 5 of them collude (or however many of them there are), or get their keys stolen, then the 'locked' Bitcoins can be stolen on the main chain. However, the goal is for this to just be a temporary measure, until such time as consensus is gained to modify the Bitcoin protocol to implement sidechains using a different method, called 'SPV peg'. After that, you would be able to stop using 'federated peg' and use 'SPV peg' instead; unlike federated peg, SPV peg allows you to transfer Bitcoins between chains without trusting anyone.

'Federated peg' does not modify the Bitcoin protocol or require the cooperation (or even knowledge) of anyone outside of the users of the sidechain, so it has no impact on the security of the main chain.


---

### Answer by username_3 on 2015-06-09. Score: 2

It means that, unfortunately, they still can't figure out how to make a sidechain work without either a central authority or its own independently-mined chain (i.e. a full-fledged altcoin).

This is sad, because it was the one thing they kept promising sidechains would bring us.

But yet we're still back where we started: if you want a cryptocurrency with a feature bitcoin doesn't have, and you don't want a central trusted authority (like Ripple), you need to start an altcoin. Sidechains have not changed anything here.

> **Comments:**
> **username_0**: Well, I still don't understand what does it *actually* mean and how is the pegging done.  
> **username_3**: Well there's a trusted third party whose public key is hardwired into the code.  Any difficult questions that come up or disagreements, basically the trusted party decides the answer.  Same as Ripple pretty much.  
> **username_3**: Here, check out https://github.com/ElementsProject/elements/blob/alpha/contrib/fedpeg/constants.py -- basically you must "rippleize" the sidechain by hardwiring its central authority's public key on line 15.  Without it, no sidechain.  
> **username_4**: I think that's why they started lightning.. because they weren't getting anywhere with sidechains.. and now we have to bear their blocking of the block size increase.. -.-  
> **username_2**: Afaict it's not that they "can't figure out" how to make sidechains work without a central authority, it's just that their primary proposal (SPV peg) requires a modification to the Bitcoin protocol, which requires gaining consensus. So, as a temporary solution in the meantime, they propose "federated peg". The plan outlined in the paper is to persuade others of the safety and desirability of SPV peg and then switch to that later. (I am not taking a position on whether an SPV peg is actually safe and desirable, I'm just saying that the paper presents it as such).  
> **username_2**: Although afaict it's true that SPV peg has not yet been IMPLEMENTED; but i think the proposers would claim that it has been 'figured out' but just not yet implemented (not sure about this).  

---

### Answer by username_3 on 2015-06-09. Score: -2

A tiny bit of detail on this was added as an "Appendix A" to the [sidechains paper](http://updates.blockstream.com/sidechains.pdf) at some point:

> By adopting some additional security assumptions at the expense of the
> low trust design objective, it is possible to do an initial
> deployment in a completely permissionless way. The key observation is
> that any enhancement to Bitcoin Script can be implemented externally
> by having a trusted federation of mutually distrusting functionaries
> evaluate the script and accept by signing for an ordinary
> multisignature script. That is, the functionaries act as a protocol
> adaptor by evaluating the same rules we would have wanted Bitcoin to
> evaluate, but cannot for lack of script enhancements. Using this we
> can achieve a federated peg.

Basically it's a cabal of "trusted miners".

Since the main bitcoin chain miners don't understand the sidechain's cool new features they can't validate those blocks. So the sidechain has to be run Ripple-style where there is a pool of trusted miners and one of them has to sign off on each block. These trusted miners (which they call "functionaries") hold special private keys, and the corresponding public keys are hardwired into the source code. These central authorities have the power to block the chain's progress, exclude transactions, or even freeze accounts.

> **Comments:**
> **username_1**: Is there some reason why you made two answers instead of editing your first answer?  
> **username_5**: @username_1 it enables him/her to "sidechain" his answer.  

---

