SpaceMint Overcoming Bitcoin s waste of energy

Transcription

1 Bitcoin Overcoming Bitcoin s waste of energy Georg Fuchsbauer joint work with S Park, A Kwon, K Pietrzak, J Alwen and P Gaži Digital currency Decentralized (no bank issuing coins) Pseudonymous Controled Inflation Journées nationales pré-gdr SI 31/05/17 Overview Ledger Public ledger 1 Bitcoin 2 Transactions Blockchain Proofs of space Issues with PoSp Alice Bob Charlie Alice Bob 0 1 Proof of work Problems with PoW New blockchain format Charlie 0 Alice: transfer 1 Bob

2 Ledger Transactions Public ledger (records all transactions) Alice owns ie it s in the ledger Bob creates pk B Charlie 1 Alice Charlie 1 Alice Alice signs pk B and adds to ledger Alice 1 Bob Alice: transfer 1 Bob how to identify? Digital signatures Double-spending hard to create Alice can create a key pair private key used to sign messages public key lets anyone verify signatures Unforgeability: no one can forge signature w/o knowing secret key physical coin digital coin easy to copy! Alice signs Alice signs pk B pk C Public key coin Ledger only accepts if Private key: enables spending of coin exists transaction no transaction

3 Decentralization The Blockchain How to eliminate authority that checks validity of tx s publishes new tx s in ledger The Blockchain H H H blocks linked by including hash of previous block cannot mofify block w/o changing everything after acts as fingerprint for whole chain Cryptographic hash functions The Blockchain H H H Doc outputs look random H Hash small modifs result in huge changes hard to find preimage best way to find input with hash from some subset is randomly trying transactions collected into block new block added & published every 10min who adds block? assume mechanism chooses random user user could be malicious Sybil attacks? Proof of work

4 Proof of work Mining prove that you ve performed work eg prevent spam: Hashcash X-Hashcash: }{{} H h pk M $ H } {{} 69 Incentive? reward bitcoins! (all bitcoins created this way) }{{} 20 random value try out 2 20 values ( 1s) easy to verify ( 1µs) Mining Forks h $ H } {{} 69 collect transactions find value $ yielding small hash broadcast block pk B pk C Double-spending! if tx s are valid hash is small enough add block to local copy of blockchain

5 Forks Why does it work? pk B pk C Miners incentivized by rewards Probability of mining block computing power no Sybil attacks! Rational to mine on longest chain quick consensus Always mine on the longest chain Secure if majority of miners is honest wait for 6 blocks before accepting payment Problems specialized hardware + cheap electricity mining oligarchy Bitcoin consumes electricity like Can proof of work town of 100k population be replaced by polluting something else? Forks Proof of stake pk B pk C prob of mining number of coins owned Problems: Nothing-at-stake problems Participation: miners = holders The 51%-attack

6 Proof of space Proof of space Trivial solution compare with F Prove: file F indices i 1 inefficient,, i n for verifier F [i 1 ],, F [i n ] A better solution f store lookup table (1, f(1)) Prove: Time/memory trade-offs: (N, f(n)) y 1 Store,, y n N 2/3, invert in time N 2/3 sorted by output Proof of work = (f 1 (y 1 ),, f 1 (y n ) Proof of space Proof of space A better solution Prove: f y 1,, y n = ( f 1 (y 1 ),, f 1 (y n ) ) store lookup table (1, f(1)) (N, f(n)) sorted by output [DFKP 15] id γ fill nodes of graph G dep on id hash content (use hard-to-pebble graph) (hash using Merkle tree)

7 Proof of space [DFKP 15] id γ Prove: nodes i 1,, i n fill nodes of graph G dep on id hash content (γ) Miner initializes space with id = pk broadcasts γ γ gets added to chain check consistency with γ = (G[i 1 ],, G[i n ]) replace proof of work by proof of space Advantages: green: low electricity; reusable hardware decentralized Challenges: PoS is interactive (γ) c proof for hash γ with challenge c Nothing-at-stake problems Mining multiple chains Grinding blocks

8 (γ) c (γ) punishment Who gets to add the block? Quality of proof? define fct of proof : quality space allocated block with best proof gets added to chain Blocks define quality of chain always mine on best chain Bitcoin: 1 easy to generate proofs! miners try to extend every chain no consensus! Forbid extending 2 chains (γ) c (γ) same challenge! = Does this work? Bitcoin: 2 easy to check if good solution! miners might not extend best chain no consensus! Take challenge from past

9 σ pk = Bitcoin: 3 miners might grind blocks leading to good challenge in future proof of work Make challenge hash of only Use signatures (tied to proof) to link blocks Transactions not hashed not consolidated in chain! More ecological? no ongoing cost resources recyclable unused disk space decentralized Blocks not linked to previous block consensus?? New blockchain structure