Topic: Nothing-at-Stake & Long Range Attack on Proof-of-Stake (Consensus Research) (Read 15423 times)

I hope James saw the following comments pointing out that shorting is a means to profit from the destruction of a currency as alternative to needing to sell or double-spend:

Here they are: https://github.com/bitcoin/bitcoin/blob/86cfd23f68367af072500b1758a4c446cdd36e74/src/chainparams.cpp#L122 . Last at 295K.

Long range isn't possible not because of rolling checkpoints only(max reorg depth in Nxt is 1440 blocks and you can't generate private branch of such length better than network's not having majority of online stake before splitting).

I remember Bitcoin itself was using checkpoints at one time, not too long ago too. Haven't heard much about that in a while. Do you or anyone else know if they are still in use at all?

I think long range is not possible because rolling checkpoints. Also when downloading a new chain there is a trust system so you download from a trusted source. Rolling checkpoints are nice but create the risk of dividing the network. A fork larger than the largest allowed reorganization would not be resolved and the network would split.


maybe he's thinking too deeply: he proposes an overcomplication that generates centralization and doesn't solve the problem it's supposed to solve.

Can anyone link me to some criticism of these claims by qualified people? I'm especially interested in a rebuttal to the claim that long range NaS attacks are not possible in the system that kushti has defined in his and his group's research.

Update:

Thanks, answered there

Kushti,

I came across a guy looking and thinking deeply about POS.

See https://bitcointalksearch.org/topic/m.11547314


It opens...


... I made him aware of your work  but he seems serious and open minded so maybe you two can help each other to keep pushing the boundaries.

Just finished constructive proof of the FLP impossibility theorem with Coq https://github.com/ConsensusResearch/flp . Hope it will  be a step to blockchain consensus formalization. Now I have a lot of other work to do but hope Coq repository with blockchain consensus formalization code(PoS-friendly) will be started someday

Well, I meant this awesome paper https://eprint.iacr.org/2014/765.pdf . Please take a look to "The common prefix property" in the paper - it's literally the same as "Nakamoto's property".

Kushti, what exactly do people mean when they say "Nakamoto's property"?  Can you link me to somewhere that gives a precise definition for this term?


Any links you can share for "good formal framework describing proof-of-work"?

1. No major news in the field of truly formal proof-of-stake description. It's the question of months at least probably(btw, good formal framework describing proof-of-work appeared only in second half of 2014, 5+ years after Nakamoto's paper which is pretty informal).

2. Just made pre-announcement https://bitcointalksearch.org/topic/pre-ann-scorex-ultracompact-cryptocurrency-engine-for-hackers-1060567


P.S. Communicating with the awesome guy Bill regularly




Nope. And Nxt will got some evolutional improvements, not radical. as radical changes seems to be not much needed at all. Qora's algo needs for some other improvements, I would like not to disclose the details here though.

Will you be integrating the finished thing into Qora before Nxt to see how it performs on a main net?

Bump  

Any news on the truly formal framework formalization?

Or the "experimental blockchain engine for hackers"?

P.S. Bill white plans to contact you about Scorex when he has time...

Glad to hear this.

Thanks,kushti.

Switching from Qora's to Nxt's algo with 1 line change is implemented, having a lot of fun by playing with both algos.

No any critical flaws found in Nxt-like proof-of-stake. On other hand, no any strict formalization made yet as well.

So there are two things to be done:

1. Formalized model showing Nakamoto's property could be met in proof-of-stake with contribution to multiple forks allowed(in other cases there are other problems with formalization). Simulations show the property is seems to be met, thanks to cumulative difficulty working more or less ok as fork selector function(btw, PoS coins with longest chain rule have problems here, at least).
I'm now talking with guys much more skilled in CS/math about possibility of the truly formal framework.

2. Practical contributions to Nxt / other projects around. Nxt's algo seems to be pretty safe, though block delays distribution is needed to be better(closer to average value). It will reduce or mb even eliminate incentive to contribute to multiple forks(by trying to do private branch attacks, then share private forks, then we have majority of forgers having multiple-branch forging with N@S possible as result in such environment). I hope some improvements will be made in 1.7/1.8.

And yeah, "test coin"(don't like "coin" word here, I would like to call it "experimental blockchain engine for hackers"). Making some changes now, so it will be possible to switch Qora's PoS to Nxt's by changing 1 line of code(and introduce other consensus models easily). Then yeah, multiple branching will be introduced in Scorex. Some non-consensus things will be tested as well, e.g. Bill White's scalability proposal etc.

I guess no one has any found any fatal flaws in this research then?

What are the next steps Kushti, were you planning on testing a modified algo in a test coin?

Got some good questions & feedback. Love Sunday meetups much more than others