Pages:
Author

Topic: Re: Proof of stake instead of proof of work - page 9. (Read 6968 times)

sr. member
Activity: 364
Merit: 250
☕ NXT-4BTE-8Y4K-CDS2-6TB82
Okay, I got that. However, calling it a problem is a rather bold claim. I would call it a property of PoS.
It is more than a "property" it is an as of yet unresolved problem.  There is no security in PoS unless it is resolved.

Let me restate my question. Why should a node 100000 blocks ahead accept a blockchain re-organisation?

Quote
(No matter if PoS or PoW)

Um, well no. I can't mine using computing power I no longer have (but did have at one point in the past).

Our mining rigs destroy themselves? I doubt it.

Quote
How would want to be on that fork anyway? In doing so, they would destroy every single bit of confidence in that very cryptocurrency.

The cost to the attacker is absolutely zero.  If he can gain anything more than zero he has everything to gain and nothing to lose.   It would destroy confidence in the PoS currency you are correct especially when it happens over and over and over without end.  That is why it is the Pos problem.

Well, as I said this is true for PoS and PoW. Trying to destroy would definitely diminish confidence in the cryptocurrency as such no matter if PoS or PoW.

Your statement about 'no cost' is true as well.

However, the huge advantage of PoS is: the network controls the consensus power and the network can punish the bad guys. I would call this the PoW problem as the consensus power can easily be introduced from outside without any control whatsoever.
donator
Activity: 1218
Merit: 1079
Gerald Davis
Okay, I got that. However, calling it a problem is a rather bold claim. I would call it a property of PoS.
It is more than a "property" it is an as of yet unresolved problem.  There is no security in PoS unless it is resolved.

Quote
(No matter if PoS or PoW)

Um, well no. I can't mine using computing power I no longer have (but did have at one point in the past).


Quote
How would want to be on that fork anyway? In doing so, they would destroy every single bit of confidence in that very cryptocurrency.

The cost to the attacker is absolutely zero.  If he can gain anything more than zero he has everything to gain and nothing to lose.   It would destroy confidence in the PoS currency you are correct especially when it happens over and over and over without end.  That is why it is the Pos problem.
sr. member
Activity: 364
Merit: 250
☕ NXT-4BTE-8Y4K-CDS2-6TB82
They can attack the network based on what they had (but no longer do) in the past.  There is nothing at risk and no cost to the attack.  THAT is the PoS problem.  

Okay, I got that. However, calling it a problem is a rather bold claim. I would call it a property of PoS.

(No matter if PoS or PoW)
How would want to be on that fork anyway? In doing so, they would destroy every single bit of confidence in that very cryptocurrency.
member
Activity: 115
Merit: 10

Imagine bitcoin worked using a PoS.  An early adopter had acquired 1M BTC at one time in the past but over time he lost/sold/spent/transferred them.   Today he has no bitcoins but the blockchain contains a history of a time when he did have 1M BTC.  If the amount of the stake being used is <1M BTC he could rewrite history not by using coins he has today (a real cost), not by buying millions of mining rigs (a real cost) but by using the history of the coins he once had (no cost).  He has absolutely nothing at risk and nothing to lose.   If he and potentially others decided to attack the network they would rewrite the blockchain starting from when they had a larger stake, creating a parallel history where they didn't lose/sell/spend/transfer the coins. 

They can attack the network based on what they had (but no longer do) in the past.  There is nothing at risk and no cost to the attack.  THAT is the PoS problem.

Beautifully explained, as always.
donator
Activity: 1218
Merit: 1079
Gerald Davis
This is a problem at any stake. Random coalitions to alter the past can be formed at no cost to those colluding.
Checkpointing is not an alternative to decentralized consensus but central override of it.

The same works for Bitcoin, too.

You misunderstand.  The risk isn't that someone could attack the network, it is that they could attack the network with no cost.

Imagine bitcoin worked using a PoS.  An early adopter had acquired 1M BTC at one time in the past but over time he lost/sold/spent/transferred them.   Today he has no bitcoins but the blockchain contains a history of a time when he did have 1M BTC.  If the amount of the stake being used is <1M BTC he could rewrite history not by using coins he has today (a real cost), not by buying millions of mining rigs (a real cost) but by using the history of the coins he once had (no cost).  He has absolutely nothing at risk and nothing to lose.   If he and potentially others decided to attack the network they would rewrite the blockchain starting from when they had a larger stake, creating a parallel history where they didn't lose/sell/spend/transfer the coins. 

They can attack the network based on what they had (but no longer do) in the past.  There is nothing at risk and no cost to the attack.  THAT is the PoS problem.  

Quote
If bitcoin miners collude, they could alter the past.

Sure they can, however there is a cost to that attack and there is something at risk which they lose if they fail.  With PoS you can attack the network for "free" using something you had but no longer do.  It is very hard to secure against an attack where the attacker can do so at any time without any cost and without any risk.
sr. member
Activity: 364
Merit: 250
☕ NXT-4BTE-8Y4K-CDS2-6TB82
This is a problem at any stake. Random coalitions to alter the past can be formed at no cost to those colluding.
Checkpointing is not an alternative to decentralized consensus but central override of it.

The same works for Bitcoin, too.

Why do you insist on defining a mining rig differently from a PoS token?

If bitcoin miners collude, they could alter the past.
If Nxt forgers collude, they could alter the past.

I see no difference.
sr. member
Activity: 364
Merit: 250
☕ NXT-4BTE-8Y4K-CDS2-6TB82
What is your opinion about that paper if referenced?

(http://www.links.org/files/decentralised-currencies.pdf)

 What you are referring is a Proof of stake problem and not proof of work.

The paper is about Bitcoin. So, it is definitely about proof of work.
full member
Activity: 144
Merit: 100
No, if you'd bothered to do some research you'd find out that checkpoints solve a number of boring DOS attack weaknesses which are better— though less simply— solved with a more intelligent fetching architecture. They also solve some initialization isolation attacks, which are better solved with threshold difficulty. I expect that once we've merged headers first we'll drastically reduce or eliminate the role they play in the reference software.

What is your opinion about that paper if referenced?

(http://www.links.org/files/decentralised-currencies.pdf)

 What you are referring is a Proof of stake problem and not proof of work.

Assume the current mining infrastructure for bitcoin is 1 billion. Say the attacker buys 1.1 billion worth of equipment. For someone to make a profit is to be able to sell 12 million coins on the markets and recover more than 1.1 billion (plus something to cover the hashing power that came from transactions). So the rational attacker needs to take the expected profit into account. Bitcoin has much less liquidity to even recover 200million.

On top of that long term this is not an issue when transaction rewards are higher than block rewards because the attacker does not gain from transactions hashing power .


On the other hand for proof of stake , an early adopter can have let's say 10% and sells that early. Now let's say the current minting stake of a proof of stake coin is 5%. It means that the early adopter who sold and doesn't care about the pos coin creates a parallel chain that eventually will be stronger than the current chain. In a decentralized consensus system you have to accept the stronger chain. That the early adopter produced. In particular any group of people that sold can gather and produce a stronger chain and profit . and this attack has zero cost for early adopters that sold. Whatever the attacker gains from selling is a net profit.

Anyone can create a bitundo type of pool gather investors who sold the coin and have X+1 stake where X is the current stake hashing and attack. That will be pure profit and someone might do it.

 Compare that with the pow attacker who possibly will have a loss due to the equipment cost and amount he can recover.
sr. member
Activity: 364
Merit: 250
☕ NXT-4BTE-8Y4K-CDS2-6TB82
No, if you'd bothered to do some research you'd find out that checkpoints solve a number of boring DOS attack weaknesses which are better— though less simply— solved with a more intelligent fetching architecture. They also solve some initialization isolation attacks, which are better solved with threshold difficulty. I expect that once we've merged headers first we'll drastically reduce or eliminate the role they play in the reference software.

What is your opinion about that paper if referenced?

(http://www.links.org/files/decentralised-currencies.pdf)
staff
Activity: 4284
Merit: 8808
Yeah. That is the reason why Bitcoin uses checkpointing
No, if you'd bothered to do some research you'd find out that checkpoints solve a number of boring DOS attack weaknesses which are better— though less simply— solved with a more intelligent fetching architecture. They also solve some initialization isolation attacks, which are better solved with threshold difficulty. I expect that once we've merged headers first we'll drastically reduce or eliminate the role they play in the reference software.
sr. member
Activity: 364
Merit: 250
☕ NXT-4BTE-8Y4K-CDS2-6TB82
There was a coin where the network had no control concerning newly added hashing power.  It was called liquidcoin.  Typically a difficulty adjustment algorithm takes care of that Smiley 

Takes care of what? The difficulty cannot change the proportion of consensus power within one network.
legendary
Activity: 1264
Merit: 1008

Hashing power can be introduce at will and without any control of the network. That is pretty bad IMHO.


There was a coin where the network had no control concerning newly added hashing power.  It was called liquidcoin.  Typically a difficulty adjustment algorithm takes care of that Smiley 
sr. member
Activity: 364
Merit: 250
☕ NXT-4BTE-8Y4K-CDS2-6TB82
No, both PoS and PoW allow everyone to participate in exact proportion to their resources.
No: you can't buy coins of the chain you want to mine if they are not for sale, whatever are your resources.

While you can build how many hashing power you want if you have the resources, and nobody, nobody, can't stop you.

The difference is quite abysmal.

Yes, but in another sense than you think.

Hashing power can be introduce at will and without any control of the network. That is pretty bad IMHO.

Stake cannot be introduced afterwards AND if so the network controls it and can react.
sr. member
Activity: 364
Merit: 250
☕ NXT-4BTE-8Y4K-CDS2-6TB82
Doesn't checkpointing prevent that?
Checkpointing is a centralized solution.

The network should work well even without them.

Yeah. That is the reason why Bitcoin uses checkpointing: https://bitcointalksearch.org/topic/m.6520315
newbie
Activity: 27
Merit: 0
I think it can not be called replacement, the development direction of POW in future will likely will be force output to computing projects intentionally, and can produce results, will only stay a part to ensure the network running.
This may be a good direction for the future, the road is own pow coin.
newbie
Activity: 7
Merit: 0
I have proposed a solution which I believe would eliminate some of the problems with existing PoS systems.  I call it Proof-of-Connection.

https://bitcointalksearch.org/topic/proposal-for-a-new-proof-of-stake-mining-system-with-proof-of-connection-553414

Basically, this system requires "ping" transactions to be submitted to the network at random intervals.  A wallet node must be connected to the network in order to receive the trigger for these transactions, and to be able to send them.  Upon successful inclusion of these PoC transactions into a block, that address's Stake-Days are reduced to 0, but their stake earnings are paid out to them in the coinbase transaction for that block.  Of course, mining a PoS/PoC block will also reset your Stake-Days to 0.  Most importantly, your Stake-Days will ALSO be reduced to 0 if you DON'T send the PoC transaction in a timely manner.  So you will not be able to let your coins lie dormant and and let your Stake-Days accumulate without being connected to the network.  You MUST be actively connected in order for your stake to accumulate.

I believe that this effectively prevents the Stake Accumulation problem.  No matter what, your Stake-Days will be reduced to 0 on a regular, random basis.  This should require a true 51% coin holdings in order to successfully pull off a 51% attack.

Furthermore, the PoC concept can be used to implement a rough time-synchronization enforcement.  In this paradigm, the timestamp can be moved forward a small amount, but never backwards.  The timestamp of the most recently generated block will serve as a reference to all connected nodes.  By sending the PoC transactions, nodes indicate their acceptance of this timestamp, and start counting up from that point.  It is understood that transactions not matching the current timestamp within X allowed variance, will be discarded.  It is understand that new blocks not matching the current timestamp within X allowed variance, will be discarded.  This is needed because of the way that PoS mining works.  The nonce used for block generation is based on the timestamp.  One nonce per second.  If people are able to manipulate time and create blocks with timestamp (nonce) far out into the future, it essentially turns into a PoW coin, because people could increment the seconds an arbitrary length of time until they find a block.  If their hardware is very fast, it would be easy to mine block after block.  A basic sanity check on the timestamp prevents this from occurring, and the only way to implement a basic timestamp sanity check is to require some level of clock synchronization.

If two competing blocks with roughly the same timestamp are generated, the one with more Stake-Days Destroyed will be chosen.  (Note, as is discussed in the linked thread, Stake-Days are not destroyed when simply sending coins in a standard transaction, as in Peercoin.)

A further refinement (not yet posted in the linked thread) is that the successful miner/minter of a block will obtain transaction fees based not only on the standard transactions, but also on the PoC transactions included in their block.  This incentivizes them not to discard PoC transactions.  These fees are true transaction fees for standard transactions, but the PoC transaction fees are generated in the coinbase transaction.  Yes, this means that somebody with a tiny amount of coins could potentially earn a multiple of their current holdings through transaction fees.  However, they would have to be very lucky, as their Stake-Days will always be very small, thus raising their effective PoS mining difficulty.
full member
Activity: 144
Merit: 100
hero member
Activity: 518
Merit: 521
Proof-of-stake will never remain decentralized:

https://bitcointalksearch.org/topic/m.6501774

Send all proof-of-stake currencies to the trashcan.
hero member
Activity: 731
Merit: 503
Libertas a calumnia
Doesn't checkpointing prevent that?
Checkpointing is a centralized solution.

The network should work well even without them.
full member
Activity: 140
Merit: 107
Random coalitions to alter the past can be formed at no cost to those colluding.

It is however not clear at all what the cost of collusion is, very much depending on the system. The Byzantine general problem assumes there is a (small) fixed number of generals. Presumably the soldiers under the command of a general are not colluding. In Lamport's model there is no cost of communication between generals. The fact that the plans are also tied to the history makes the situation much more complicated.
Pages:
Jump to: