8 ms·

A Provably Secure Proof-Of-Stake Blockchain Protocol

93 points by xiamx 10y ago

lacker 10y ago
Is anyone actually mining this cryptocurrency? It seems a bit odd to say this is a proof of concept, without proving the concept by actually running the code. It might be happening somewhere, the topic just seemed avoided by the README.
- thruflo 10y ago
  Where does it say proof of concept? The repo describes itself as a first implementation of the model described in the paper.
- jcoffland 10y ago
  The is no mining in a proof of stake blockchain. Atleast not in the traditional proof-of-work sense.
- EthanHeilman 10y ago
  Did you mistake Proof-of-Stake for Proof-of-Concept? The Satoshi whitepaper that introduced Bitcoin was released before any running code and the code was in development for a while before the currency launched. At this point in the development of cryptocurrencies there is room for experimental cryptocurrencies that aren't immediate attempts to get a production system running but provide research which currently adopted cryptocurrencies can draw from. Inventing a better jet engine should not require starting an aerospace company that builds and sells complete airplanes.
- wmf 10y ago
  They provide the code so you can prove the concept by running it yourself.
vesinisa 10y ago
Interesting! Great to see people working on a more environmentally friendly blockchain. What are the weak points of this cryptocurrency compared to Bitcoin? The white paper is very technical. Is it required that majority of stakeholders stay online and constantly take part in the network for it to function correctly?
- drcode 10y ago
  Usually the main weakness of "Proof of Stake" protocols is something called "weak subjectivity" which means that nodes that connect to the internet at a regular basis (i.e. once per month or something) have strong correctness guarantees, but nodes that go offline for long periods of time reach a situation where they can no longer distinguish the "real" from a fraudulent blockchain. Nodes that reach this state need to be manually reconnected to the correct chain. I think this is arguably an acceptable tradeoff, given the other advantages of POS.
  - petertodd 10y ago
    ...and what is the "correct" chain may be a highly contentious subject. For instance, this is likely to be contentious if a big theft happens, yet the same theft also makes it possible for the thieves to not only control the chain going forward, but also rewrite existing history as a theft can give control of private keys relevant in the past.
    - deleted 10y ago
      [deleted]
    - drcode 10y ago
      POS in general is a highly contentious subject in the cryptocurrency community and many people disagree vehemently about the tradeoffs. Peter, for instance, is a strong critic of POS- There are smart people on both sides of the debate.
      - petertodd 10y ago
        Rather than replying to my comment by talking about who I am, I'd suggest you reply to the content of my comment instead.
        drcode 10y ago
        OK sure, though I'm no expert on this subject. Well, first of all your example makes it hard to tell if you're describing a percentage-based attack (i.e. 51% attack or 34% attack etc) or a long range attack. In your example, how much % the currency are you claiming a thief has stolen? Are you saying you're using private keys to rewrite history that is based on staking deposits that predate recent chain synchronizations by the node who's view of the history is being compromised? I can respond better if I understand what you're trying to say.
gwern 10y ago
Some earlier discussion of the protocol itself: https://www.reddit.com/r/ethereum/comments/52qfwl/provably_secure_proof_of_stake_algorithm/ https://www.reddit.com/r/ethereum/comments/52qfwl/provably_s...
lappa 10y ago
I don't know why this paper needs to introduce so much already common terminology. "Corrupt" is a re-org "stable transactions" are confirmed transactions "Function maxvalid(C, C). Returns the longest chain from C ∪ {C} that does not fork from C more than k blocks." This is the recipe for partitioning consensus. All you need to do is broadcast to anyone a lower-work chain and they will be on their own fork. This is easy to do during a new sync in which the node has been offline for more than k blocks, or with a little more work you could stake grind and partition the network at the tip. The former problem is covered in section 3.2. Generally the nothing at stake problem will result in the problem of requiring some trusted source to not lie, regardless of the implementation, see https://download.wpsoftware.net/bitcoin/pos/ https://download.wpsoftware.net/bitcoin/pos/
- drcode 10y ago
  > has been offline for more than k blocks These systems require you to be online at regular intervals for proper security guarantees.
  - benchaney 10y ago
    So new users don't have proper security guarantees? That seems like a somewhat serious flaw.
    - drcode 10y ago
      Yes, this is the weakness of POS systems. Of course, with a POW system new users still need to get a trusted copy of the genesis block.
      - lappa 10y ago
        They don't, however, need trust to determine which chain has had the most work done on it. An alternative genesis with much less work done on it is suspect immediately.
    - murbard2 10y ago

93 points by xiamx 10y ago

Is anyone actually mining this cryptocurrency? It seems a bit odd to say this is a proof of concept, without proving the concept by actually running the code. It might be happening somewhere, the topic just seemed avoided by the README.

thruflo 10y ago
Where does it say proof of concept? The repo describes itself as a first implementation of the model described in the paper.
jcoffland 10y ago
The is no mining in a proof of stake blockchain. Atleast not in the traditional proof-of-work sense.
EthanHeilman 10y ago
Did you mistake Proof-of-Stake for Proof-of-Concept? The Satoshi whitepaper that introduced Bitcoin was released before any running code and the code was in development for a while before the currency launched. At this point in the development of cryptocurrencies there is room for experimental cryptocurrencies that aren't immediate attempts to get a production system running but provide research which currently adopted cryptocurrencies can draw from. Inventing a better jet engine should not require starting an aerospace company that builds and sells complete airplanes.
wmf 10y ago
They provide the code so you can prove the concept by running it yourself.

vesinisa 10y ago

Interesting! Great to see people working on a more environmentally friendly blockchain. What are the weak points of this cryptocurrency compared to Bitcoin? The white paper is very technical. Is it required that majority of stakeholders stay online and constantly take part in the network for it to function correctly?

drcode 10y ago
Usually the main weakness of "Proof of Stake" protocols is something called "weak subjectivity" which means that nodes that connect to the internet at a regular basis (i.e. once per month or something) have strong correctness guarantees, but nodes that go offline for long periods of time reach a situation where they can no longer distinguish the "real" from a fraudulent blockchain. Nodes that reach this state need to be manually reconnected to the correct chain. I think this is arguably an acceptable tradeoff, given the other advantages of POS.
- petertodd 10y ago
  ...and what is the "correct" chain may be a highly contentious subject. For instance, this is likely to be contentious if a big theft happens, yet the same theft also makes it possible for the thieves to not only control the chain going forward, but also rewrite existing history as a theft can give control of private keys relevant in the past.
  - deleted 10y ago
    [deleted]
  - drcode 10y ago
    POS in general is a highly contentious subject in the cryptocurrency community and many people disagree vehemently about the tradeoffs. Peter, for instance, is a strong critic of POS- There are smart people on both sides of the debate.
    - petertodd 10y ago
      Rather than replying to my comment by talking about who I am, I'd suggest you reply to the content of my comment instead.
      - drcode 10y ago
        OK sure, though I'm no expert on this subject. Well, first of all your example makes it hard to tell if you're describing a percentage-based attack (i.e. 51% attack or 34% attack etc) or a long range attack. In your example, how much % the currency are you claiming a thief has stolen? Are you saying you're using private keys to rewrite history that is based on staking deposits that predate recent chain synchronizations by the node who's view of the history is being compromised? I can respond better if I understand what you're trying to say.

gwern 10y ago

Some earlier discussion of the protocol itself: https://www.reddit.com/r/ethereum/comments/52qfwl/provably_secure_proof_of_stake_algorithm/ https://www.reddit.com/r/ethereum/comments/52qfwl/provably_s...

lappa 10y ago

I don't know why this paper needs to introduce so much already common terminology. "Corrupt" is a re-org "stable transactions" are confirmed transactions "Function maxvalid(C, C). Returns the longest chain from C ∪ {C} that does not fork from C more than k blocks." This is the recipe for partitioning consensus. All you need to do is broadcast to anyone a lower-work chain and they will be on their own fork. This is easy to do during a new sync in which the node has been offline for more than k blocks, or with a little more work you could stake grind and partition the network at the tip. The former problem is covered in section 3.2. Generally the nothing at stake problem will result in the problem of requiring some trusted source to not lie, regardless of the implementation, see https://download.wpsoftware.net/bitcoin/pos/ https://download.wpsoftware.net/bitcoin/pos/

drcode 10y ago
> has been offline for more than k blocks These systems require you to be online at regular intervals for proper security guarantees.
- benchaney 10y ago
  So new users don't have proper security guarantees? That seems like a somewhat serious flaw.
  - drcode 10y ago
    Yes, this is the weakness of POS systems. Of course, with a POW system new users still need to get a trusted copy of the genesis block.
    - lappa 10y ago
      They don't, however, need trust to determine which chain has had the most work done on it. An alternative genesis with much less work done on it is suspect immediately.
  - murbard2 10y ago