3 ms·

Proof-of-stake is not a replacement for proof-of-work, because PoS doesn’t solve the problem of which valid chain is the canonical one. That is, when given 50 d

by runeks 9y ago

Proof-of-stake is not a replacement for proof-of-work, because PoS doesn’t solve the problem of which valid chain is the canonical one. That is, when given 50 different, valid chains, which is the right one? With PoS, the only way to agree on this is through voting (how many nodes present the various different chains — which is fragile, since bringing up additional nodes is cheap), and through centralization (central coordinator telling you which chain to choose — which adds nothing, since the double spend problem is easily solved using a central party). Fundamentally, PoS solves the wrong problem: the difficult problem is not who gets to extend the chain, it’s deciding which chain to extend in the first place.

JohnJamesRambo 9y ago
I'm sorry but it is and does. https://en.wikipedia.org/wiki/Proof-of-stake https://en.wikipedia.org/wiki/Proof-of-stake https://github.com/ethereum/wiki/wiki/Proof-of-Stake-FAQ https://github.com/ethereum/wiki/wiki/Proof-of-Stake-FAQ
- runeks 9y ago
  I’m well aware that it’s intended as a replacement for PoW, but I’m pointing out that they have very different security guarantees. For example: imagine there's a vulnerability in the reference client. With PoS, a payload can compromise nodes and replace their chain with another (valid) chain, leaving everyone wondering which chain is the right one. With PoW, no attacker can alter the chain without invalidating its proof-of-work.
DennisP 9y ago
Casper does have a fork choice rule. Basically the chosen chain is the one that destroys the least amount of staker ETH.
- runeks 9y ago
  So the chosen chain will never include proofs-of-staker-fraud (since these destroy staker ETH)?
  - DennisP 9y ago
    It definitely will include fraud proofs. But I'm not up on it well enough to cite the exact rule.
Certhas 9y ago
So a central bank approved proof-of-stake chain could displace a major part of the banking sector.
wcoenen 9y ago
The idea is to vote not by bringing nodes online, but with a stake. Meaning you sign with a private key which is linked to a certain amount of cryptocurrency. To make sure that something is actually at stake and you don't just vote 50 times on 50 different valid forks, anyone can submit proof to the chain (or rather, any fork of the chain) which shows that a certain stake voted for multiple conflicting forks. In that case the stake is destroyed in all of those forks. Part of the stake may be given to the reporter as incentive for such reporting. The result is that stakers need to pick one fork, and the one with the most votes (weighted by the amount of currency behind them) wins.
- runeks 9y ago
  > Meaning you sign with a private key which is linked to a certain amount of cryptocurrency. This requires that the 50 different chains each use the same private key for the stake. What if 50 different chains are presented in which no private keys are the same? Why would an attacker reuse the same private key for a new, but valid, chain? > [...] anyone can submit proof to the chain which shows that a certain stake voted for multiple conflicting forks. How does this solve the problem when the miners (who may have mined on multiple chains) are the ones who need to include this proof-of-fraud in the chain? What will make them include a transaction proving they've committed fraud?
  - wcoenen 9y ago
    > What if 50 different chains are presented in which no private keys are the same? The chains share state right up until the fork point. Each fork gets resolved by the signatures linked to stakes that were already established in the last shared block. > What will make them include a transaction proving they've committed fraud? A staker/miner can chose to not include proof of his own wrongdoing, but that will not prevent others from creating an alternative fork which does have that proof.
    - runeks 9y ago
      > The chains share state right up until the fork point. I’m not talking about forks. I’m talking about completely different, but valid, chains. > A staker/miner can chose to not include proof of his own wrongdoing, but that will not prevent others from creating an alternative fork which does have that proof. This brings us back to the initial problem: how do we agree on which chain is the canonical one? Also, what’s the timeout on this event happening? Unless there’s a timeout — at which point a fork changing history is ignored — some transactions in the chain remain unsettled because a fork might appear which invalidates them (because they originated from coins that were staked by a now-proven-fraudulent staker).

by runeks 9y ago

JohnJamesRambo 9y ago

I'm sorry but it is and does. https://en.wikipedia.org/wiki/Proof-of-stake https://en.wikipedia.org/wiki/Proof-of-stake https://github.com/ethereum/wiki/wiki/Proof-of-Stake-FAQ https://github.com/ethereum/wiki/wiki/Proof-of-Stake-FAQ

runeks 9y ago
I’m well aware that it’s intended as a replacement for PoW, but I’m pointing out that they have very different security guarantees. For example: imagine there's a vulnerability in the reference client. With PoS, a payload can compromise nodes and replace their chain with another (valid) chain, leaving everyone wondering which chain is the right one. With PoW, no attacker can alter the chain without invalidating its proof-of-work.

DennisP 9y ago

Casper does have a fork choice rule. Basically the chosen chain is the one that destroys the least amount of staker ETH.

runeks 9y ago
So the chosen chain will never include proofs-of-staker-fraud (since these destroy staker ETH)?
- DennisP 9y ago
  It definitely will include fraud proofs. But I'm not up on it well enough to cite the exact rule.

Certhas 9y ago

So a central bank approved proof-of-stake chain could displace a major part of the banking sector.

wcoenen 9y ago

The idea is to vote not by bringing nodes online, but with a stake. Meaning you sign with a private key which is linked to a certain amount of cryptocurrency. To make sure that something is actually at stake and you don't just vote 50 times on 50 different valid forks, anyone can submit proof to the chain (or rather, any fork of the chain) which shows that a certain stake voted for multiple conflicting forks. In that case the stake is destroyed in all of those forks. Part of the stake may be given to the reporter as incentive for such reporting. The result is that stakers need to pick one fork, and the one with the most votes (weighted by the amount of currency behind them) wins.

runeks 9y ago
> Meaning you sign with a private key which is linked to a certain amount of cryptocurrency. This requires that the 50 different chains each use the same private key for the stake. What if 50 different chains are presented in which no private keys are the same? Why would an attacker reuse the same private key for a new, but valid, chain? > [...] anyone can submit proof to the chain which shows that a certain stake voted for multiple conflicting forks. How does this solve the problem when the miners (who may have mined on multiple chains) are the ones who need to include this proof-of-fraud in the chain? What will make them include a transaction proving they've committed fraud?
- wcoenen 9y ago
  > What if 50 different chains are presented in which no private keys are the same? The chains share state right up until the fork point. Each fork gets resolved by the signatures linked to stakes that were already established in the last shared block. > What will make them include a transaction proving they've committed fraud? A staker/miner can chose to not include proof of his own wrongdoing, but that will not prevent others from creating an alternative fork which does have that proof.
  - runeks 9y ago
    > The chains share state right up until the fork point. I’m not talking about forks. I’m talking about completely different, but valid, chains. > A staker/miner can chose to not include proof of his own wrongdoing, but that will not prevent others from creating an alternative fork which does have that proof. This brings us back to the initial problem: how do we agree on which chain is the canonical one? Also, what’s the timeout on this event happening? Unless there’s a timeout — at which point a fork changing history is ignored — some transactions in the chain remain unsettled because a fork might appear which invalidates them (because they originated from coins that were staked by a now-proven-fraudulent staker).