4 ms·

Proof of stake doesn't work in practice unless we can find a source of randomness that is globally available, non-influencable and everyone can agree on [1]. At

Proof of stake doesn't work in practice unless we can find a source of randomness that is globally available, non-influencable and everyone can agree on [1]. At the moment, that source of randomness is completely elusive. It might be possible to create a random source from some form of binary astronomical event which can be widely verified but it would have an incredibly low bit rate of new randomness. One possible candidate is randomly nulling pulsars [2]. Unfortunately, the equipment required to observe this phenomenon is probably not widely available outside of large observatories. Having said that the costs would still be lower than the energy costs of the Bitcoin network. [1] http://www.truthcoin.info/blog/pos-still-pointless/ http://www.truthcoin.info/blog/pos-still-pointless/ [2] https://arxiv.org/abs/1706.05407 https://arxiv.org/abs/1706.05407

konschubert 9y ago
How about using stock markets? They are of course vulnerable to some amount of manipulation, but with a good algorithm that could be rendered sufficiently costly to become impractical.
- barbegal 9y ago
  They are probably as good as we have today but even they could be manipulated if large amounts of money was on the line. I can't see any way of introducing algorithms to make it more difficult to manipulate though.
RoboTeddy 9y ago
Can imagine a protocol for generating randomness to some arbitrary security level (at the expense of locking up security deposits): (1) Anyone can decide to become a 'randomness provider' by putting up a large security depsoit (2) Every epoch (some number of blocks), each provider chooses a private random number and commits to it by publishing its hash (3) During the next epoch but, each provider publishes the random they committed to earlier. (4) xor together all the random values. The result is a pseudorandom number everyone can agree on, and which should be sufficiently good for many applications include PoS selection If any provider fails to publish the random number they committed to, they lose their security deposit and there is no random value provided for the associated epoch. The process starts over. If you're worried about bribing attacks over all providers, recognize that all we need is a single altruistic provider to keep the system safe. Altruistic behavior may be rare compared to selfish behavior, but I think we can usually rely on its nonzero presence. If you're still really worried that collusion could be going on amongst ALL randomness providers, just become a provider yourself. It's possible for a provider to wait for all other providers to reveal their values, and then privately determine whether or not the final random value would be favorable to them; they then have the option of canceling the epoch by keeping their private value hidden and losing their security deposit. This option (in combination with a particular application, and the size of the security deposit of providers) puts a bound on what the random value can be safely used for (e.g., if it's for a lottery, the expected value of another truly random swing at the jackpot has to be lower than the value of a security deposit).
- barbegal 9y ago
  That's all well and good but who manages the security deposit?
  - RoboTeddy 9y ago
    The system itself, e.g. the code of a smart contract. Example implementation: https://github.com/randao/randao https://github.com/randao/randao
    - barbegal 9y ago
      So the randomness providers secure the deposit of their own randomness. The circularity of the system means it won't work in practice. RANDAO is secured by the proof of work miners.
      - RoboTeddy 9y ago
        Actually, this kind of "snake eating its own tail" loop is exactly how cryptocurrencies operate. For example, proof of work blockchains secure themselves by creating mining incentives with money that has value because it is secure. It works because the system can regress over time, e.g. value at t=n can be used to secure a greater amount of value at t=n+1. (Although value needn't be strictly increasing for system to operate; if value decreases, so do the security requirements)
- konschubert 9y ago
  > If you're worried about bribing attacks over all providers, recognize that all we need is a single altruistic provider to keep the system safe. Altruistic behavior may be rare compared to selfish behavior, but I think we can usually rely on its nonzero presence. You also need to be sure that the others don't ignore the single altruistic source. In a byzantine system, you can't distinguish if somebody is offline or if the others are silencing him.
  - RoboTeddy 9y ago
konschubert 9y ago
Here is how I understand the argument made in the first link: If you give people a certain block reward, say 1$ per year, then the capital they are willing to invest to gain that reward will be 1$ divided by the worldwide rate of capital returns at the given risk level. The argument is that it doesn't matter if we are dealing with capital that is locked away in mining hardware + lost as electricity or in a smart contract. The total amount of "economic work" locked away will be the same. I think that's correct. Proof of stake is not cheaper for the short-term economy than proof of work. But what about the long term? 100 years? The kind of time frame that investors don't worry about, but we as mankind should? I guess what I'm saying is that locking away capital today maybe has less long term damage than wasting extreme amounts of energy.
mhluongo 9y ago
Publicly verifiable randomness is possible without relying on astronomical events. Check out threshold relay by the Dfinity team (which we're porting to Ethereum), or RandHound and RandHerd [1]. 1 - https://eprint.iacr.org/2016/1067.pdf https://eprint.iacr.org/2016/1067.pdf
- barbegal 9y ago
  That paper assumes that at most f out of at least 3f+1 participants are dishonest. In practice one can't make that assumption since sybil attacks are easy.
  - mhluongo 9y ago
    You can bootstrap a Sybil-resistant system using PoW or some other method. This is one building block.
konschubert 9y ago
> does this apply both to blockchain-style proof of stake and BFT - style proof of stake?
- barbegal 9y ago
  Both styles since both reward the creators of a block and both select the creators of a block through some form of randomness. So in both schemes there is an incentive to bias that randomness in your favour.
  - konschubert 9y ago
    Doesn't BFT reward anyone that's validating a block? Meaning that everybody who validates the right block gets the same reward? Or is there an extra reward for the creator?

konschubert 9y ago

How about using stock markets? They are of course vulnerable to some amount of manipulation, but with a good algorithm that could be rendered sufficiently costly to become impractical.

barbegal 9y ago
They are probably as good as we have today but even they could be manipulated if large amounts of money was on the line. I can't see any way of introducing algorithms to make it more difficult to manipulate though.

RoboTeddy 9y ago

Can imagine a protocol for generating randomness to some arbitrary security level (at the expense of locking up security deposits): (1) Anyone can decide to become a 'randomness provider' by putting up a large security depsoit (2) Every epoch (some number of blocks), each provider chooses a private random number and commits to it by publishing its hash (3) During the next epoch but, each provider publishes the random they committed to earlier. (4) xor together all the random values. The result is a pseudorandom number everyone can agree on, and which should be sufficiently good for many applications include PoS selection If any provider fails to publish the random number they committed to, they lose their security deposit and there is no random value provided for the associated epoch. The process starts over. If you're worried about bribing attacks over all providers, recognize that all we need is a single altruistic provider to keep the system safe. Altruistic behavior may be rare compared to selfish behavior, but I think we can usually rely on its nonzero presence. If you're still really worried that collusion could be going on amongst ALL randomness providers, just become a provider yourself. It's possible for a provider to wait for all other providers to reveal their values, and then privately determine whether or not the final random value would be favorable to them; they then have the option of canceling the epoch by keeping their private value hidden and losing their security deposit. This option (in combination with a particular application, and the size of the security deposit of providers) puts a bound on what the random value can be safely used for (e.g., if it's for a lottery, the expected value of another truly random swing at the jackpot has to be lower than the value of a security deposit).

barbegal 9y ago
That's all well and good but who manages the security deposit?
- RoboTeddy 9y ago
  The system itself, e.g. the code of a smart contract. Example implementation: https://github.com/randao/randao https://github.com/randao/randao
  - barbegal 9y ago
    So the randomness providers secure the deposit of their own randomness. The circularity of the system means it won't work in practice. RANDAO is secured by the proof of work miners.
    - RoboTeddy 9y ago
      Actually, this kind of "snake eating its own tail" loop is exactly how cryptocurrencies operate. For example, proof of work blockchains secure themselves by creating mining incentives with money that has value because it is secure. It works because the system can regress over time, e.g. value at t=n can be used to secure a greater amount of value at t=n+1. (Although value needn't be strictly increasing for system to operate; if value decreases, so do the security requirements)
konschubert 9y ago
> If you're worried about bribing attacks over all providers, recognize that all we need is a single altruistic provider to keep the system safe. Altruistic behavior may be rare compared to selfish behavior, but I think we can usually rely on its nonzero presence. You also need to be sure that the others don't ignore the single altruistic source. In a byzantine system, you can't distinguish if somebody is offline or if the others are silencing him.
- RoboTeddy 9y ago

konschubert 9y ago

Here is how I understand the argument made in the first link: If you give people a certain block reward, say 1$ per year, then the capital they are willing to invest to gain that reward will be 1$ divided by the worldwide rate of capital returns at the given risk level. The argument is that it doesn't matter if we are dealing with capital that is locked away in mining hardware + lost as electricity or in a smart contract. The total amount of "economic work" locked away will be the same. I think that's correct. Proof of stake is not cheaper for the short-term economy than proof of work. But what about the long term? 100 years? The kind of time frame that investors don't worry about, but we as mankind should? I guess what I'm saying is that locking away capital today maybe has less long term damage than wasting extreme amounts of energy.

mhluongo 9y ago

Publicly verifiable randomness is possible without relying on astronomical events. Check out threshold relay by the Dfinity team (which we're porting to Ethereum), or RandHound and RandHerd [1]. 1 - https://eprint.iacr.org/2016/1067.pdf https://eprint.iacr.org/2016/1067.pdf

barbegal 9y ago
That paper assumes that at most f out of at least 3f+1 participants are dishonest. In practice one can't make that assumption since sybil attacks are easy.
- mhluongo 9y ago
  You can bootstrap a Sybil-resistant system using PoW or some other method. This is one building block.

konschubert 9y ago

> does this apply both to blockchain-style proof of stake and BFT - style proof of stake?

barbegal 9y ago
Both styles since both reward the creators of a block and both select the creators of a block through some form of randomness. So in both schemes there is an incentive to bias that randomness in your favour.
- konschubert 9y ago
  Doesn't BFT reward anyone that's validating a block? Meaning that everybody who validates the right block gets the same reward? Or is there an extra reward for the creator?