4 ms·

IOHK (Cardano) has proven that PoS is just as safe as PoW with actual mathematical proofs that are peer reviewed by actual cryptography professors. This is actu

by Sargos 8y ago

IOHK (Cardano) has proven that PoS is just as safe as PoW with actual mathematical proofs that are peer reviewed by actual cryptography professors. This is actually a big step forward as we now have trust that there's a system that acts the exact same way as PoW but in a vastly more energy efficient way in PoS. This almost relegates PoW to a legacy technology as there's no reason to use it anymore. https://twitter.com/IOHK_Charles/status/989540452322836480 https://twitter.com/IOHK_Charles/status/989540452322836480

dlubarov 8y ago
I think that Ouroboros paper [1] is a bit overhyped. A common criticism of proof of stake is that an attacker could acquire private keys to old accounts whose coins have already been spent, then use those to build a long fork. It has been shown [2] that these attacks are not wholly preventable if we assume that posterior corruption will happen: > We shall formally prove that absent additional trust assumptions, it is impossible to achieve consensus in the presence of posterior corruptions when nodes can join or rejoin late. The only tool we have to defend against posterior corruption attacks is checkpointing. If we treat blocks beyond a certain age T as irreversible checkpoints, and posterior corruption requires going back farther than T (because of staker withdrawal delays), then continuously running nodes won't be fooled by posterior corruption forks. New nodes, or nodes which went offline for a long period, could still be fooled, but they can always "ask a friend" for a recent checkpoint. This approach is what Vitalik [3] and others call weak subjectivity. Charles et al. like to imply that they've solved this problem without resorting to weak subjectivity, but their "solution" to posterior corruption attacks is to mandate that honest parties delete private keys after using them: > in order to achieve adaptive security the blocks are signed using a key-evolving signature scheme F_KES instead of a standard signature, and honest parties are mandated to update their private key in each slot. It isn't much of a solution, since users have no incentive to delete their old private keys. [1] https://eprint.iacr.org/2018/378 https://eprint.iacr.org/2018/378 [2] https://eprint.iacr.org/2016/919 https://eprint.iacr.org/2016/919 [3] https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/ https://blog.ethereum.org/2014/11/25/proof-stake-learned-lov...

by Sargos 8y ago

dlubarov 8y ago

I think that Ouroboros paper [1] is a bit overhyped. A common criticism of proof of stake is that an attacker could acquire private keys to old accounts whose coins have already been spent, then use those to build a long fork. It has been shown [2] that these attacks are not wholly preventable if we assume that posterior corruption will happen: > We shall formally prove that absent additional trust assumptions, it is impossible to achieve consensus in the presence of posterior corruptions when nodes can join or rejoin late. The only tool we have to defend against posterior corruption attacks is checkpointing. If we treat blocks beyond a certain age T as irreversible checkpoints, and posterior corruption requires going back farther than T (because of staker withdrawal delays), then continuously running nodes won't be fooled by posterior corruption forks. New nodes, or nodes which went offline for a long period, could still be fooled, but they can always "ask a friend" for a recent checkpoint. This approach is what Vitalik [3] and others call weak subjectivity. Charles et al. like to imply that they've solved this problem without resorting to weak subjectivity, but their "solution" to posterior corruption attacks is to mandate that honest parties delete private keys after using them: > in order to achieve adaptive security the blocks are signed using a key-evolving signature scheme F_KES instead of a standard signature, and honest parties are mandated to update their private key in each slot. It isn't much of a solution, since users have no incentive to delete their old private keys. [1] https://eprint.iacr.org/2018/378 https://eprint.iacr.org/2018/378 [2] https://eprint.iacr.org/2016/919 https://eprint.iacr.org/2016/919 [3] https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/ https://blog.ethereum.org/2014/11/25/proof-stake-learned-lov...