ertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertised sites are not endorsed by theBitcoin Forum. Theymay be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.

SlipperySlope



Offline



Activity: 686

Merit: 501



Stephen Reed







Hero MemberActivity: 686Merit: 501Stephen Reed Re: [ANNOUNCE] Proof-of-Stake for Bitcoin April 25, 2014, 09:14:18 PM #2



Quote The problem with proof of stake is essentially that there is no cost to

creating a proof-of-stake. So there are two problems here:



One is that stake voters are free to vote for multiple chains, and since

only one will be the "real" chain, i.e. the one with the longest proof of

stake, the extra votes will simply go away. So there is no cost to voting

for multiple blocks. (A way to discourage this might be to use a signature

scheme where signing multiple signatures with the same key causes the key

to be revealed. But it is not clear what should be done after the fact,

since there is no consensus on which blocks exist or are 'valid' for the

proof of stake to fall back on.)



Another problem is that the stake voters are chosen 'randomly' but

deterministic ally by the content of earlier blocks. This gives a

voter to grind through blocks until he finds one which will give him

more votes in the future than he otherwise should get. Then the proof

of stake becomes a proof-of-work, but one that discourages consensus

since all voters will want to do this.



The problem is what wrecked Peercoin, which I understand is now

centralized (all blocks are signed by the developers to be valid). It is

also a problem with NXT, as of the last time any of us at

#bitcoin-wizards looked at their code.



I talk about this a bit in Section 5 of my document on ASICs and proof

of work:



https://download.wpsoftware.net/bitcoin/asic-faq.pdf





A goal of proof-of-stake is that it should be easy and cheap to create

a history, at least relative to proof-of-work. Perhaps people want this

for environmental reasons or some sort of "the people should own the

means of production" mentality. But this makes it easy to overwrite

history. As I described above, an attempt to force all participants to

participate in such fraud (thereby making it unfeasible) by, say, having

each block voted on by several random participants, doesn't work because

the random selection can always be gamed.



There have been fun conversations on #bitcoin-wizards about getting

random numbers from the sun, or cosmic radiation, or pulsars, since

these numbers would be both random and verifiable by many parties.

Certainly this would require expensive equipment for all verifying

parties, which intuitively is bad for Bitcoin because people verify

transactions for free and we want this to be as cheap and easy as

possible. (To the best of my knowledge nobody has suggested choosing

stake voters from such random numbers, though there have been many

ideas and I might've missed it. Pulsars are nice because they give us

a clock which everyone within several light years can agree on, which

is good for e.g. sharing the Bitcoin blockchain with Martians. This

is almost always a more popular discussion topic than PoS.)



It's also unclear that PoS can be equitable anyway, since selecting

voters based on "stake" seems to favor the very rich disproportionately. The problems to address as viewed by a member of the developers email list . . .

SlipperySlope



Offline



Activity: 686

Merit: 501



Stephen Reed







Hero MemberActivity: 686Merit: 501Stephen Reed Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 25, 2014, 09:43:44 PM #3 Quote from: jonald_fyookball on April 25, 2014, 07:49:18 PM A good problem solving technique is to first solve a simpler problem.



May I suggest setting aside the issue of new coin rewards,

and simply focus on how to achieve consensus

between nodes without PoW.



It quickly becomes clear that if solvable, it is non-trivial.



The core developers stated that no one has achieved

this so far.



This is what Meni said too -- you still need PoW as

issuance mechanism.



We are talking about a node creating a new block

and the rest of the network accepting it.



I think it may be possible with some kind of cryptographic

handshake between nodes, but my ideas on this are

vague at best.



EDIT: If you want to simplify the problem even further, assume all nodes trust each other and are honest.



clout



Offline



Activity: 209

Merit: 100







Full MemberActivity: 209Merit: 100 Re: [ANNOUNCE] Proof-of-Stake for Bitcoin April 26, 2014, 08:32:08 AM #4 Quote from: SlipperySlope on April 25, 2014, 09:14:18 PM



Quote The problem with proof of stake is essentially that there is no cost to

creating a proof-of-stake. So there are two problems here:



One is that stake voters are free to vote for multiple chains, and since

only one will be the "real" chain, i.e. the one with the longest proof of

stake, the extra votes will simply go away. So there is no cost to voting

for multiple blocks. (A way to discourage this might be to use a signature

scheme where signing multiple signatures with the same key causes the key

to be revealed. But it is not clear what should be done after the fact,

since there is no consensus on which blocks exist or are 'valid' for the

proof of stake to fall back on.)



Another problem is that the stake voters are chosen 'randomly' but

deterministic ally by the content of earlier blocks. This gives a

voter to grind through blocks until he finds one which will give him

more votes in the future than he otherwise should get. Then the proof

of stake becomes a proof-of-work, but one that discourages consensus

since all voters will want to do this.



The problem is what wrecked Peercoin, which I understand is now

centralized (all blocks are signed by the developers to be valid). It is

also a problem with NXT, as of the last time any of us at

#bitcoin-wizards looked at their code.



I talk about this a bit in Section 5 of my document on ASICs and proof

of work:



https://download.wpsoftware.net/bitcoin/asic-faq.pdf





A goal of proof-of-stake is that it should be easy and cheap to create

a history, at least relative to proof-of-work. Perhaps people want this

for environmental reasons or some sort of "the people should own the

means of production" mentality. But this makes it easy to overwrite

history. As I described above, an attempt to force all participants to

participate in such fraud (thereby making it unfeasible) by, say, having

each block voted on by several random participants, doesn't work because

the random selection can always be gamed.



There have been fun conversations on #bitcoin-wizards about getting

random numbers from the sun, or cosmic radiation, or pulsars, since

these numbers would be both random and verifiable by many parties.

Certainly this would require expensive equipment for all verifying

parties, which intuitively is bad for Bitcoin because people verify

transactions for free and we want this to be as cheap and easy as

possible. (To the best of my knowledge nobody has suggested choosing

stake voters from such random numbers, though there have been many

ideas and I might've missed it. Pulsars are nice because they give us

a clock which everyone within several light years can agree on, which

is good for e.g. sharing the Bitcoin blockchain with Martians. This

is almost always a more popular discussion topic than PoS.)



It's also unclear that PoS can be equitable anyway, since selecting

voters based on "stake" seems to favor the very rich disproportionately. The problems to address as viewed by a member of the developers email list . . .

transactions as proof of stake solves these issues. proof of work mining is still used to produce blocks randomly, but proof of stake ( coin days destroyed from transactions) is used for consensus. transactions as proof of stake solves these issues. proof of work mining is still used to produce blocks randomly, but proof of stake ( coin days destroyed from transactions) is used for consensus. http://the-iland.net/static/downloads/TransactionsAsProofOfStake.pdf

calian



Offline



Activity: 354

Merit: 250









Sr. MemberActivity: 354Merit: 250 Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 26, 2014, 10:13:39 AM #5 I would argue that you can't break the 21,000,000 coin guarantee and still have Bitcoin so the inflationary model of PPC is out. Instead I'd suggest a hard fork to a hybrid POW/POS system with target block times of 2 minutes. POW blocks would still target 10 minute block times and receive the block rewards + transaction fees. POS blocks would target 2.5 minute block times and receive any transaction fees included in their block. This solution continues to reward those who have invested millions in Bitcoin specific hardware while encouraging Bitcoin holders with any significant stake to run nodes.

Peter R



Offline



Activity: 1162

Merit: 1007









LegendaryActivity: 1162Merit: 1007 Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 26, 2014, 07:43:25 PM #6 Will the initial distribution of wealth in Bitcoin-PoS be exactly as per the unspent outputs in the bitcoin blockchain at a certain point in time in the future, or will you consider redistribution of wealth if you find popular support for it?



Run Bitcoin Unlimited ( www.bitcoinunlimited.info

SlipperySlope



Offline



Activity: 686

Merit: 501



Stephen Reed







Hero MemberActivity: 686Merit: 501Stephen Reed Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 01:45:10 AM #7 Quote from: Peter R on April 26, 2014, 07:43:25 PM Will the initial distribution of wealth in Bitcoin-PoS be exactly as per the unspent outputs in the bitcoin blockchain at a certain point in time in the future, or will you consider redistribution of wealth if you find popular support for it?



I would keep the blockchain as is. The best case for redistribution to add to Satoshi's social contract would be to make permanent the up-to-now unspent coins that Satoshi mined while alpha testing the live chain. Put this up for debate and see if Satoshi surfaces to comment. He could easily have disposed of, or overwritten, the private keys as they were used to create his stash of 980,000 according to

I would keep the blockchain as is. The best case for redistribution to add to Satoshi's social contract would be to make permanent the up-to-now unspent coins that Satoshi mined while alpha testing the live chain. Put this up for debate and see if Satoshi surfaces to comment. He could easily have disposed of, or overwritten, the private keys as they were used to create his stash of 980,000 according to http://bitslog.wordpress.com/2013/04/24/satoshi-s-fortune-a-more-accurate-figure/

SlipperySlope



Offline



Activity: 686

Merit: 501



Stephen Reed







Hero MemberActivity: 686Merit: 501Stephen Reed Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 03:44:54 AM

Last edit: May 29, 2014, 07:16:37 PM by SlipperySlope #8 A Bitcoin Super-Peer Network



Andytoshi, a participant in the bitcoin developers mail list advised me to solve the problem of distributed consensus. While thinking about this problem, advice given to me by others in this forum came to mind. I will attempt to solve Bitcoin proof-of-stake by solving a simpler and larger problem, revisiting the thoughts of Satoshi, in light of how Bitcoin has come to operate.



Satoshi quit commenting on this forum about the time that slush started the first mining pool. Satoshi's defining paper had no provision for pools,

yet in the recent four-day period, a mere 68 public and private pools mined all the bitcoin . . ..







https://blockchain.info/pools?timespan=4days



. . . out of a total 7,650 full nodes, and 2.6 million online wallets reported by Blockchain.info and Coinbase.



https://getaddr.bitnodes.io/



Today's Bitcoin network is different than what Satoshi may have envisioned in his defining paper, but it works.



I believe that the Satoshi Social Contract, between developers and users, accommodates a variety of network topologies and responsibilities.



To overcome the problem of how to provide distributed consensus about which version of the blockchain is correct, I propose to build a blockchain that does not fork. The coin-creating responsibility is assigned to one agent, rotated round robin every 10 minutes among the 100 largest trustworthy such agents.







A super-peer network of 100 or less pools use Chord technology to form a robust ring. A mining-permit token is advanced around the ring every 10 minutes. The pool with the token creates the new block and via solicited proof-of-stake shares, distributes the block creation reward to its clients, and to the other super-peers in the ring in proportion to their reported proof-of-stake shares. The proof-of-stake shares are to-myself transactions with a 10 minute age, in which the transaction amount in bitcoin is input into the reward distribution algorithm executed by the super-peer. Proof-of-stake shares are thus analogous to proof-of-work shares submitted to a pool today by client hashers.



Here is a diagram of Chord ring topology. These are the closely connected super-peers - the 100 pools - of the proposed Bitcoin proof-of-stake network . . .







I seek two sorts of critiques, (1) if this does not work then how could it be modified to work? (2) what are the likely attacks? I also want to be sure these ideas are clearly stated.



If the idea maybe could work then it has these advantages over the current Bitcoin network, beyond the efficiency argument of proof-of-stake vs. existing money-consuming proof-of-work . . .



A single instance of bitcoind is deterministically chosen to create the new block - there are no redundant block creation attempts, no forked blockchains, no orphans and no waste.

Internet bandwidth usage is greatly reduced in a topology where client blockchain validating and maintaining full-nodes communicate with a single pool, and potentially with a set of backup pools. High bandwidth and high availability channels between pools reflect the status quo with how Bitcoin works today.

Human judgement of pool trustworthiness removes the need to algorithmically provide it - again this is the status quo.

Because new transactions can reach a pool in one hop, and reach the pool creating the new block in one more hop, network latency is reduced, potentially allowing a reduction of confirmation times, and reducing the possibility of double-spend versus the current Bitcoin network.

The reward distribution algorithm does not have to be strictly in proportion to the offered bitcoin stake, rather it could and should be distributed in part to the super peers in return for substantial bandwidth and data security costs that they incur. Full node operators should receive sufficient reward to accommodate their expenses validating and replicating the blockchain, whose transactions grow at 3.2x annually, far in excess of Moore's Law cost reductions. The remaining large portion of the block creation reward, I propose to distribute in a manner which disproportionately rewards smaller stake holders, and perhaps somehow those wallet-owners not running full-nodes. The manner of distribution should should somehow dispel "the rich get richer".

Your thoughts? Andytoshi, a participant in the bitcoin developers mail list advised me to solve the problem of distributed consensus. While thinking about this problem, advice given to me by others in this forum came to mind. I will attempt to solve Bitcoin proof-of-stake by solving a simpler and larger problem, revisiting the thoughts of Satoshi, in light of how Bitcoin has come to operate.Satoshi quit commenting on this forum about the time that slush started the first mining pool. Satoshi's defining paper had no provision for pools,yet in the recent four-day period,. . . out of a total 7,650 full nodes, and 2.6 million online wallets reported by Blockchain.info and Coinbase.Today's Bitcoin network is different than what Satoshi may have envisioned in his defining paper, but it works.To overcome the problem of how to provide distributed consensus about which version of the blockchain is correct, I propose to build a blockchain that does not fork. The coin-creating responsibility is assigned to one agent, rotated round robin every 10 minutes among the 100 largest trustworthy such agents.A super-peer network of 100 or less pools use Chord technology to form a robust ring. A mining-permit token is advanced around the ring every 10 minutes. The pool with the token creates the new block and via solicited proof-of-stake shares, distributes the block creation reward to its clients, and to the other super-peers in the ring in proportion to their reported proof-of-stake shares. The proof-of-stake shares are to-myself transactions with a 10 minute age, in which the transaction amount in bitcoin is input into the reward distribution algorithm executed by the super-peer. Proof-of-stake shares are thus analogous to proof-of-work shares submitted to a pool today by client hashers.Here is a diagram of Chord ring topology. These are the closely connected super-peers - the 100 pools - of the proposed Bitcoin proof-of-stake network . . .I seek two sorts of critiques, (1) if this does not work then how could it be modified to work? (2) what are the likely attacks? I also want to be sure these ideas are clearly stated.Your thoughts?

clout



Offline



Activity: 209

Merit: 100







Full MemberActivity: 209Merit: 100 Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 03:54:20 AM #9 can someone please explain to me why using transactions as proof of stake does not work to solve the problems that you are attempting to address

SlipperySlope



Offline



Activity: 686

Merit: 501



Stephen Reed







Hero MemberActivity: 686Merit: 501Stephen Reed Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 04:51:58 AM #11 Quote from: jonald_fyookball on April 27, 2014, 04:35:51 AM Who chooses the 100 nodes



Somehow they form up and compete. To be fair, pools could have other pools as clients without losing the super-peer topology benefits.



The nodes are mining pools that, like today, advertise and solicit clients. The 100 is arbitrary. It is a simple a round number larger than the effective number of nodes that control bitcoin mining today. Slightly more decentralized than today. The idea is to have a high bandwidth Bitcoin network backbone to handle every one of the worlds financial transactions plus all the machine-to-machine transactions coming with the Internet-of-things. Somehow they form up and compete. To be fair, pools could have other pools as clients without losing the super-peer topology benefits.The nodes are mining pools that, like today, advertise and solicit clients. The 100 is arbitrary. It is a simple a round number larger than the effective number of nodes that control bitcoin mining today. Slightly more decentralized than today. The idea is to have a high bandwidth Bitcoin network backbone to handle every one of the worlds financial transactions plus all the machine-to-machine transactions coming with the Internet-of-things.

SlipperySlope



Offline



Activity: 686

Merit: 501



Stephen Reed







Hero MemberActivity: 686Merit: 501Stephen Reed Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 05:49:58 AM #12 Quote from: jonald_fyookball on April 27, 2014, 05:10:02 AM "Somehow" ? I think it's a critical piece you need to figure out.



Well, the first thought that comes to mind is to distribute the open source code, in the Java language, for operating a compliant pool. I would create a reference pool if I cannot sign on at least one existing Bitcoin mining pool. New pools would join the super-peer network In the same manner that Bitcoin Core clients connect to the existing network via a built-in set of IP addresses - I think,



Bitcoin pools, and altcoin pools today are advertised by their promoters, and joined by clients on the basis of human judgement. I would retain that working aspect of the status quo. Well, the first thought that comes to mind is to distribute the open source code, in the Java language, for operating a compliant pool. I would create a reference pool if I cannot sign on at least one existing Bitcoin mining pool. New pools would join the super-peer network In the same manner that Bitcoin Core clients connect to the existing network via a built-in set of IP addresses - I think,Bitcoin pools, and altcoin pools today are advertised by their promoters, and joined by clients on the basis of human judgement. I would retain that working aspect of the status quo.

clout



Offline



Activity: 209

Merit: 100







Full MemberActivity: 209Merit: 100 Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 06:16:18 AM #14 also transactions as proof of stake (tapos) is different than delegated proof of stake (dpos) although dpos uses the same consensus of proof of stake through coin days destroy from transactions.



esssentially using transaction as proof of stake allows you to come to consensus through pos and block production can be determined in any fashion you see fit. the original tapos paper uses mining for block production, but dpos makes block production faster

SlipperySlope



Offline



Activity: 686

Merit: 501



Stephen Reed







Hero MemberActivity: 686Merit: 501Stephen Reed Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 06:23:37 AM #15 Quote from: clout on April 27, 2014, 06:16:18 AM also transactions as proof of stake (tapos) is different than delegated proof of stake (dpos) although dpos uses the same consensus of proof of stake through coin days destroy from transactions.



esssentially using transaction as proof of stake allows you to come to consensus through pos and block production can be determined in any fashion you see fit. the original tapos paper uses mining for block production, but dpos makes block production faster



I believe you mean



Thanks for the tip. I am open to all improvements. I believe you mean https://bitcointalk.org/index.php?topic=354573.msg3793765#msg3793765 , which is the first thread I could find on the topic. I will study the whitepaper.Thanks for the tip. I am open to all improvements.

clout



Offline



Activity: 209

Merit: 100







Full MemberActivity: 209Merit: 100 Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 06:26:05 AM #16 Quote from: jonald_fyookball on April 27, 2014, 04:35:51 AM Who chooses the 100 nodes



each transaction has an implicit proof of stake and therefore an implicit vote towards the security of the network. everyone in the network votes for there own delegates. this is a process that is automated in the client but is easily manually adjusted. essentially the most reliable nodes will be voted to the top 100 and if they ever fail to do their job (fail to produce a block when it is their turn or do not include all confirmed transaction in their produced block) the are immediately fired since the client registers such actions and can switch votes or vote against a delegate. each transaction has an implicit proof of stake and therefore an implicit vote towards the security of the network. everyone in the network votes for there own delegates. this is a process that is automated in the client but is easily manually adjusted. essentially the most reliable nodes will be voted to the top 100 and if they ever fail to do their job (fail to produce a block when it is their turn or do not include all confirmed transaction in their produced block) the are immediately fired since the client registers such actions and can switch votes or vote against a delegate.

SlipperySlope



Offline



Activity: 686

Merit: 501



Stephen Reed







Hero MemberActivity: 686Merit: 501Stephen Reed Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 06:31:08 AM #17 Quote from: clout on April 27, 2014, 06:26:05 AM Quote from: jonald_fyookball on April 27, 2014, 04:35:51 AM Who chooses the 100 nodes



each transaction has an implicit proof of stake and therefore an implicit vote towards the security of the network. everyone in the network votes for there own delegates. this is a process that is automated in the client but is easily manually adjusted. essentially the most reliable nodes will be voted to the top 100 and if they ever fail to do their job (fail to produce a block when it is their turn or do not include all confirmed transaction in their produced block) the are immediately fired since the client registers such actions and can switch votes or vote against a delegate.

each transaction has an implicit proof of stake and therefore an implicit vote towards the security of the network. everyone in the network votes for there own delegates. this is a process that is automated in the client but is easily manually adjusted. essentially the most reliable nodes will be voted to the top 100 and if they ever fail to do their job (fail to produce a block when it is their turn or do not include all confirmed transaction in their produced block) the are immediately fired since the client registers such actions and can switch votes or vote against a delegate.

Thanks for an idea how to automate it. I was thinking that clients enroll with a pool, and possibly change to a different pool, manually using their judgement as is the case today with regard to miners and their pools. Perhaps this aspect of trustworthiness does not have to be defined algorithmically. Thanks for an idea how to automate it. I was thinking that clients enroll with a pool, and possibly change to a different pool, manually using their judgement as is the case today with regard to miners and their pools. Perhaps this aspect of trustworthiness does not have to be defined algorithmically.

clout



Offline



Activity: 209

Merit: 100







Full MemberActivity: 209Merit: 100 Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 06:37:42 AM #18 the manual process is choosing your delegate, although this can be automated so that the client simply choose one of the delegates with the best reputation. the real automation lies in using transaction as proof of stake, because it does not require that someone volunteer their stake and private key.



i think the voting process should be automated within the client, because the job that these delegates have to do is very simple - produce a block when it is your turn, include all confirmed transactions. this is not something that many would be diligent in observing, but is easily detectable by the client.

SlipperySlope



Offline



Activity: 686

Merit: 501



Stephen Reed







Hero MemberActivity: 686Merit: 501Stephen Reed Re: [ANNOUNCE] Bitcoin Proof-of-Stake April 27, 2014, 06:50:30 AM #19 Quote from: clout on April 27, 2014, 06:37:42 AM the manual process is choosing your delegate, although this can be automated so that the client simply choose one of the delegates with the best reputation. the real automation lies in using transaction as proof of stake, because it does not require that someone volunteer their stake and private key.



i think the voting process should be automated within the client, because the job that these delegates have to do is very simple - produce a block when it is your turn, include all confirmed transactions. this is not something that many would be diligent in observing, but is easily detectable by the client.



Thanks for clarifying your point. Thanks for clarifying your point.