Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a...
Transcript of Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a...
![Page 1: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/1.jpg)
Simple Proofs of Sequential WorkBram Cohen Krzysztof Pietrzak
Eurocrypt 2018, Tel Aviv, May 1st 2018
![Page 2: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/2.jpg)
Outline• What• How• Why
Proofs of Sequential Work
Sustainable Blockchains
Sketch of Construction & Proof
![Page 3: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/3.jpg)
Outline• What• How• Why
Proofs of Sequential Work
Sustainable Blockchains
Sketch of Construction & Proof
![Page 4: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/4.jpg)
Outline• What• How• Why
Proofs of Sequential Work
Sustainable Blockchains
Sketch of Construction & Proof
![Page 5: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/5.jpg)
Outline• What• How• Why
Proofs of Sequential Work
Sustainable Blockchains
Sketch of Construction & Proof
σi τi
βi
σi+1 τi+1
βi+1
αi αi+1
![Page 6: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/6.jpg)
Proofs of Sequential Work
![Page 7: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/7.jpg)
![Page 8: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/8.jpg)
puzzle: (N = p · q, x, T ) , solution: x2T
mod Nsolution computed with two exponentiation given p, q:
e← 2T mod φ(N) , x2T
= xe mod N
conjectured to require T sequential squarings given only N
x→ x2 → x22 → . . . x2
T
mod N
![Page 9: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/9.jpg)
puzzle: (N = p · q, x, T ) , solution: x2T
mod N
sequential computation ∼computation time ⇒
“send message to the future”
solution computed with two exponentiation given p, q:
e← 2T mod φ(N) , x2T
= xe mod N
conjectured to require T sequential squarings given only N
x→ x2 → x22 → . . . x2
T
mod N
![Page 10: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/10.jpg)
![Page 11: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/11.jpg)
PoSW vs. Time-Lock Puzzles
• Prove that time has passed⇒ Non-interactive time-stamps
• Send message to the futureFunctionality
![Page 12: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/12.jpg)
PoSW vs. Time-Lock Puzzles
• Prove that time has passed⇒ Non-interactive time-stamps
• Send message to the future
• Random oracle model or“sequential” hash-function
• Non-standard algebraicassumption
Functionality
Assumption
![Page 13: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/13.jpg)
PoSW vs. Time-Lock Puzzles
• Prove that time has passed⇒ Non-interactive time-stamps
• Send message to the future
• Random oracle model or“sequential” hash-function
• Non-standard algebraicassumption
Functionality
Assumption
Public vs. Private• Public-coin ⇒
Publicly verfiable• Private-coin ⇒
Designated verifier
![Page 14: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/14.jpg)
Proofs of Sequential Workaka. Verifiable Delay Algorithm
Prover Pχ←
Verifier Vstatement χ
Time T ∈ N
![Page 15: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/15.jpg)
Proofs of Sequential Workaka. Verifiable Delay Algorithm
τ = τ(χ, T ) verify(χ, T, τ) ∈accept/reject
Prover Pχ←
Verifier Vstatement χ
Time T ∈ N
![Page 16: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/16.jpg)
Proofs of Sequential Workaka. Verifiable Delay Algorithm
τ = τ(χ, T ) verify(χ, T, τ) ∈accept/reject
Completeness and Soundness in the random oracle model:
HProver Pχ←
Verifier Vstatement χ
Time T ∈ N
![Page 17: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/17.jpg)
Proofs of Sequential Workaka. Verifiable Delay Algorithm
τ = τ(χ, T ) verify(χ, T, τ) ∈accept/reject
Completeness and Soundness in the random oracle model:
HProver Pχ←
Verifier Vstatement χ
Time T ∈ N
Completeness: τ(c, T ) can be computed making T queries to H
Soundness: Computing any τ ′ s.t. verify(χ, T, τ ′) =accept forrandom χ requires almost T sequential queries to H
![Page 18: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/18.jpg)
Proofs of Sequential Workaka. Verifiable Delay Algorithm
τ = τ(χ, T ) verify(χ, T, τ) ∈accept/reject
Completeness and Soundness in the random oracle model:
HProver Pχ←
Verifier Vstatement χ
Time T ∈ N
Completeness: τ(c, T ) can be computed making T queries to H
Soundness: Computing any τ ′ s.t. verify(χ, T, τ ′) =accept forrandom χ requires almost T sequential queries to Hmassive parallelism useless to generate valid proof faster ⇒prover must make almost T sequential queries ∼ T time
![Page 19: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/19.jpg)
Three Problems of the [MMV’13] PoSW1) Space Complexity : Prover needs massive (linear in T)
space to compute proof.2) Poor/Unclear Parameters due to usage of sophisticated
combinatorial objects.3) Uniqueness : Once an accepting proof is computed, many
other valid proofs can be generated (not a problem fortime-stamping, but for blockchains).
![Page 20: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/20.jpg)
Three Problems of the [MMV’13] PoSW1) Space Complexity : Prover needs massive (linear in T)
space to compute proof.2) Poor/Unclear Parameters due to usage of sophisticated
combinatorial objects.3) Uniqueness : Once an accepting proof is computed, many
other valid proofs can be generated (not a problem fortime-stamping, but for blockchains).
1) Prover needs only O(log(T )) (not O(T )) space, e.g. forT = 242 (≈ a day) that’s ≈ 10KB vs. ≈ 1PB.
2) Simple construction and proof with good concreteparameters.
3) Awesome open problem!
New Construction
![Page 21: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/21.jpg)
Construction and Proof Sketch
![Page 22: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/22.jpg)
Three Basic Concepts
![Page 23: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/23.jpg)
DAG G = (V,E) is (e, d)depth-robust if after removing anye nodes a path of length d exists.
1 2 3 4 5 6
Depth-Robust Graphs (only [MMV’13])
Three Basic Concepts
![Page 24: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/24.jpg)
DAG G = (V,E) is (e, d)depth-robust if after removing anye nodes a path of length d exists.
1 2 3 4 5 6
Depth-Robust Graphs (only [MMV’13])
is (2, 3) depth-robust
Three Basic Concepts
![Page 25: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/25.jpg)
DAG G = (V,E) is (e, d)depth-robust if after removing anye nodes a path of length d exists.
1 2 3 4 5 6
Depth-Robust Graphs (only [MMV’13])
label `i = H(`parents(i)), e.g. `4 = H(`3, `4)
Graph Labelling
Three Basic Concepts
![Page 26: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/26.jpg)
x y
H H
x′y′
queries y = H(x), y′ = H(x′) wherey ⊆ x′ ⇒ query x′ was made after x
Random Oracles are Sequential
DAG G = (V,E) is (e, d)depth-robust if after removing anye nodes a path of length d exists.
1 2 3 4 5 6
Depth-Robust Graphs (only [MMV’13])
label `i = H(`parents(i)), e.g. `4 = H(`3, `4)
Graph Labelling
Three Basic Concepts
![Page 27: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/27.jpg)
The MMV’13 ConstructionHProver P
χ←Verifier V
statement χ
Time T = 6
![Page 28: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/28.jpg)
The MMV’13 ConstructionHProver P
χ←Verifier V
statement χ
Time T = 6
1 2 3 4 5 6
• Protocol specifies depth-robustDAG G on T nodes
• Define “fresh” random oracleHχ(·) ≡ H(χ‖·)
![Page 29: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/29.jpg)
The MMV’13 ConstructionHProver P
χ←Verifier V
statement χ
Time T = 6
• Protocol specifies depth-robustDAG G on T nodes
• Define “fresh” random oracleHχ(·) ≡ H(χ‖·)
• Compute labels of G using Hχ
`1 `2 `3 `4 `5 `6
![Page 30: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/30.jpg)
The MMV’13 ConstructionHProver P
χ←Verifier V
statement χ
Time T = 6
• Protocol specifies depth-robustDAG G on T nodes
• Define “fresh” random oracleHχ(·) ≡ H(χ‖·)
• Compute labels of G using Hχ
`1 `2 `3 `4 `5 `6
• Send commitment φ to labels to Vφ
φ
![Page 31: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/31.jpg)
The MMV’13 ConstructionHProver P
χ←Verifier V
statement χ
Time T = 6
• Protocol specifies depth-robustDAG G on T nodes
• Define “fresh” random oracleHχ(·) ≡ H(χ‖·)
• Compute labels of G using Hχ
`1 `2 `3 `4 `5 `6
• Send commitment φ to labels to Vφ
φ
• V challenged to open random subset of nodes and parents(interaction can be removed using Fiat-Shamir)
c ⊂ Vopen {`i}i∈c∪i∈parents(i)
check openings andif labels consistentwith parent labels
![Page 32: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/32.jpg)
The MMV’13 ConstructionHProver P
χ←Verifier V
statement χ
Time T = 6
φ
`′1 `′2 `′3 `′4 `′5 `′6• G is (e, d) depth-robust• φ commits P̃ to labels {`′i}i∈V• i is bad if `′i 6= H(`′parents(i))
Proof Sketch
φ
![Page 33: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/33.jpg)
The MMV’13 ConstructionHProver P
χ←Verifier V
statement χ
Time T = 6
φ
`′1 `′2 `′3 `′4 `′5 `′6• G is (e, d) depth-robust• φ commits P̃ to labels {`′i}i∈V• i is bad if `′i 6= H(`′parents(i))
Proof Sketch
φ
• Case 1: ≥ e bad nodes ⇒ will fail opening phase whp.
![Page 34: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/34.jpg)
The MMV’13 ConstructionHProver P
χ←Verifier V
statement χ
Time T = 6
φ
`′1 `′2 `′3 `′4 `′5 `′6• G is (e, d) depth-robust• φ commits P̃ to labels {`′i}i∈V• i is bad if `′i 6= H(`′parents(i))
Proof Sketch
φ
• Case 1: ≥ e bad nodes ⇒ will fail opening phase whp.• Case 2: Less than e bad labels ⇒ ∃ path of good nodes
(by (e, d) depth-robustness) ⇒ P̃ made d sequentialqueries (by sequantality of RO)
![Page 35: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/35.jpg)
The New ConstructionT = 15
![Page 36: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/36.jpg)
The New Construction
For every leaf i add all edges (j, i) where j is left sibling ofnode on path i→ root
T = 15
![Page 37: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/37.jpg)
The New Construction
For every leaf i add all edges (j, i) where j is left sibling ofnode on path i→ root
right siblingT = 15
left sibling
![Page 38: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/38.jpg)
The New Construction
For every leaf i add all edges (j, i) where j is left sibling ofnode on path i→ root
T = 15
![Page 39: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/39.jpg)
The New Construction
For every leaf i add all edges (j, i) where j is left sibling ofnode on path i→ root
`1 `2
`3
`14
`15
• P computes labelling `i = H(`parents(i)) and sends rootlabel φ = `T to V. Can be done storing only log(T ) labels.
T = 15
• V challenges P to open a subset of leaves and checksconsistency (blue and green edges!)
![Page 40: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/40.jpg)
The New Construction
For every leaf i add all edges (j, i) where j is left sibling ofnode on path i→ root
`1 `2
`3
`14
`15
• P computes labelling `i = H(`parents(i)) and sends rootlabel φ = `T to V. Can be done storing only log(T ) labels.
T = 15
• V challenges P to open a subset of leaves and checksconsistency (blue and green edges!)
PKC’00
![Page 41: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/41.jpg)
The New Construction
Proof Sketch
φ T = 15
![Page 42: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/42.jpg)
The New Construction
Proof Sketch• P̃ committed to labels `′i after sending φ = `15.• i is bad if `′i 6= H(`′parents(i)).
φ T = 15
![Page 43: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/43.jpg)
The New Construction
Proof Sketch• P̃ committed to labels `′i after sending φ = `15.• i is bad if `′i 6= H(`′parents(i)).• Let S ⊂ V denote the bad nodes and all nodes below.
φ T = 15
![Page 44: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/44.jpg)
The New Construction
Proof Sketch• P̃ committed to labels `′i after sending φ = `15.• i is bad if `′i 6= H(`′parents(i)).• Let S ⊂ V denote the bad nodes and all nodes below.• Claim 1: ∃ path going through V − S (of length T − |S|).
φ T = 15
![Page 45: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/45.jpg)
The New Construction
Proof Sketch• P̃ committed to labels `′i after sending φ = `15.• i is bad if `′i 6= H(`′parents(i)).• Let S ⊂ V denote the bad nodes and all nodes below.• Claim 1: ∃ path going through V − S (of length T − |S|).
• Claim 1: ∃ path going through V − S.
• Claim 2: P̃ can’t open |S|/T fraction of leafs.
φ T = 15
![Page 46: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/46.jpg)
The New Construction
Proof Sketch• P̃ committed to labels `′i after sending φ = `15.• i is bad if `′i 6= H(`′parents(i)).• Let S ⊂ V denote the bad nodes and all nodes below.• Claim 1: ∃ path going through V − S (of length T − |S|).
• Claim 1: ∃ path going through V − S.
• Claim 2: P̃ can’t open |S|/T fraction of leafs.
Theorem: P̃ made only T (1− ε) sequential queries⇒ will pass opening phase with prob. ≤ (1− ε)#of challenges
φ T = 15
![Page 47: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/47.jpg)
why we care
Sustainable Blockchains
σi τi
βi
σi+1 τi+1
βi+1
αi αi+1
![Page 48: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/48.jpg)
Mining Bitcoin (Proofs of Work)
![Page 49: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/49.jpg)
Mining Bitcoin (Proofs of Work)
Ecological: Massive energy & hardwarewaste.
Economical: Requires high rewards ⇒inflation and/or high transaction fees.
Security: E.g. buy old ASICs for 51%attack.
Ecological: Massive energy & hardwarewaste.
Economical: Requires high rewards ⇒inflation and/or high transaction fees.
Security: E.g. buy old ASICs for 51%attack.
![Page 50: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/50.jpg)
Can we have a more “sustainable”
Blockchain?
![Page 51: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/51.jpg)
![Page 52: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/52.jpg)
dynamicsproof of work hardness set so blocks appear ≈ every 10 minutes
Bitcoin: Proofs of Workcomputation as resource
prob. of solving PoW first ∼ fraction of hashing power
![Page 53: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/53.jpg)
dynamicsproof of work hardness set so blocks appear ≈ every 10 minutes
Bitcoin: Proofs of Work
Chia: Proofs of Space and Time
computation as resourceprob. of solving PoW first ∼ fraction of hashing power
![Page 54: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/54.jpg)
dynamicsproof of work hardness set so blocks appear ≈ every 10 minutes
Bitcoin: Proofs of Work
Chia: Proofs of Space and Timespace as resource
prob. of finding PoSpace of best quality ∼ fraction ofdedicated space
computation as resourceprob. of solving PoW first ∼ fraction of hashing power
![Page 55: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/55.jpg)
dynamicsproof of work hardness set so blocks appear ≈ every 10 minutes
Bitcoin: Proofs of Work
Chia: Proofs of Space and Timespace as resource
prob. of finding PoSpace of best quality ∼ fraction ofdedicated space
dynamicsRun PoSW on top of PoSpace for T ∼ quality of PoSpace to
“finalize” block
computation as resourceprob. of solving PoW first ∼ fraction of hashing power
![Page 56: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/56.jpg)
βi = (. . . , φi, αi)
φi : proof of work on challenge hash(βi−1) transactions
βi βi+1 βi+2 βi+3 βi+4
![Page 57: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/57.jpg)
βi = (. . . , φi, αi)
φi : proof of work on challenge hash(βi−1) transactions
σi τi σi+1 τi+1 σi+2 τi+2
σi : proof of space on challenge hash(τi−1)
τi : proof of sequential work on challenge hash(σi−1)and time parameter quality(σi−1)
βi βi+1 βi+2 βi+3 βi+4
![Page 58: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/58.jpg)
βi = (. . . , φi, αi)
φi : proof of work on challenge hash(βi−1) transactions
σi τi σi+1 τi+1 σi+2 τi+2
αi αi+1 αi+2
σi : proof of space on challenge hash(τi−1)
τi : proof of sequential work on challenge hash(σi−1)and time parameter quality(σi−1)
βi βi+1 βi+2 βi+3 βi+4
![Page 59: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/59.jpg)
βi = (. . . , φi, αi)
φi : proof of work on challenge hash(βi−1) transactions
σi τi σi+1 τi+1 σi+2 τi+2
αi αi+1 αi+2
σi : proof of space on challenge hash(τi−1)
τi : proof of sequential work on challenge hash(σi−1)and time parameter quality(σi−1)
βi βi+1 βi+2 βi+3 βi+4
NOTHING TOGRIND HERE!
![Page 60: Simple Proofs of Sequential Work · 2018. 5. 15. · other valid proofs can be generated (not a problem for time-stamping, but for blockchains). 1) Prover needs only O ( log ( T ))](https://reader036.fdocuments.in/reader036/viewer/2022062605/5fd604b4c87bd1361c145ad6/html5/thumbnails/60.jpg)