Alternative cryptocurrencies

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Alternative Cryptocurrencies
Stefan Dziembowski
University of Warsaw
Workshop on Bitcoin, Introduction to Cryptocurrencies...

Drawbacks of Bitcoin’s PoWs
costs money
bad for
environment
1. high energy consumption
2. advantage for people with
dedica...

Drawbacks of Bitcoin transaction
system
1. lack of real anonymity
2. non-Turing complete scripts
OP_DUP OP_HASH160
02192cf...

Natural questions
Can we have:
1. PoWs where there is no mining in hardware?
2. more energy-efficient PoWs?
3. PoWs doing ...

Alternative cryptocurrencies
a) Litecoin – a currency where hardware mining is
(supposedly) harder
b) Spacemint – a curren...

Plan
1. Litecoin – a currency based on the
Scrypt hash function
2. Spacemint – a currency based on the
Proofs of Space
3. ...

Litecoin
Released in Oct 2011 by Charles Lee.
Instead of SHA256 Litecoin uses scrypt hash function
introduced in:
Colin Pe...

How scrypt works?
𝐕𝟏 = 𝐇(𝐗) 𝐕𝟐 = 𝐇(𝐕𝟐)𝐕𝟎 = 𝐗 𝐕 𝑵−𝟏 = 𝐇(𝐕 𝐍−𝟐). . .
second phase: compute the output by accessing the table...

What is known about scrypt?
[Percival, 2009]:
• it can be computed in time 𝑶(𝐍),
• to compute it one needs time 𝐓 and spac...

An observation
[Alwen, Serbinenko, STOC’15]: this definition is not
strong enough.
The adversary that wants to compute scr...

The contribution of [Alwen and Serbinenko]
1. the “right” definition:
2. a construction that satisfies this definition (us...

Open problem
Prove security of the
scrypt function in the
[Alwen, Serbinenko]
model.

Plan
1. Litecoin – a currency based on the
Scrypt hash function
2. Spacemint – a currency based on the
Proofs of Space
3. ...

Spacemint
[Sunoo Park, Krzysztof Pietrzak, Albert Kwon, Joël Alwen,
Georg Fuchsbauer, Peter Gaži, Eprint 2015]
Based on th...

Example of an application other than
cryptocurrencies
Goal: prevent malicious users from opening lots of fake
accounts.
Me...

Main difference from PoWs
To prove that one wasted n CPU cycles one needs to
perform these cycles.
while:
To prove that on...

Advantages
• more energy-efficient
• no “hardware acceleration”
• cheaper (user can devote their unused disk space)

The security definition

How to measure time and space
Time is measured in terms of the calls
to a random oracle 𝑯.
Space is measured in blocks of ...

The general scenario
verify prove
R
𝑵 blocks of length 𝑳.
...
𝐈𝐧𝐢𝐭(𝐈𝐝)
𝐏𝐫𝐨𝐨𝐟
𝐏𝐫𝐨𝐨𝐟 proveverify
prover’s memory
verifer pro...

How to define security of a PoS
Properties:
• completeness,
• soundness, and
• efficiency.
If the prover is honest then
th...

How to define the efficiency?
Let us show a very simple (but not efficient)
PoS.
Note: we have not defined the security ye...

A “trivial PoS”
𝑹 = (𝑹 𝟏, … , 𝑹 𝑵)
𝑱 ⊆ 𝟏, … , 𝑵
such that 𝑱 = 𝒌
𝑹𝒊 𝒊∈𝑱
R
𝐏𝐫𝐨𝐨𝐟
checks if
the answer
is correct
Note: if 𝑹 ...

Efficiency
verifier prover
𝐈𝐧𝐢𝐭 𝐩𝐨𝐥𝐲(𝐥𝐨𝐠 𝑵 , 𝒌) 𝐩𝐨𝐥𝐲(𝑵)
𝐏𝐫𝐨𝐨𝐟 𝐩𝐨𝐥𝐲(𝐥𝐨𝐠 𝑵 , 𝒌) 𝐩𝐨𝐥𝐲(𝐥𝐨𝐠 𝑵 , 𝒌)
We require that the computin...

How to define soundness?
Informally:
we want to force a cheating prover to constantly
waste a lot of memory.

What would be the goal of a cheating prover?
“Compress” 𝑹:
verify prove
...
Init(Id)
proof
proofverify
𝑿
𝑵 𝟎 ≪ 𝑵 “blocks”
...

Observation: a cheating prover has a simple
(but inefficient) winning strategy.
Init(Id)
erase 𝑹 but store all the
message...

Restrictions on cheating prover
We restrict his operating time.
We say that 𝑷 is an
𝑵, 𝑻 -cheating prover
if:
size of
𝑷’s ...

Security definition
A protocol is a 𝑵, 𝑻 -Proof of Space if it is
complete, efficient, and sound.
∀
𝑵, 𝑻
-cheating
prover
...

The constructions

Why is constructing the PoS schemes hard?
Time-memory tradeoffs
R
X
time
𝑵
R
𝑵
𝑵
Instead of storing 𝑵 blocks
the adversary...

Example of a time-memory
tradeoff: function inversion
𝑭: 𝟎, 𝟏 𝒏 → 𝟎, 𝟏 𝒏 – a random permutation
Fact: 𝑭 can be inverted ef...

Can we build a PoS out of it?
No 
[M. Hellman, 1980]: a time-memory tradeoff exists for
this problem:
𝑭 can be inverted i...

Main technique
𝑮 = (𝑽, 𝑬) – a directed acyclic graph with 𝑽 = 𝑵.
𝑯𝐈𝐝 – a hash function that depends on 𝐈𝐝.
(for example 𝑯 ...

Very informally
A graph that is bad if it can be “quickly” labeled if one
stores a “small” number of labels.
Example of a ...

How to build a PoS from a good
graph?
Problem: the entire 𝑹 needs to be sent to the verifier.
𝑹 = (𝑹 𝟏, … , 𝑹 𝑵)
𝑱 ⊆ 𝟏, … ...

Solution: let the prover commit to 𝑹 with a
Merkle tree.
𝑹 𝟏 𝑹 𝟐 𝑹 𝟑 𝑹 𝟒
𝑯(𝑹 𝟏, 𝑹 𝟐) 𝑯(𝑹 𝟑, 𝑹 𝟒)
𝑹 𝟓 𝑹 𝟔 𝑹 𝟕 𝑹 𝟖
𝑯(𝑹 𝟓, 𝑹 ...

New 𝐈𝐧𝐢𝐭 phase
𝐌𝐞𝐫𝐤𝐥𝐞(𝑹)
𝐈𝐝 𝐈𝐝
Compute
𝑹 = 𝑹 𝟏, … , 𝑹 𝑵 ≔ 𝒇 𝑮 𝐈𝐝
b c
a
𝑹 𝒃 𝑹 𝒄
𝑹 𝒂
checks if
𝑹 𝒂 = 𝑯 𝑰𝒅 𝒂, 𝑹 𝒃, 𝑹 𝒄
if yes...

New 𝐏𝐫𝐨𝐨𝐟 phase
In the 𝐏𝐫𝐨𝐨𝐟 phase the prover opens the Merkle
commitment to every 𝑹𝒊 he is asked about.
𝑱 ⊆ 𝟏, … , 𝑵
such...

Easy to see
𝑮 − a graph to which a malicious prover committed.
If the consistency check was ok for 𝒌 times, then most
like...

How to deal with the inconsistent
nodes?
graph 𝑮: 𝒙 inconsistent
nodes
The adversary can “save” memory
by not storing thes...

Techniques
We construct good graphs such that the time-memory
tradeoffs for computing 𝒇 𝑮 are bad.
For this we use techniq...

The results of [DFKP15]
We construct a 𝒄 𝟏 𝑵, 𝒄 𝟐 𝑵 −Proof of Space.
(for some constants 𝒄 𝟏, and 𝒄 𝟐)
We also have a cons...

A question
How to construct a
cryptocurrency on top of PoS?

Why cannot the PoS’s be used to
directly replace the PoWs?
1. PoW is single-phase, while PoS has the Init
phase
2. How to ...

Single-phase vs. “with initialization”
random 𝒙
proof 𝒔 random 𝒙
proof 𝒔
commitment 𝑪 ≔
(Merkle(f(Id)),Id)
Note: the consi...

The solution
Every user who joins the system “declares” how
much space he can devote. This is done as follows:
Gen (secret...

How to make the reward proportional
to invested resources?
Suppose we have 5 miners, with the
following proportion of spac...

Observation
Let 𝑵 𝟏, … , 𝑵 𝒌 be the memory sizes of the miners.
Suppose 𝑵 𝟏 = ⋯ = 𝑵 𝒌.
Suppose we have a random challenge ...

Easy to see:
For each 𝑷𝒊 his probability of
winning is equal to 𝟏/𝒌.
This is because for a given
commitment 𝑪 and a the ch...

But what if the 𝑵𝒊’s are not equal?
We need a function 𝑫 𝑵 𝒊
such that the following condition
yields a winner with probab...

Quality of the
blockchain
Using the function 𝑫 𝑵 𝒊
we can also define the quality
of the block chain.
First, let 𝒗𝒊 ≔ 𝑫 𝑵 ...

This solution need some small
modifications
1. To avoid bad events that happen with small
probability we need to limit the...

2. What if the amount of space in the system
increases dramatically?
Then the adversary that “starts computing the blockch...

Where does the challenge 𝒙 come from?
1. Use a NIST beacon or some other trusted source –
not a good solution for a “fully...

Problems with using previous block:
By manipulating the transaction list the miner can
produce different 𝒙𝒊
′
𝑠.
𝒙i 𝒙i+1
t...

Solution
The challenge does not depend on the transactions.
Spacemint blockchain syntax:
Block 𝑩𝒊+𝟏
s𝑖+1
signature
transac...

Yet another problem
Suppose there is a fork
blocki+1
blocki+2 block’i+2
blocki+3
If 𝐛𝐥𝐨𝐜𝐤 𝐢+𝟐
′
gives a challenge that is ...

Solution: look deeper in the past
The challenge for block 𝒊 is a hash of block 𝒊 − 𝟏𝟐𝟎.
Why not to look deeper into the pa...

A more subtle problem
In Proofs of Work mining costs, while in Proofs of Space it is
“for free”.
So a miner that sees a fo...

Solution: penalize such behavior
blocki
blocki+1
blocki+2 block’i+2
blocki+3 block’i+3
discovers that these
blocks were si...

Full description of the protocol
See [PPKAFG 2015].
This paper contains also a game-theoretic model and a
security proof.

Open problem
Understand better the
bounds in these
constructions
(currently there are
many hidden
constants)

Plan
1. Litecoin – a currency based on the
Scrypt hash function
2. Spacemint – a currency based on the
Proofs of Space
3. ...

Proofs of Stake
The “voting power” depends on how much money one
has.
Justification: people who have the money are natural...

Challenges when constructing Proof-
of-Stake currencies
Similar to the Proofs of Space (note: Proofs of Stake is
a much ea...

Other problems
1. How to distribute initial money?
2. How to force coin owners to mine?

A potential speculative attack on
PoStake coins
[Nicolas Houy, It Will Cost You Nothing to 'Kill' a Proof-of-Stake Crypto-...

Plan
1. Litecoin – a currency based on the
Scrypt hash function
2. Spacemint – a currency based on the
Proofs of Space
3. ...

Idea
Can we have a currency that does
something useful?
Some ideas proposed:
• Permacoin [A. Miller, A. Juels, E. Shi, B. ...

Permacoin
Main idea: parametrize PoWs with a large file 𝑭 (“too
large to store by individuals”).
To solve a PoW one needs ...

Why is it useful?
Can be used data that is useful for some purpose.
Difference between Permacoin and Spacemint:
• Permacoi...

Another nice feature of Permacoin
It’s PoWs are nonoutsourcable:
A miner in a mining pool can always steal the PoW
solutio...

Primecoin
Proof of Work: finding chains of primes.

Chains of primes
• Cunningham chain of the
first kind:
• 𝒑 𝟎
• 𝒑 𝟏 = 𝟐𝒑 𝟎 + 𝟏
• 𝒑 𝟐 = 𝟐𝒑 𝟏 + 𝟏
• 𝒑 𝟑 = 𝟐𝒑 𝟐 + 𝟏
• …
(all 𝒑...

Main idea of Primecoin
Proof of Work = “find as long chains as possible”
Some challenges:
1. Verification of a PoW solutio...

Yet another question
How to “link” the solution to the hash of the previous
block 𝐁𝐢?
Answer:
Require 𝒑 𝟏 + 𝟏 to be a mult...

Research direction
Any other ideas for
“useful Proofs of
Work”?

Plan
1. Litecoin – a currency based on the
Scrypt hash function
2. Spacemint – a currency based on the
Proofs of Space
3. ...

Ethereum – a “currency
designed for contracts”
main feature: Turing-complete scripts
the transaction ledger is maintained ...

Research direction
Understand the
impact of verifier’s
dillema

Plan
1. Litecoin – a currency based on the
Scrypt hash function
2. Spacemint – a currency based on the
Proofs of Space
3. ...

Namecoin (NMC)– a
decentralized DNS
Idea: use Bitcoin’s ledger as a DNS.
It maintains a censorship-resistant top level dom...

Thank you!

©2016 by Stefan Dziembowski. Permission to make digital or hard copies of part or
all of this material is currently grante...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

Smart contracts and applications ... by vpnmentor 1547 views
Mining pools and attacks by vpnmentor 9530 views
Alternative cryptocurrencies by vpnmentor 1364 views
Smart contracts and applications ... by vpnmentor 1982 views
Michael schapira - Hebrew Universit... by vpnmentor 1348 views
On the Security of TLS-DHE in the S... by vpnmentor 2162 views

View on Slideshare

1 of 85 Ad

View on Slideshare

1 of 85 Ad