MIME-Version: 1.0
In-Reply-To: <CAJowKg+tYK9j5LTwokMGutD+-SjBQ70U=X7rqHMGSeaG2NEo9A@mail.gmail.com>
References: <CAJR7vkpRhNsQsem-nFkeubX04xx1y7aHwCENfg0d1266oOsXMw@mail.gmail.com>
	<Cwhn7YzwaDUZtOygDAgrU1UXjRPG-EiH3Fyz2c95gqOpNnNbiYL1NvhS28yK5wLJCnIqDaBrM6c574dY-O6_-bRjLIFmDe2NCxIuyV1w2dw=@protonmail.com>
	<CAJowKg+tYK9j5LTwokMGutD+-SjBQ70U=X7rqHMGSeaG2NEo9A@mail.gmail.com>
From: Bram Cohen <bram@bittorrent.com>
Date: Mon, 10 Apr 2017 07:34:47 -0700
Message-ID: <CA+KqGko1cWoe=31udzVSg8cdb2Do7CW4Gq_7WODsMOC=3Y1kTg@mail.gmail.com>
To: Erik Aronesty <erik@q32.com>
Content-Type: multipart/alternative; boundary=001a11c142109d92d3054cd0e031
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] A Small Modification to Segwit
Precedence: list

--001a11c142109d92d3054cd0e031
Content-Type: text/plain; charset=UTF-8

On Sun, Apr 9, 2017 at 11:44 AM, Erik Aronesty via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

>
> Clearly a level-playing field is critical to keeping centralization from
> being a "defining feature" of Bitcoin over the long term.   I've heard the
> term "level playing field" bandied about quite a bit.   And it seems to me
> that the risk of state actor control and botnet attacks is less than
> state-actor manipulation of specialized manufacturing of "SHA-256 forever"
> hardware.   Indeed, the reliance on a fairly simple hash seems less and
> less likely a "feature" and more of a baggage.
>
>
Whatever your hashing function the bottleneck for mining will be power.
Equihash and Cuckoo are serious attempts at making custom hardware have no
benefit over commodity hardware, but that's more about getting rid of
custom hardware manufacturers than it is about mining decentralization,
although arguably if successful it might let botnets back in, which would
improve decentralization. While those have been surprisingly successful at
resisting hardware so far, they might eventually fall as well, and if they
do they'll have even worse properties of centralizing around a mining
hardware manufacturer than sha256 does.

It would be much safer to go the other way, to a PoW function whose best
hardware implementation is particularly straightforward and well
understood. In that case it would be best to go with sha3. Sha3 also has
the benefit of using the sponge construction, which makes it particularly
resistant to asciboost-type attacks. It was picked out specifically because
its design from a security standpoint was particularly
confidence-inspiring, and in this case it actually makes a difference.
Arguably you could also go with blake2b, whose 1024 bit block size
completely obviates the asicboost concern entirely by cramming everything
into a single block. That also might have an even simpler design in
hardware than sha3, but a real expert would need to opine on that one.

--001a11c142109d92d3054cd0e031
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On S=
un, Apr 9, 2017 at 11:44 AM, Erik Aronesty via bitcoin-dev <span dir=3D"ltr=
">&lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_b=
lank">bitcoin-dev@lists.linuxfoundation.org</a>&gt;</span> wrote:<br><block=
quote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc=
 solid;padding-left:1ex"><div dir=3D"ltr"><br>Clearly a level-playing field=
 is critical to keeping centralization from being a &quot;defining feature&=
quot; of Bitcoin over the long term. =C2=A0 I&#39;ve heard the term &quot;l=
evel playing field&quot; bandied about quite a bit. =C2=A0 And it seems to =
me that the risk of state actor control and botnet attacks is less than sta=
te-actor manipulation of specialized manufacturing of &quot;SHA-256 forever=
&quot; hardware. =C2=A0 Indeed, the reliance on a fairly simple hash seems =
less and less likely a &quot;feature&quot; and more of a baggage.<div><br><=
/div></div></blockquote><div><br></div><div>Whatever your hashing function =
the bottleneck for mining will be power. Equihash and Cuckoo are serious at=
tempts at making custom hardware have no benefit over commodity hardware, b=
ut that&#39;s more about getting rid of custom hardware manufacturers than =
it is about mining decentralization, although arguably if successful it mig=
ht let botnets back in, which would improve decentralization. While those h=
ave been surprisingly successful at resisting hardware so far, they might e=
ventually fall as well, and if they do they&#39;ll have even worse properti=
es of centralizing around a mining hardware manufacturer than sha256 does.<=
/div><div><br></div><div>It would be much safer to go the other way, to a P=
oW function whose best hardware implementation is particularly straightforw=
ard and well understood. In that case it would be best to go with sha3. Sha=
3 also has the benefit of using the sponge construction, which makes it par=
ticularly resistant to asciboost-type attacks. It was picked out specifical=
ly because its design from a security standpoint was particularly confidenc=
e-inspiring, and in this case it actually makes a difference. Arguably you =
could also go with blake2b, whose 1024 bit block size completely obviates t=
he asicboost concern entirely by cramming everything into a single block. T=
hat also might have an even simpler design in hardware than sha3, but a rea=
l expert would need to opine on that one.</div></div></div></div>

--001a11c142109d92d3054cd0e031--