Received-SPF: pass (sog-mx-2.v43.ch3.sourceforge.com: domain of petertodd.org
	designates 62.13.148.99 as permitted sender)
	client-ip=62.13.148.99; envelope-from=pete@petertodd.org;
	helo=outmail148099.authsmtp.net; 
Date: Mon, 18 Aug 2014 22:30:25 -0400
From: Peter Todd <pete@petertodd.org>
To: bitcoin-development@lists.sourceforge.net
Message-ID: <20140819023025.GA3074@petertodd.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="mYCpIKhGyMATD0i+"
Content-Disposition: inline
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: [Bitcoin-development] Cloud mining should be using merkle sum trees
 to prove they aren't doing fractional reserve mining
Precedence: list


--mYCpIKhGyMATD0i+
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

A number of people - most recently Gavin Andresen - have speculated that
cloud hashing operations may in fact be ponzi schemes that don't
actually own the hashing power they claim to own. The claim is that the
customers upfront purchase of hashing power is simply kept and used to
pay off existing customer profits rather than actually being used to
purchase mining equipment.

We can use merkle sum trees to detect this fraud cryptographically:

1) Put the MH/s paid for by each account into a merkle sum tree, each
with a customer supplied unique identifier. (like their email address)
This allows the customer to verify that the hashing power they paid for
has been included in the total hashing power claimed.

2) Mark blocks found by the operation publicly so they can be associated
with the specific cloud mining operation; putting the merkle sum tree
root hash into the coinbase or an OP_RETURN output would be ideal. This
allows anyone to verify that the hashing power claimed corresponds to
the # of blocks actually found.

--=20
'peter'[:-1]@petertodd.org
0000000000000000201d505432d708aa2edb656f6fe34d686b37d4747e5ff389

--mYCpIKhGyMATD0i+
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBCAAGBQJT8rbBAAoJEBmcgzuo5/CF8zIIANNpWYzw0Ir85Zg6gIr0CWWC
k/2IzrQALx9qqSex4lB81wO9VUiCs3p6HE5AFLFJur8dIVZ9F7ArPo4EARHVeq4v
AyjN88kwxdJHz2zQOyPV7Rm1o2lIU0eQaP+mBwcGPIbrRJKPFPVL+yFQBYxXyzEB
Sku+L5wdbycEOLgWFpSrVci0sj22ouprzlEgVJTG+u8sznfmi2ShPh+2mJs22RXL
rUgo81AtZc1UWJEOXKRM9txXabZhSOziVJiX7gAjy7IiE9tyqZcUrRHztJFYlo+o
DY1K/gLkOrIZVi2HbFMIb4zav+SQr/4Sftbz8+k6URdaE2FsECsUCEU/5OkvfdY=
=cTN/
-----END PGP SIGNATURE-----

--mYCpIKhGyMATD0i+--