summaryrefslogtreecommitdiff
path: root/c6/e55c480e02738860dbdb8d64860c6ca5416afc
blob: 81dccb8719cb6a4cf77fd971290b134c454a68fe (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
Return-Path: <bogdan@powx.org>
Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137])
 by lists.linuxfoundation.org (Postfix) with ESMTP id 1AB5AC0001
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Mon, 17 May 2021 19:23:15 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by smtp4.osuosl.org (Postfix) with ESMTP id F09FA40283
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Mon, 17 May 2021 19:23:14 +0000 (UTC)
X-Virus-Scanned: amavisd-new at osuosl.org
X-Spam-Flag: NO
X-Spam-Score: -1.889
X-Spam-Level: 
X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5
 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
 LOTS_OF_MONEY=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_MONEY_PERCENT=0.01]
 autolearn=ham autolearn_force=no
Authentication-Results: smtp4.osuosl.org (amavisd-new);
 dkim=pass (2048-bit key) header.d=powx-org.20150623.gappssmtp.com
Received: from smtp4.osuosl.org ([127.0.0.1])
 by localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id oCMXxTYF_i78
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Mon, 17 May 2021 19:23:12 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.8.0
Received: from mail-yb1-xb30.google.com (mail-yb1-xb30.google.com
 [IPv6:2607:f8b0:4864:20::b30])
 by smtp4.osuosl.org (Postfix) with ESMTPS id D404A40518
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Mon, 17 May 2021 19:23:11 +0000 (UTC)
Received: by mail-yb1-xb30.google.com with SMTP id i4so10079600ybe.2
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Mon, 17 May 2021 12:23:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=powx-org.20150623.gappssmtp.com; s=20150623;
 h=mime-version:from:date:message-id:subject:to:cc
 :content-transfer-encoding;
 bh=IplpDhAF1HHgwOn2j4tcjHhghSSLk88rwnKV/5tnlcY=;
 b=zPTMFosG7+KzfIcfsWzYTNyeoMXevg+DhMYN7RbFo2DUe1Og1qcMBpPh429N/HlQwU
 6dYKpcmGDnbqAjfuSTVtqlHFsB+lUXA9VZ78mVq1Oi1D7lii7ovnSwlvNlNFK12B7LpU
 ppBRtJeZvFm/Q15+jIWQYyugRG+TJoOELUJjW763dMqRQwYairT2UiBIKh6E6bVOFZ92
 1oBRfMXxjerBEDcXi0lA/E/fIzEm5W/r6HlHOAXLJD3/FjRQYssAiLHXC6ultiiQAJ7q
 O18sBX72zjHDXPZq3UV3ziSgoXkOPbt/qqMAbK2+F1/VKIjhiwi1cA40gs2zNkkze1je
 yRpA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc
 :content-transfer-encoding;
 bh=IplpDhAF1HHgwOn2j4tcjHhghSSLk88rwnKV/5tnlcY=;
 b=baHhZp5zycMi/mLSUVm8OesAes0mKNHyJP6La4CiA2VjfOX/dytZodFaoXgnUTNkal
 vOWFRE4jPGCwk/tIFDw7PrE34yM0EtDEhuwv9e1g3Q45xRqg6vPP4iw/I0lzBdYG5ZMb
 VMRnervHuiF7w8Nvjf8fyT+DhYqL8Cl7q6e13AmU0/+bjYEKEkiE744GQbkFvk9d4tuz
 UXccbeuDDjPoMR8F+gjuEKSQ6bzLrpixhfzTxUewyL4HJAbvYDgRTH9JnRkWWy3EEVlJ
 IoD8Bzu5aYOagcdC6noMpW+OA9qmnGsG/ZdoYfB/JfhIr/7NEQxCyk6hJDQVQIpH8HgX
 YJYw==
X-Gm-Message-State: AOAM530so0s0r66X7JslgeVxgjhAka/Ew2ONooj9CkVGjgbC1K4/2ccF
 y5X9DntqfvupKtZfxJqLjnu08mXAKWKsqZ2oC7ubTqQmAv3QIQ==
X-Google-Smtp-Source: ABdhPJx/PsQvVwL4oI/+nZiAVpNS91kxjigpjXG+l7E9W3E1xYSshioKpDxDCv7NwqzTnPbulfhzXFmmMKUhMXksqQo=
X-Received: by 2002:a25:e750:: with SMTP id e77mr1856037ybh.147.1621279389954; 
 Mon, 17 May 2021 12:23:09 -0700 (PDT)
MIME-Version: 1.0
From: Bogdan Penkovsky <bogdan@powx.org>
Date: Mon, 17 May 2021 21:32:08 +0200
Message-ID: <CAGFmrSac+Ej1a6da8GcPK1pB_kgowtQk5roaDCVsL9t1zgwEFA@mail.gmail.com>
To: bitcoin-dev@lists.linuxfoundation.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Mailman-Approved-At: Mon, 17 May 2021 20:32:19 +0000
Cc: Michael Dubrovsky <mike@powx.org>
Subject: [bitcoin-dev] Proposal: Low Energy Bitcoin PoW
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>, 
 <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>, 
 <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Mon, 17 May 2021 19:23:15 -0000

Hi Bitcoin Devs,

We would like to share with you a draft proposal for a durable, low
energy Bitcoin proof of work.

----

<pre>
  BIP: ?
  Title: Durable, Low Energy Bitcoin PoW
  Author: Michael Dubrovsky <mike+bip[at]powx.org>, Bogdan Penkovsky
<bogdan+bip[at]powx.org>
  Discussions-To: <mike+bip[at]powx.org>
  Comments-Summary: No comments yet.
  Comments-URI: https://github.com/PoWx-Org/obtc/wiki/BIP
  Status: Draft
  Type: Standards Track
  Created: 2021-05-13
  License: BSD-2-Clause
           OPL
</pre>


=3D=3D Simple Summary =3D=3D

Bitcoin's energy consumption is growing with its value (see Figure below).
Although scaling PoW is necessary to maintain the security of the network,
reliance on massive energy consumption has scaling drawbacks and leads to m=
ining
centralization. A major consequence of the central role of local electricit=
y
cost in mining is that today, most existing and potential participants in t=
he
Bitcoin network cannot profitably mine Bitcoin even if they have the capita=
l to
invest in mining hardware. From a practical perspective, Bitcoin adoption b=
y
companies like Tesla (which recently rescinded its acceptance of Bitcoin as
payment) has been hampered by its massive energy consumption and perceived
environmental impact.

[[https://github.com/PoWx-Org/obtc/raw/main/img/btc_energy-small.png]]

Figure. Bitcoin price and estimated Bitcoin energy consumption.
Data sources: [https://cbeci.org Cambridge Bitcoin Electricity
Consumption Index], [https://www.coindesk.com CoinDesk].

We propose a novel proof-of-work paradigm for Bitcoin--Optical proof-of-wor=
k. It
is designed to decouple Bitcoin mining from energy and make it feasible out=
side
of regions with low electricity costs. ''Optical proof-of-work'' (oPoW) is =
a
modification of Hashcash that is most efficiently computed using a new clas=
s of
photonic processors. Without compromising the cryptographic or game-theoret=
ical
security of Hashcash, oPoW shifts the operating expenses of mining (OPEX), =
to
capital expenses (CAPEX)--i.e. electricity to hardware. oPoW makes it possi=
ble
for billions of new miners to enter the market simply by investing in a
low-energy photonic miner. Shifting to a high-CAPEX PoW has the added benef=
it of
making the hashrate resilient to Bitcoin's price fluctuations - once low-OP=
EX
hardware is operating there is no reason to shut it down even if the value =
of
mining rewards diminishes. oPoW is backward compatible with GPUs, FPGAs, an=
d
ASICs meaning that a transitional period of optical and traditional hardwar=
e
mining in parallel on the network is feasible

More information is available here: [https://www.powx.org/opow].

=3D=3D Abstract =3D=3D

As Bitcoin gained utility and value over the preceding decade, the
network incentivized the purchase of billions of dollars in mining
equipment and electricity. With the growth of competition, home mining
became unprofitable. Even the most sophisticated special-purpose
hardware (ASIC miners) doesn=E2=80=99t cover its energy costs unless the mi=
ner
also has direct access to very cheap electricity. This heavy reliance
on energy makes it difficult for new miners to enter the market and
leads to hashrate instability as miners shut off their machines when
the price of Bitcoin falls. Additionally as the network stores ever
more value, the percentage of world energy consumption that is
associated with Bitcoin continues to grow, creating the potential for
scaling failure and a general backlash. To ensure that Bitcoin can
continue scaling and reach its full potential as a world currency and
store of value, we propose a low-energy proof-of-work paradigm for
Bitcoin. ''Optical proof of work (oPoW)'' is designed to decouple
Bitcoin=E2=80=99s security from massive energy use and make bitcoin mining
feasible outside of regions with low electricity costs. ''Optical
proof-of-work'' is a modification of Hashcash that is most efficiently
computed using a new class of photonic processors that has emerged as
a leading solution for ultra-low energy computing over the last 5
years. oPoW shifts the operating expenses of mining (OPEX), to capital
expenses (CAPEX)=E2=80=93i.e. electricity to hardware, without compromising
the cryptographic or game-theoretical security of Hashcash. We provide
an example implementation of oPoW, briefly discuss its cryptographic
construction as well as the working principle of photonic processors.
Additionally, we outline the potential benefits of oPoW to the bitcoin
network, including geographic decentralization and democratization of
mining as well as hashrate resilience to price fluctuations.

=3D=3D Copyright =3D=3D

This BIP is dual-licensed under the Open Publication License and BSD
2-clause license.

=3D=3D Motivation =3D=3D

As Bitcoin has grown over the past decade from a small network run by
hobbyists to a global currency, the underlying Proof of Work protocol
has not been updated. Initially pitched as a global decentralized
network (=E2=80=9Cone CPU-one vote=E2=80=9D), Bitcoin transactions today ar=
e secured
by a small group of corporate entities. In practice, it is only
feasible for [http://archive.is/YeDwh entities that can secure access
to abundant, inexpensive energy]. The economics of mining limit
profitability to places like Iceland, Texas, or Western China. Besides
the negative environmental externalities, which may be significant,
mining today is performed primarily with the consent (and in many
cases, partnership) of large public utilities and the governments that
control them. Although this may not be a problem in the short term, in
the long term it stands to erode the censorship resistance and
security of Bitcoin and other public blockchains through potential
regulation or [https://arxiv.org/pdf/1605.07524.pdf partitioning
attacks].

Recent events, such as the
[https://twitter.com/MustafaYilham/status/1384278267067203590 ~25%
hashrate crash due to coal-powered grid failure in china] and Tesla=E2=80=
=99s
rescinding of its acceptance of Bitcoin as a form of payment, show
that there are practical real-world downsides to Proof of Works=E2=80=99s
massive reliance on energy.

[[https://github.com/PoWx-Org/obtc/raw/main/img/emusk_tweet.png]]

Whether on not the Bitcoin community accepts this common criticism as
entirely valid, it has real-world effects which will only get worse
over time. Eliminating the exponentially growing energy use currently
built into Bitcoin without eliminating the security of PoW would be
ideal and should not be a partisan issue.

New consensus mechanisms have been proposed as a means of securing
cryptocurrencies whilst reducing energy cost, such as various forms of
Proof of Stake and Proof of Space-Time. While many of these
alternative mechanisms offer compelling guarantees, they generally
require new security assumptions, which have not been stress-tested by
live deployments at any adequate scale. Consequently, we still have
relatively little empirical understanding of their safety. Completely
changing the Bitcoin paradigm is likely to introduce new unforeseen
problems. We believe that the major issues discussed above can be
resolved by improving rather than eliminating Bitcoin=E2=80=99s fundamental
security layer=E2=80=94Proof of Work. Instead of devising a new consensus
architecture to fix these issues, it is sufficient to shift the
economics of PoW. The financial cost imposed on miners need not be
primarily composed of electricity. The situation can be significantly
improved by reducing the operating expense (OPEX)=E2=80=94energy=E2=80=94as=
 a major
mining component. Then, by shifting the cost towards capital expense
(CAPEX)=E2=80=94mining hardware=E2=80=94the dynamics of the mining ecosyste=
m becomes
much less dependent on electricity prices, and much less electricity
is consumed as a whole.

Moreover, a reduction in energy consumption automatically leads to
geographically distributed mining, as mining becomes profitable even
in regions with expensive electricity. Additionally, lower energy
consumption will eliminate heating issues experienced by today=E2=80=99s
mining operations, which will further decrease operating cost as well
as noise associated with fans and cooling systems. All of this means
that individuals and smaller entities would be able to enter the
mining ecosystem simply for the cost of a miner, without first gaining
access to cheap energy or a dedicated, temperature-controlled data
center. To a degree, memory-hard PoW schemes like
[https://github.com/tromp/cuckoo Cuckoo Cycle], which increase the use
of SRAM in lieu of pure computation, push the CAPEX/OPEX ratio in the
right direction by occupying ASIC chip area with memory. To maximize
the CAPEX to OPEX ratio of the Optical Proof of Work algorithm, we
developed [https://assets.pubpub.org/xi9h9rps/01581688887859.pdf
''HeavyHash''] [1]. HeavyHash is a cryptographic construction that
takes the place of SHA256 in Hashcash. Our algorithm is compatible
with ultra-energy-efficient photonic co-processors that have been
developed for machine learning hardware accelerators.

HeavyHash uses a proven digital hash (SHA3) packaged with a large
amount of MAC (Multiply-and-Accumulate) computation into a Proof of
Work puzzle. Although HeavyHash can be computed on any standard
digital hardware, it becomes hardware efficient only when a small
digital core is combined with a low-power photonic co-processor for
performing MAC operations. oPoW mining machines will have a small
digital core flip-chipped onto a large, low-power photonic chip. This
core will be bottlenecked by the throughput of the digital to analog
and analog to digital converters. A prototype of such analogue optical
matrix multiplier can be seen in the figure below.

[[https://github.com/PoWx-Org/obtc/raw/main/img/optical_chip.png]]

Figure. TOP: Photonic Circuit Diagram, A. Laser input (1550nm, common
telecom wavelength) B. Metal pads for controlling modulators to
transduce electrical data to optical C. Metal pads for tuning mesh of
directional couplers D. Optical signal exits here containing the
results of the computation and is output to fibers via a grating
coupler the terminus of each waveguide. E. Alignment circuit for
aligning fiber coupling stage. Bottom: a photograph of a bare oPoW
miner prototype chip before wire and fiber bonding. On the right side
of the die are test structures (F).

The ''HeavyHash'' derives its name from the fact that it is bloated or
weighted with additional computation. This means that a cost
comparable oPoW miner will have a much lower nominal hashrate compared
to a Bitcoin ASIC (HeavyHashes/second vs. SHA256 Hashes/second in
equivalent ASIC). We provide the cryptographic security argument of
the HeavyHash function in Section 3 in
[https://assets.pubpub.org/xi9h9rps/01581688887859.pdf Towards Optical
Proof of Work] [1]. In the article, we also provide a game-theoretic
security argument for CAPEX-heavy PoW. For additional information, we
recommend reading
[https://uncommoncore.co/wp-content/uploads/2019/10/A-model-for-Bitcoins-se=
curity-and-the-declining-block-subsidy-v1.02.pdf
this article].

While traditional digital hardware relies on electrical currents,
optical computing uses light as the basis for some of or all of its
operations. Building on the development and commercialization of
silicon photonic chips for telecom and datacom applications, modern
photonic co-processors are silicon chips made using well-established
and highly scalable silicon CMOS processes. However, unlike cutting
edge electronics which require ever-smaller features (e.g. 5 nm),
fabricated by exponentially more complex and expensive machinery,
silicon photonics uses old fabrication nodes (90 nm). Due to the large
de Broglie wavelength of photons, as compared to electrons, there is
no benefit to using the small feature sizes. The result is that access
to silicon photonic wafer fabrication is readily available, in
contrast to the notoriously difficult process of accessing advanced
nodes. Moreover, the overall cost of entry is lower as lithography
masks for silicon photonics processes are an order of magnitude
cheaper ($500k vs. $5M). Examples of companies developing optical
processors for AI, which will be compatible with oPoW include
[https://lightmatter.co/ Lightmatter], [https://www.lightelligence.ai/
Lightelligence], [https://luminous.co/ Luminous],
[https://www.intel.com/content/www/us/en/architecture-and-technology/silico=
n-photonics/silicon-photonics-overview.html
Intel], and other more recent entrants.

=3D=3D Specification =3D=3D

=3D=3D=3D HeavyHash =3D=3D=3D

The HeavyHash is performed in three stages:

# Keccak hash
# Matrix-vector multiplication
# Keccak of the result xorred with the hashed input

Note that the most efficiently matrix-vector multiplication is
performed on a photonic miner. However, this linear algebra operation
can be performed on any conventional computing hardware (CPU, GPU,
etc.), therefore making the HeavyHash compatible with any digital
device.

The algorithm=E2=80=99s pseudo-code:

<pre>// M is a Matrix 64 x 64 of Unsigned 4 values

// 256-bitVector
x1 <- keccak(input)

// Reshape the obtained bitvector
// into a 64-vector of unsigned 4-bit values
x2 <- reshape(x1, 64)

// Perform a matrix-vector multiplication.
// The result is 64-vector of 14-bit unsigned.
x3 <- vector_matrix_mult(x2, M)

// Truncate all values to 4 most significant bits.
// This is due to the specifics of analog
// computing by the photonic accelerator.
// Obtain a 64-vector of 4-bit unsigned.
x4 <- truncate_to_msb(x3, 4)

// Interpret as a 256-bitvector
x5 <- flatten(x4)

// 256-bitVector
result <- keccak(xor(x5, x1))</pre>

Which in C can be implemented as:

<pre>
static void heavyhash(const uint16_t matrix[64][64], void* pdata,
size_t pdata_len, void* output)
{
    uint8_t hash_first[32] __attribute__((aligned(32)));
    uint8_t hash_second[32] __attribute__((aligned(32)));
    uint8_t hash_xored[32] __attribute__((aligned(32)));

    uint16_t vector[64] __attribute__((aligned(64)));
    uint16_t product[64] __attribute__((aligned(64)));

    sha3_256((uint8_t*) hash_first, 32, (const uint8_t*)pdata, pdata_len);

    for (int i =3D 0; i < 32; ++i) {
        vector[2*i] =3D (hash_first[i] >> 4);
        vector[2*i+1] =3D hash_first[i] & 0xF;
    }

    for (int i =3D 0; i < 64; ++i) {
        uint16_t sum =3D 0;
        for (int j =3D 0; j < 64; ++j) {
            sum +=3D matrix[i][j] * vector[j];
        }
        product[i] =3D (sum >> 10);
    }

    for (int i =3D 0; i < 32; ++i) {
        hash_second[i] =3D (product[2*i] << 4) | (product[2*i+1]);
    }

    for (int i =3D 0; i < 32; ++i) {
        hash_xored[i] =3D hash_first[i] ^ hash_second[i];
    }
    sha3_256((uint8_t*)output, 32, (const uint8_t*)hash_xored, 32);
}
</pre>

=3D=3D=3D Random matrix generation =3D=3D=3D

The random matrix M (which is a HeavyHash parameter) is obtained in a
deterministic way and is changed every block. Matrix M coefficients
are generated using a pseudo-random number generation algorithm
(xoshiro) from the previous block header. If the matrix is not full
rank, it is repeatedly generated again.

An example code to obtain the matrix M:

<pre>
void generate_matrix(uint16_t matrix[64][64], struct xoshiro_state *state) =
{
    do {
        for (int i =3D 0; i < 64; ++i) {
            for (int j =3D 0; j < 64; j +=3D 16) {
                uint64_t value =3D xoshiro_gen(state);
                for (int shift =3D 0; shift < 16; ++shift) {
                    matrix[i][j + shift] =3D (value >> (4*shift)) & 0xF;
                }
            }
        }
    } while (!is_full_rank(matrix));
}

static inline uint64_t xoshiro_gen(struct xoshiro_state *state) {
    const uint64_t result =3D rotl64(state->s[0] + state->s[3], 23) + state=
->s[0];

    const uint64_t t =3D state->s[1] << 17;

    state->s[2] ^=3D state->s[0];
    state->s[3] ^=3D state->s[1];
    state->s[1] ^=3D state->s[2];
    state->s[0] ^=3D state->s[3];

    state->s[2] ^=3D t;

    state->s[3] =3D rotl64(state->s[3], 45);

    return result;
}
</pre>

=3D=3D Discussion =3D=3D

=3D=3D=3D Geographic Distribution of Mining Relative to CAPEX-OPEX Ratio of
Mining Costs =3D=3D=3D

Below is a simple model showing several scenarios for the geographic
distribution of mining activity relative to the CAPEX/OPEX ratio of
the cost of operating a single piece of mining hardware. As the ratio
of energy consumption to hardware cost decreases, geographic
variations in energy cost cease to be a determining factor in miner
distribution.

Underlying assumptions: 1. Electricity price y is fixed in time but
varies geographically. 2. Every miner has access to the same hardware.
3. Each miner=E2=80=99s budget is limited by both the cost of mining equipm=
ent
as well as the local cost of the electricity they consume

budget =3D a(p+ey),

where a is the number of mining machines, p is the machine price, e is
the total energy consumption over machine lifetime, and y is
electricity price.

Note that in locations where mining is not profitable, hashrate is zero.

[[https://github.com/PoWx-Org/obtc/raw/main/img/sim1.png]]

[[https://github.com/PoWx-Org/obtc/raw/main/img/sim2.png]]

[[https://github.com/PoWx-Org/obtc/raw/main/img/sim3.png]]


An interactive version of this diagram can be found
[https://www.powx.org/opow here].

=3D=3D=3D Why does CAPEX to OPEX shift lead to lower energy consumption? =
=3D=3D=3D

A common misconception about oPoW is that it makes mining =E2=80=9Ccheaper=
=E2=80=9D by
enabling energy-efficient hardware. There is no impact on the dollar
cost of mining a block, rather the mix of energy vs. hardware
investment changes from about 50/50 to 10/90 or better. We discuss
this at length and rigorously in our paper[1].

=3D=3D=3D Working Principles of Photonic Processors =3D=3D=3D

Photonics accelerators are made by fabricating waveguides in silicon
using standard lithography processes. Silicon is transparent to
infrared light and can act as a tiny on-chip fiber optical cable.
Silicon photonics found its first use during the 2000s in transceivers
for sending and receiving optical signals via fiber and has advanced
tremendously over the last decade.

By encoding a vector into optical intensities passing through a series
of parallel waveguides, interfering these signals in a mesh of tunable
interferometers (acting as matrix coefficients), and then detecting
the output using on-chip Germanium photodetectors, a matrix-vector
multiplication is achieved. A generalized discussion of matrix
multiplication setups using photonics/interference can be found in
[https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.73.58 Reck
et al.] and [https://arxiv.org/abs/1506.06220 Russell et al.] A
detailed discussion of several integrated photonic architectures for
matrix multiplication and corresponding tuning algorithms can be found
in [https://arxiv.org/pdf/1909.06179.pdf Pai et al.]

Below is a conceptual representation of a 3D-packaged oPoW mining
chip. Note that the majority of the real estate and cost comes from
the photonic die and the laser, with only a small digital SHA3 die
needed (as opposed to a conventional miner of the same cost, which
would have many copies of this die running in parallel).

[[https://github.com/PoWx-Org/obtc/raw/main/img/optminer.png]]

=3D=3D=3D Block Reward Considerations =3D=3D=3D

Although it is out of the scope of this proposal, the authors strongly
recommend the consideration of a change in the block reward schedule
currently implemented in Bitcoin. There is no clear way to incentivize
miners with transaction fees only, as has been successfully shown in
[https://www.cs.princeton.edu/~smattw/CKWN-CCS16.pdf On the
Instability of Bitcoin Without the Block Reward] and other
publications, therefore looking a decade or two ahead it will be
important to implement a fixed block reward or to slow the decay of
the block reward to maintain the security of the network. Given that
oPoW miners have low operating costs, once a large number of machines
are running the reward level sufficient to keep them in operation and
providing robust security can potentially be significantly smaller
than in the case of the current SHA256 ASICs securing Bitcoin.

=3D=3D=3D Implementation on the Bitcoin Network =3D=3D=3D

A hard fork is not necessarily required for the Bitcoin network to
test and eventually implement oPoW. It=E2=80=99s possible to add oPoW as a
dual PoW to Bitcoin as a soft fork. Tuning the parameters to ensure
that, for example, 99.9% of the security budget would be earned by
miners via the SHA256 Hashcash PoW and 0.1% via oPoW would create
sufficient incentive for oPoW to be stress-tested and to incentivize
the manufacture of dedicated oPoW miners. If this test is successful,
the parameters can be tuned continuously over time, e.g. oPoW share
doubling at every halving, such that oPoW accounts for some target
percentage (up to 100% in a complete SHA256 phase-out).

=3D=3D Endnotes =3D=3D

With significant progress in optical and analog
matrix-vector-multiplication chipsets over the last year, we hope to
demonstrate commercial low-energy mining on our network in the next 6
months. The current generation of optical matrix processors under
development is expected to have 10x better energy consumption per MAC
operation than digital implementations, and we expect this to improve
by another order of magnitude in future generations.

PoWx will also be publishing the designs of the current optical miner
prototypes in the near term under an open-source hardware license.

=3D=3D Acknowledgments =3D=3D

We thank all the members of the Bitcoin community who have already
given us feedback over the last several years as well as others in the
optical computing community and beyond that have given their input.




[1] M. Dubrovsky et al. Towards Optical Proof of Work, CES conference
(2020) https://assets.pubpub.org/xi9h9rps/01581688887859.pdf

[2] https://sciencex.com/news/2020-05-powering-bitcoin-silicon-photonics-po=
wer.html

[3] KISS random number generator http://www.cse.yorku.ca/~oz/marsaglia-rng.=
html




----
We have taken into account the moderator's comments we received previously.



Bogdan and Mike,

PoWx