Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id A612CBB6 for ; Mon, 19 Feb 2018 13:41:24 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pl0-f44.google.com (mail-pl0-f44.google.com [209.85.160.44]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id C964FE4 for ; Mon, 19 Feb 2018 13:41:23 +0000 (UTC) Received: by mail-pl0-f44.google.com with SMTP id x18so92690pln.0 for ; Mon, 19 Feb 2018 05:41:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=8BIG38ypVmVXmtQyMlmqH5QOkr7KL+TeMZ9rLvtyH9A=; b=Wny4FXoPezoFyZsRwb7tgxTpv7qe9MnEHaaoCU9RBlLB7AO2pO/g3oBewOSgwDAaWf TBLcFhsaOTRGQIqJVKdbc5ANxrSAJRv8ke9UTdGmfGrU/1e6wr/ao4cWzt9KvIxZeN9c EGk72if1iIupwkT+tuRP73yUfEO4Su0pAvqS5HMMMJpkX0q99UlnBhsGL53XVGRBgxtP 049c8XENmJ1+ROIjM04WUk70jPbSlho0YNYVFirL8SLiQJLSjGWheOqo8cRoySGCFGdf 0iyj9mZC4Yeacv7wPvu8Gok/Ub4o8Jjebq7qgbBPyDpMNuhipKzAcsh85kWBjyMvM6Ml vkdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=8BIG38ypVmVXmtQyMlmqH5QOkr7KL+TeMZ9rLvtyH9A=; b=a5LUVEkRAV1nuo7JYYJy/1crK6rL68ltj+peds/tfBT1yzQRo0/HSkVODQU2JCLlVt B6hwxSm4seWgUHzy8o3XyaVP5y3PuojmR3I1cWTL/p5tDTw6TzM/vWiFkNzDPE39zsCh g221knXOwLhuNPHxoPnXsVII/6H7jyc7imZpe+3DG71oAPuc18jh6XaG41HvcdNaIKsE phv09wGnB4aS9/iSBi5xMtT/na4ZZzOYfkqQFEdODu6P9D3ZYhmaaZjw38l20vcSY7QJ e2XyW/7xNySVJ22rryWyA75KsNxEZK/8rdEnS/AzLTnheUFyOFRleLtXCBmbwiY9PchC fDYg== X-Gm-Message-State: APf1xPBPxliLaqbuQapn7SPqs8+20YaUVf4HRKPaf3R8kHHn+kXWNJCf oBgdz+U6tAYQRpnkGtbhzM4yRvnYWmESmxZHmJAjGg== X-Google-Smtp-Source: AH8x224F/S7EWtS+DrkTEHVGdPIEmKqyCOQ5IkRJml4Bvq6velsoME9ZO4TC1wJpY0d8wi6gWGs8AKUSU3dRBST4SVU= X-Received: by 2002:a17:902:5a4a:: with SMTP id f10-v6mr14250706plm.308.1519047683121; Mon, 19 Feb 2018 05:41:23 -0800 (PST) MIME-Version: 1.0 Received: by 10.100.160.69 with HTTP; Mon, 19 Feb 2018 05:41:21 -0800 (PST) Received: by 10.100.160.69 with HTTP; Mon, 19 Feb 2018 05:41:21 -0800 (PST) In-Reply-To: References: From: Daniele Pinna Date: Mon, 19 Feb 2018 14:41:21 +0100 Message-ID: To: Contact@taoeffect.com, Bitcoin Dev Content-Type: multipart/alternative; boundary="0000000000008ca667056590d96a" X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, HTML_MESSAGE, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org X-Mailman-Approved-At: Mon, 19 Feb 2018 14:28:09 +0000 Subject: Re: [bitcoin-dev] Some thoughts on removing timestamps in PoW X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Feb 2018 13:41:24 -0000 --0000000000008ca667056590d96a Content-Type: text/plain; charset="UTF-8" Granted that removing the 21M coin cap is basically a non-starter in de bitcoin community I'd like to respond to a couple points in your proposal. The Y% difficulty adjustment should still be calculated through some averaging of a certain number N of past blocks. Otherwise two lucky high difficulty blocks in a row could potentially grind the network to a halt. Just imagine what would happen to the bitcoin network if the difficulty target was magically increased by 40% all of a sudden. This is certainly not likely but must be considered imo. The second, and most interesting (to me at least) is how the reward should scale with difficulty. By making the reward scale concavely (logarithmically for example) with difficulty as well as depend on past average difficulty AND total # of mined coins, it might be possible to retain something close to the 21M coin cap while also disincentivizing mining blocks with excessively large difficulties. Let D and D_0 be the difficulty of the mind block and some reference initial difficulty respectively. S and S_0 the total floating coin supply and the reference initial supply. Then the reward function could look something like this: R(D, S; D_0,S_0) =R_0(S/S_0)*Log[1+D/D_0]/Log[2] Where R_0(S/S_0) can be some decaying exponential function of the ratio S/S_0 such that initially (when S=S_0) R_0=12.5. But... As I said, this is solely for sake of argument. Daniele ---------- Forwarded message ---------- From: Tao Effect To: Bitcoin Protocol Discussion Cc: Bcc: Date: Sun, 18 Feb 2018 20:29:50 -0500 Subject: [bitcoin-dev] Some thoughts on removing timestamps in PoW Copied from: https://github.com/WebOfTrustInfo/rebooting-the- web-of-trust-spring2018/pull/13 # Blockchain Timestamps Unnecessary In Proof-of-Work? *Author: Greg Slepak ([@taoeffect@mastodon.social](https://mastodon.social/@ taoeffect))* ---- The Bitcoin blockchain has a 10-minute target blocktime that is achieved by a difficulty adjustment algorithm. I assert, or rather, pose the hypothesis, that the use of timestamps in Bitcoin's blockchain may be unnecessary, and that Bitcoin can operate with the same security guarantees without it (except as noted in [Risks and Mitigations](#risks-and-mitigations)), and therefore does not need miners to maintain global clock synchronization. The alternative difficulty adjustment algorithm would work according to the following principles: - The incentive for miners is and always has been to maximize profit. - The block reward algorithm is now modified to issue coins into perpetuity (no maximum). Any given block can issue _up to_ `X` number of coins per block. - The number of coins issued per block is now tied directly to the difficulty of the block, and the concept of "epocs" or "block reward halving" is removed. - The chain selection rule remains "chain with most proof of work" - The difficulty can be modified by miners in an arbitrary direction (up or down), but is limited in magnitude by some maximum percentage (e.g. no more than 20% deviation from the previous block), we call this `Y%`. ### Observations - Miners are free to mine blocks of whatever difficulty they choose, up to a maximum deviation - The blockchain may at times produce blocks very quickly, and at other times produce blocks more slowly - Powerful miners are incentivized to raise the difficulty to remove competitors (as is true today) - Whether miners choose to produce blocks quickly or slowly is entirely up to them. If they produce blocks quickly, each block has a lower reward, but there are more of them. If they produce blocks slowly, each block has a higher reward, but there are fewer of them. So an equilibrium will be naturally reached to produce blocks at a rate that should minimize orphans. A timestamp may still be included in blocks, but it no longer needs to be used for anything, or represent anything significant other than metadata about when the miner claims to have produced the block. ### Risks and Mitigations Such a system may introduce risks that require further modification of the protocol to mitigate. The most straightforward risk comes from the potential increase in total transaction throughput that such a change would introduce (these are the same concerns that exist with respect to raising the blocksize). The removal of timestamps would allow a cartel of miners to produce high-difficulty blocks at a fast rate, potentially resulting in additional centralization pressures not only on miners but also on full nodes who then would have greater difficulty keeping up with the additional bandwidth and storage demands. Two equally straightforward mitigations exist to address this if we are given the liberty of modifying the protocol as we wish: 1. Introducing state checkpoints into the chain itself could make it possible for full nodes to skip verification of large sections of historical data when booting up. 2. A sharded protocol, where each shard uses a "sufficiently different" PoW algorithm, would create an exit for users should the primary blockchain become captured by a cartel providing poor quality-of-service. -- Please do not email me anything that you are not comfortable also sharing with the NSA. --0000000000008ca667056590d96a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Granted that removing the 21M coin cap = is basically a non-starter in de bitcoin community I'd like to respond = to a couple points in your proposal.=C2=A0

The Y% difficulty adjustment should still be calculated = through some averaging of a certain number N of past blocks. Otherwise two = lucky high difficulty blocks in a row could potentially grind the network t= o a halt. Just imagine what would happen to the bitcoin network if the diff= iculty target was magically increased by 40% all of a sudden. This is certa= inly not likely but must be considered imo.=C2=A0
The second, and most interesting (to me at least)= is how the reward should scale with difficulty. By making the reward scale= concavely (logarithmically for example) with difficulty as well as depend = on past average difficulty AND total # of mined coins, it might be possible= to retain something close to the 21M coin cap while also disincentivizing = mining blocks with excessively large difficulties.=C2=A0

Let D and D_0 be the difficulty of the min= d block and some reference initial difficulty respectively. S and S_0 the t= otal floating coin supply and the reference initial supply. Then the reward= function could look something like this:

=
R(D, S; D_0,S_0) =3DR_0(S/S_0)*Log[1+D/D_0]/Log[2]
<= div dir=3D"auto">
Where R_0(S/S_0) can be some d= ecaying exponential function of the ratio S/S_0 such that initially (when S= =3DS_0) R_0=3D12.5.

But.= .. As I said, this is solely for sake of argument.=C2=A0

Daniele=C2=A0

---------- Forwarded message ----------
From:=C2=A0Tao Effect <contact@taoeffect.com>
To:=C2=A0Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfo= undation.org>
Cc:=C2=A0
Bcc:=C2=A0
Date:=C2=A0Sun, 18 Feb 2018 20:29:50 -0500
Subject:=C2=A0[bitcoin-dev] Some thoughts on remo= ving timestamps in PoW

# Blockchain Timestamps Unnecessary In Pr= oof-of-Work?


----

The Bitcoin blockchain has a 10-minute tar= get blocktime that is achieved by a difficulty adjustment algorithm.
<= div>
I assert, or rather, pose the hypothesis, that the use o= f timestamps in Bitcoin's blockchain may be unnecessary, and that Bitco= in can operate with the same security guarantees without it (except as note= d in [Risks and Mitigations](#risks-and-mitigations)), and therefore d= oes not need miners to maintain global clock synchronization.
The alternative difficulty adjustment algorithm would work acco= rding to the following principles:

- The incentive= for miners is and always has been to maximize profit.
- The bloc= k reward algorithm is now modified to issue coins into perpetuity (no maxim= um). Any given block can issue _up to_ `X` number of coins per block.
=
- The number of coins issued per block is now tied directly to the dif= ficulty of the block, and the concept of "epocs" or "block r= eward halving" is removed.
- The chain selection rule remain= s "chain with most proof of work"
- The difficulty can = be modified by miners in an arbitrary direction (up or down), but is limite= d in magnitude by some maximum percentage (e.g. no more than 20% deviation = from the previous block), we call this `Y%`.

### O= bservations

- Miners are free to mine blocks of wh= atever difficulty they choose, up to a maximum deviation
- The bl= ockchain may at times produce blocks very quickly, and at other times produ= ce blocks more slowly
- Powerful miners are incentivized to raise= the difficulty to remove competitors (as is true today)
- Whethe= r miners choose to produce blocks quickly or slowly is entirely up to them.= If they produce blocks quickly, each block has a lower reward, but there a= re more of them. If they produce blocks slowly, each block has a higher rew= ard, but there are fewer of them. So an equilibrium will be naturally reach= ed to produce blocks at a rate that should minimize orphans.

=
A timestamp may still be included in blocks, but it no longer ne= eds to be used for anything, or represent anything significant other than m= etadata about when the miner claims to have produced the block.
<= br>
### Risks and Mitigations

Such a sys= tem may introduce risks that require further modification of the protocol t= o mitigate.

The most straightforward risk comes fr= om the potential increase in total transaction throughput that such a chang= e would introduce (these are the same concerns that exist with respect to r= aising the blocksize). The removal of timestamps would allow a cartel of mi= ners to produce high-difficulty blocks at a fast rate, potentially resultin= g in additional centralization pressures not only on miners but also on ful= l nodes who then would have greater difficulty keeping up with the addition= al bandwidth and storage demands.

Two equally stra= ightforward mitigations exist to address this if we are given the liberty o= f modifying the protocol as we wish:

1. Introducin= g state checkpoints into the chain itself could make it possible for full n= odes to skip verification of large sections of historical data when booting= up.
2. A sharded protocol, where each shard uses a "suffici= ently different" PoW algorithm, would create an exit for users should = the primary blockchain become captured by a cartel providing poor quality-o= f-service.


--
Please do = not email me anything that you are not comfortable also sharing=C2=A0with the NSA.

--0000000000008ca667056590d96a--