Date: Tue, 18 May 2021 11:58:44 +0000
To: "mike@powx.org" <mike@powx.org>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <vTGmO3qpvd7XawxARg2vvWmeP2LOCLAIBgMRWmNNmf7mok0DRhIes5JsBnooflSNk4DX2vQCuOB7hBmSjcUT_RvtF6l8gJ9Tt69TWEeowmg=@protonmail.com>
In-Reply-To: <03AA32FD-5AC0-42B0-B6D3-387BDC2B4238@powx.org>
References: <U-U9RmD3wRndUuQkzjsqm5X8BNnGKcxiIJs-fWbPMiGNaiSlENL4Yn4Ui8vUseIMse_rzgzBmV6EfkdROHEuPbA9vgf7Fkq39Hr9cs-zZbs=@protonmail.com>
 <03AA32FD-5AC0-42B0-B6D3-387BDC2B4238@powx.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Proposal: Low Energy Bitcoin PoW
Precedence: list

Good morning Michael,

> That=E2=80=99s interesting. I didn=E2=80=99t know the history of ASICBOOS=
T.

History is immaterial, what is important is the technical description of AS=
ICBOOST.
Basically, by fixing the partial computation of the second block of SHA256,=
 we could selectively vary bits in the first block of SHA256, while reusing=
 the computation of the second block.
This allows a grinder to grind more candidate blocks without recomputing th=
e second block output, reducing the needed power consumption for the same n=
umber of hashes attempted.

Here is an important writeup: https://www.mit.edu/~jlrubin/public/pdfs/Asic=
boost.pdf
It should really be required reading for anyone who dreams of changing PoW =
algorithms to read and understand this document.

There may be similar layer-crossings in any combined construction --- or ev=
en just a simple hash function --- when it is applied to a specific Bitcoin=
 block format.

>
> Our proposal (see Implementation) is to phase in oPoW slowly starting at =
a very low % of the rewards (say 1%). That should give a long testing perio=
d where there is real financial incentive for things like ASICBOOST
>
> Does that resolve or partially resolve the issue in your eyes?

It does mitigate this somewhat.

However, such a mechanism is an additional complication and there may be fu=
rther layer-crossing violations possible --- there may be an optimization t=
o have a circuit that occasionally uses SHA256d and occasionally uses oPoW,=
 that is not possible with a pure SHA256d or pure oPoW circuit.
So this mitigation is not as strong as it might appear at first glance; add=
itional layers means additional possibility of layer-crossing violations li=
ke ASICBOOST.


Regards,
ZmnSCPxj