MIME-Version: 1.0
References: <42cd5ffd-63e8-b738-c4ea-13d0699b1268@purse.io>
In-Reply-To: <42cd5ffd-63e8-b738-c4ea-13d0699b1268@purse.io>
From: Tier Nolan <tier.nolan@gmail.com>
Date: Sat, 5 Oct 2019 00:31:18 +0100
Message-ID: <CAE-z3OV_LL+Jww3e=gO6t=02VW7m9PK+8EaYoEVLy9NKNMiSaQ@mail.gmail.com>
To: Braydon Fuller via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="0000000000006c7d8e05941e1bea"
Subject: Re: [bitcoin-dev] Chain width expansion
Precedence: list

--0000000000006c7d8e05941e1bea
Content-Type: text/plain; charset="UTF-8"

Are you assuming no network protocol changes?

At root, the requirement is that peers can prove their total chain POW.

Since each block has the height in the coinbase, a peer can send a short
proof of height for a disconnected header and could assert the POW for that
header.

Each peer could send the the N strongest headers (lowest digest/most POW)
for their main chain and prove the height of each one.

The total chain work can be estimated as N times the POW for the lowest in
the list.  This is an interesting property of how POW works.  The 10th best
POW block will have about 10% of the total POW.

The N blocks would be spread along the chain and the peer could ask for all
headers between any 2 of them and check the different in claimed POW.  If
dishonesty is discovered, the peer can be banned and all info from that
peer wiped.

You can apply the rule hierarchically.  The honest peers would have a much
higher POW chain.  You could ask the peer to give you the N strongest
headers between 2 headers that they gave for their best chain.  You can
check that their height is between the two limits.

The peer would effectively be proving their total POW recursively.

This would require a new set of messages so you can request info about the
best chain.

It also has the nice feature that it allows you to see if multiple peers
are on the same chain, since they will have the same best blocks.

The most elegant would be something like using SNARKS to directly prove
that your chain tip has a particular POW.  The download would go tip to
genesis, unlike now when it is in the other direction.

------------------------------------------------------------------------

In regard to your proposal, I think the key is to limit things by peer,
rather than globally.

The limit to header width should be split between peers.  If you have N
outgoing peers, they get 1/N of your header download resources each.

You store the current best/most POW header chain and at least one
alternative chain per outgoing peer.

You could still prune old chains based on POW, but the best chain and the
current chain for each outgoing peer should not be pruned.

The security assumption is that a node is connected to at least one honest
node.

If you split resources between all peers, then it prevents the dishonest
nodes from flooding and wiping out the progress for the honest peer.

- Message Limiting -

I have the same objection here.  The message limiting should be per peer.

An honest peer who has just been connected to shouldn't suffer a penalty.

Your point that it is only a few minutes anyway may make this point moot
though.

--0000000000006c7d8e05941e1bea
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Are you assuming no network protocol changes?</div><d=
iv><br></div><div>At root, the requirement is that peers can prove their to=
tal chain POW.</div><div><br></div><div>Since each block has the height in =
the coinbase, a peer can send a short proof of height for a disconnected he=
ader and could assert the POW for that header.</div><div><br></div><div>Eac=
h peer could send the the N strongest headers (lowest digest/most POW) for =
their main chain and prove the height of each one.=C2=A0 <br></div><div><br=
></div><div>The total chain work can be estimated as N times the POW for th=
e lowest in the list.=C2=A0 This is an interesting property of how POW work=
s.=C2=A0 The 10th best POW block will have about 10% of the total POW.<br><=
/div><div><br></div><div>The N blocks would be spread along the chain and t=
he peer could ask for all headers between any 2 of them and check the diffe=
rent in claimed POW.=C2=A0 If dishonesty is discovered, the peer can be ban=
ned and all info from that peer wiped.</div><div><br></div><div>You can app=
ly the rule hierarchically.=C2=A0 The honest peers would have a much higher=
 POW chain.=C2=A0 You could ask the peer to give you the N strongest header=
s between 2 headers that they gave for their best chain.=C2=A0 You can chec=
k that their height is between the two limits.</div><div><br></div><div>The=
 peer would effectively be proving their total POW recursively.<br></div><d=
iv><br></div><div>This would require a new set of messages so you can reque=
st info about the best chain.</div><div><br></div><div>It also has the nice=
 feature that it allows you to see if multiple peers are on the same chain,=
 since they will have the same best blocks.<br></div><div><br></div><div>Th=
e most elegant would be something like using SNARKS to directly prove that =
your chain tip has a particular POW.=C2=A0 The download would go tip to gen=
esis, unlike now when it is in the other direction.<br></div><div><br></div=
><div>---------------------------------------------------------------------=
---<br></div><div><br></div><div>In regard to your proposal, I think the ke=
y is to limit things by peer, rather than globally.</div><div><br></div><di=
v>The limit to header width should be split between peers.=C2=A0 If you hav=
e N outgoing peers, they get 1/N of your header download resources each.</d=
iv><div><br></div><div>
You store the current best/most POW header chain and at least one alternati=
ve chain per outgoing peer.=C2=A0=20

</div><div><br></div><div>
You could still prune old chains based on POW, but the best chain and the c=
urrent chain for each outgoing peer should not be pruned.<br></div><div><br=
>

</div><div>The security assumption is that a node is connected to at least =
one honest node.</div><div><br></div><div>If you split resources between al=
l peers, then it prevents the dishonest nodes from flooding and wiping out =
the progress for the honest peer.<br></div><div><br></div><div>- Message Li=
miting -</div><div><br></div><div>I have the same objection here.=C2=A0 The=
 message limiting should be per peer.</div><div><br></div><div>An honest pe=
er who has just been connected to shouldn&#39;t suffer a penalty.</div><div=
><br></div><div>Your point that it is only a few minutes anyway may make th=
is point moot though.<br></div></div>

--0000000000006c7d8e05941e1bea--