1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
|
Return-Path: <vitteaymeric@gmail.com>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
[172.17.192.35])
by mail.linuxfoundation.org (Postfix) with ESMTPS id A39E4486
for <bitcoin-dev@lists.linuxfoundation.org>;
Tue, 14 Feb 2017 18:43:56 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.7.6
Received: from mail-wr0-f176.google.com (mail-wr0-f176.google.com
[209.85.128.176])
by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 5BA2F131
for <bitcoin-dev@lists.linuxfoundation.org>;
Tue, 14 Feb 2017 18:43:54 +0000 (UTC)
Received: by mail-wr0-f176.google.com with SMTP id k90so175941489wrc.3
for <bitcoin-dev@lists.linuxfoundation.org>;
Tue, 14 Feb 2017 10:43:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
h=subject:to:references:cc:from:message-id:date:user-agent
:mime-version:in-reply-to;
bh=yyufG57fALQ/wAfYwdJu5g83HRieQmbuoOh6epyLE78=;
b=jYQ9RtRGvkpsFVYPxOmy4bqnMjzh3hH9/AM9j4HRHVpfOj+vEuCIlLb7zo9GoXAxZn
Wpq4xQWc/zWoWdl4eP06QdMt3NabAU/sz7UFQQ48OqlDhDGhIKvubK20ZrK62TagyLRr
T4ecpCQ42rVcnWNJY5bikfv+7CCqZRxkgx6hgpj19STRyQ2mScIdOWjuRTjRnbZjuAdY
/I3LT5CQVti4xoBGzkwzCJ6mrYB8YWFGENb0i/CyAD6Bl/5Fg3uVeoG+lH8YMLeVg+YU
bAuHGXqgTbjrHuuEnkp0zxdBZUeEwVqAZim9xfHWg9r8hoKRtTYIp340X3BItgM03Rbd
n8vg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:subject:to:references:cc:from:message-id:date
:user-agent:mime-version:in-reply-to;
bh=yyufG57fALQ/wAfYwdJu5g83HRieQmbuoOh6epyLE78=;
b=MDl1bbQUkm6U6869ObynpEpoe3MctB2zyal9jLnTqJ1yo87zxmggd4EAmKdl4vV/aW
mosVm2S+cOCjrx8WLbrxhMq5RqFGUOuu297gCic9Y6joqiHAibW62eZPxslx4qxjZ+vO
bBw/S+2b9NBFn27J/kBrz07jFpchRgNLAMTf7ElVZs+EjN5mH35CiKRCf0sV0w+5pZ7U
2TUHem3D5deoGzGvMAyVLOheF4JLWXDDSuhl41C3QpXe64JtFVvB8ZxSbxlXDSpto/eR
yzN2n7cnlD83IOrOn9Ep9P48NSvkWSQhttnsnDBHa3K8AzehDuhDpgmTFx+X0FR/klnm
75ow==
X-Gm-Message-State: AMke39lX9eFVX4Qm5dZnWnakRIBnvYy7rjRnGRnBIRcrXQGgfo8mqU1ALk+VXR5WYb9Zcg==
X-Received: by 10.223.163.26 with SMTP id c26mr24950873wrb.68.1487097832977;
Tue, 14 Feb 2017 10:43:52 -0800 (PST)
Received: from [192.168.1.10] (ANice-654-1-83-126.w90-0.abo.wanadoo.fr.
[90.0.60.126]) by smtp.googlemail.com with ESMTPSA id
136sm2286794wms.32.2017.02.14.10.43.51
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Tue, 14 Feb 2017 10:43:52 -0800 (PST)
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
References: <BL2PR03MB435AA04A0AB8AC0E7781CA7EE430@BL2PR03MB435.namprd03.prod.outlook.com>
<CAKzdR-qvDcUMcFDyS_w5XvuYi+zBzH_z9rp=EqBkN3o+MyuubA@mail.gmail.com>
<BL2PR03MB4355F39BE003DBF200591EBEE590@BL2PR03MB435.namprd03.prod.outlook.com>
<CAKzdR-p25HXQty_o0y+rS2dBz568tCjyW9kvAoBJxJuii8k9eA@mail.gmail.com>
From: Aymeric Vitte <vitteaymeric@gmail.com>
Message-ID: <9d41572e-a1c4-6a7b-f1d7-373f7c656b41@gmail.com>
Date: Tue, 14 Feb 2017 19:44:26 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:45.0) Gecko/20100101
Thunderbird/45.7.0
MIME-Version: 1.0
In-Reply-To: <CAKzdR-p25HXQty_o0y+rS2dBz568tCjyW9kvAoBJxJuii8k9eA@mail.gmail.com>
Content-Type: multipart/alternative;
boundary="------------34D7B91459FFB166F762F2D2"
X-Spam-Status: No, score=-0.5 required=5.0 tests=BAYES_00,DKIM_SIGNED,
DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,FREEMAIL_REPLY,HTML_MESSAGE,
RCVD_IN_SORBS_SPAM autolearn=no version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
smtp1.linux-foundation.org
X-Mailman-Approved-At: Tue, 14 Feb 2017 19:04:17 +0000
Subject: Re: [bitcoin-dev] Proof of Nodework (PoNW) - a method to
trustlessly reward nodes for storing and verifying the blockchain
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Feb 2017 18:43:56 -0000
This is a multi-part message in MIME format.
--------------34D7B91459FFB166F762F2D2
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 8bit
I started writing this
https://gist.github.com/Ayms/aab6f8e08fef0792ab3448f542a826bf some time
ago, but stopped since I was under the impression that this was of very
little interest for the Bitcoin community
It's not final and finished at all, but since I wrote it and don't have
plans right now to pursue it, I placed it in a gist and publish the
link, probably not everything is correct and this does not cover
everything but it can maybe give some ideas (which are for some the
combination of concepts from former/other projects) that could be
reused, addressing:
- incentive to run full nodes
- make sure that they are indeed full nodes
- make sure that they participate to the network and are efficient enough
- make sure that they don't collude in pools to get the rewards and are
independent
- set up quickly a full node (incremental torrent-like download)
As this was written this was supposed to add some modifications to the
bitcoin protocol but I don't think that's necessarily a good idea, most
likely this can be handled via sidechains and/or external systems
Le 13/02/2017 à 15:48, Sergio Demian Lerner via bitcoin-dev a écrit :
>
>
> On Mon, Feb 13, 2017 at 8:58 AM, John Hardy <john@seebitcoin.com
> <mailto:john@seebitcoin.com>> wrote:
>
> Hi Sergio,
>
>
> Thanks for your response, interesting work, very excited for RSK.
>
>
> I like the ephemeral payload, I suppose that aspect of my proposal
> could be described as ephemeral blockspace.
>
>
> I'm curious about the challenge phase, what incentive do nodes to
> have to check other nodes' responses?
>
> The reward is split between all full nodes. Therefore each full node
> has an incentive to check at least some other full nodes responses
> because there is a competition for the full node reward. At the end,
> each full node response will be checked by more than other node with
> high probability. Also each full node does a small pre-deposit, that
> is consumed if the node cheats.
>
> Is any validation of responses mandatory, or does policing the
> system rely on altruism?
>
>
> As previously said, validation is not mandatory.
>
> I also wondered how time-based responses are enforced? What
> prevents a miner censoring challenge responses so they do not get
> included in a block 'in time' - if inclusion within a block is
> the mechanism used?
>
> There is not many defenses against censorship but try to hide your
> identity until the end of the protocol. But if somebody knows that
> your transactions belong to you, then there is little defense. We just
> wait more than a single block for the commitments, so several miners
> must collude in order to censor a transaction.
>
>
> I saw your tweet on Lumino - sounds very promising. Would be keen
> to take a look at the paper if you're looking for any additional
> review at this stage.
>
> I'm keeping it private against all my desire because I want it to be
> reviewed before I publish it. Credibility is very easily lost.
> The same idea (Ephemeral Data) has been used to design the Lumino Network.
>
>
> Regards,
>
>
> John Hardy
>
>
>
> ------------------------------------------------------------------------
> *From:* Sergio Demian Lerner <sergio.d.lerner@gmail.com
> <mailto:sergio.d.lerner@gmail.com>>
> *Sent:* Sunday, February 12, 2017 8:22 PM
> *To:* John Hardy; Bitcoin Protocol Discussion
> *Subject:* Re: [bitcoin-dev] Proof of Nodework (PoNW) - a method
> to trustlessly reward nodes for storing and verifying the blockchain
>
> Hi John,
> RSK platform (a Bitcoin sidechain) is already prepared to do
> something similar to this, although very efficiently. We set apart
> 1% of the block reward to automatically reward full nodes.
>
> We have two systems being evaluated: the first is based on PoUBS
> (Proof of Unique Blockchain Storage) which uses asymmetric-time
> operations to encode the blockchain based on each user public key
> such that decoding is fast, but encoding is slow. The second is
> more traditional proof of retrievability, but it requires some
> ASIC-resistance assumptions.
>
> In both cases, a special smart contract is being called at every
> block that creates periodic challenges. Every full node that wants
> to participate can submits a commitment to the Merkle hash root of
> a pseudo-random sequence of encoded blocks. Then the smart
> contract chooses random elements from the committed dataset, and
> each full node has a period to submit Merkle-proofs that such
> random elements belong to the commitment.
>
> To prevent blockchain bloat we designed a very cool new type of
> transaction payload: Ephemeral Payload. Ephemeral payload is a
> payload in a transaction that gets discarded after N blocks if no
> smart contract does reference it. If is does, it's solidified
> forever in the blockchain.
> Then there is a challenge phase where other full nodes can inform
> the smart contract if they find an error in the submitted
> responses. Then the smart contract ONLY evaluates the responses
> which have been questioned by users.
>
> This way the smart contract does very little computation (only
> when a user misbehaves) and the blockchain normally does not store
> any proof forever (only the ones created by misbehaving users).
>
> Because RSK/Rootstock has a very short block interval (10
> seconds), all this happens very quickly and does not require much
> computation.
>
> Best regards,
> Sergio Lerner
> Chief Scientist RSK (aka Roostock)
>
>
> On Tue, Feb 7, 2017 at 8:27 AM, John Hardy via bitcoin-dev
> <bitcoin-dev@lists.linuxfoundation.org
> <mailto:bitcoin-dev@lists.linuxfoundation.org>> wrote:
>
> Proof of Nodework (PoNW) is a way to reward individual nodes
> for keeping a full copy of and verifying the blockchain.
>
>
> Hopefully they also do useful ‘traditional’ node activities
> too like relay transactions and blocks, but there isn’t really
> any way I can think of to trustlessly verify this also.
>
>
> PoNW would require a new separate area of block space, a
> nodeblock, purely concerned with administering the system. A
> nodeblock is committed to a block as with SegWit. A recent
> history of nodeblocks needs to be stored by nodes, however the
> data eventually becomes obsolete and so does not need to be
> retained forever.
>
>
> In order to prevent Sybil, a node must register an Bitcoin
> address by submitting an addNode transaction - along with a
> security deposit to prevent cheating.
>
>
> This transaction will be stored in the nodeblock. Once a node
> can see that its addNode transaction has been added it can
> begin the PoNW process. The node’s registered address will be
> hashed with the block header of the block it wants to work on.
> This will determine exactly where within the blockchain to
> begin the PoNW.
>
>
> The PoNW method could be as simple as creating a Merkle tree
> from the randomly generated point on the blockchain, though a
> method that is CPU/Memory heavy and less likely to be replaced
> by dedicated hardware like ASICs would be better. This process
> could not begin until the most recent block has been fully
> verified, and while being carried out should still enable
> normal relay activities to proceed as normal, since it
> shouldn’t tie up network at all. The data processed should
> also be mixed with data from the latest block so that it
> cannot be computed in advance.
>
>
> A node can do as much PoNW for a block as it likes. Once
> finished it will then create a nodeWorkComplete transaction
> for that block with its final proof value, add how much ‘work’
> it did - and create a couple of assertions about what it
> processed (such as there were x number of pieces of data
> matching a particular value during calculating). These
> assertions can be accurate or inaccurate.
>
>
> The system will run in epochs. During each epoch of say 2016
> blocks, there will be an extended window for PoNW transactions
> to be added to nodeblocks to limit minor censorship.
>
>
> The random hash generated from a node’s address and blockhash
> will also be used to determine nodeWorkComplete transactions
> from a previous block that the node must also verify, and
> correctly calculate whether the assertions it made were true
> or false. The average PoNW that a node performed in its
> previous x nodeblocks will be used to determine the target
> PoNW for the node to verify - and this will randomly be a
> large number of smaller PoNW transactions, or a smaller number
> of large PoNW. This process will be deterministic based on
> that block and address hash. All the data will be put together
> in a transaction and then signed by the node addresses private
> key.
>
>
> If a nodeWorkComplete transaction contains any incorrect
> information in an attempt to cheat the validation process a
> challenge transaction can be created. This begins a refereeing
> process where other nodes check the challenge and vote whether
> it is to be upheld or not. The losing node is punished by
> losing their accrued PoNW for that epoch and a percentage of
> their security deposit.
>
>
> Nodes will also be punished if they broadcast more than one
> signed transaction per block.
>
>
> In order to prevent nodes from having multiple keys registered
> - which would enable them choose to perform PoNW on a subset
> of the data that they hold - the share of reward that the node
> gets will be multiplied based on the number of blocks within
> an epoch that the node performs PoNW on. The share of reward
> is limited based on how much security deposit has been staked.
> The higher the PoNW the higher the deposit needed in order to
> claim their full allocation of any reward.
>
>
> At the end of an epoch, with a wait period for any delayed or
> censored transactions or challenges to be included and settled
> up, the process of calculating the reward each node is due can
> begin. This will then be then paid in a regular block, and
> means for all the data involved in PoNW, the only permanent
> mark it makes on the main blockchain is for a transaction that
> pays all addresses their share of the reward at the end of
> epoch. Any miner who creates a block without correctly
> calculating and paying the due reward will have mined an
> invalid block and be orphaned.
>
>
> The question of where and how much the reward comes from is a
> different one. It could come from the existing miner reward,
> or a special new tx donation fee for nodes. If there was some
> way for users to ‘donate’ to the reward pool for nodes this
> would increase the incentive for additional nodes to
> participate on the network in the event of centralisation.
>
>
> This is a relatively effective way to create a reward for all
> nodes participating on a network. I’d be keen to field any
> questions or critiques.
>
> Thanks,
>
>
> John Hardy
>
> john@seebitcoin.com <mailto:john@seebitcoin.com>
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> <mailto:bitcoin-dev@lists.linuxfoundation.org>
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
> <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>
>
>
>
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
--
Zcash wallets made simple: https://github.com/Ayms/zcash-wallets
Bitcoin wallets made simple: https://github.com/Ayms/bitcoin-wallets
Get the torrent dynamic blocklist: http://peersm.com/getblocklist
Check the 10 M passwords list: http://peersm.com/findmyass
Anti-spies and private torrents, dynamic blocklist: http://torrent-live.org
Peersm : http://www.peersm.com
torrent-live: https://github.com/Ayms/torrent-live
node-Tor : https://www.github.com/Ayms/node-Tor
GitHub : https://www.github.com/Ayms
--------------34D7B91459FFB166F762F2D2
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>I started writing this
<a class="moz-txt-link-freetext" href="https://gist.github.com/Ayms/aab6f8e08fef0792ab3448f542a826bf">https://gist.github.com/Ayms/aab6f8e08fef0792ab3448f542a826bf</a> some
time ago, but stopped since I was under the impression that this
was of very little interest for the Bitcoin community</p>
<p>It's not final and finished at all, but since I wrote it and
don't have plans right now to pursue it, I placed it in a gist and
publish the link, probably not everything is correct and this does
not cover everything but it can maybe give some ideas (which are
for some the combination of concepts from former/other projects)
that could be reused, addressing:</p>
<p>- incentive to run full nodes</p>
<p>- make sure that they are indeed full nodes</p>
<p>- make sure that they participate to the network and are
efficient enough<br>
</p>
<p>- make sure that they don't collude in pools to get the rewards
and are independent<br>
</p>
<p>- set up quickly a full node (incremental torrent-like download)</p>
<p>As this was written this was supposed to add some modifications
to the bitcoin protocol but I don't think that's necessarily a
good idea, most likely this can be handled via sidechains and/or
external systems<br>
</p>
<br>
<div class="moz-cite-prefix">Le 13/02/2017 à 15:48, Sergio Demian
Lerner via bitcoin-dev a écrit :<br>
</div>
<blockquote
cite="mid:CAKzdR-p25HXQty_o0y+rS2dBz568tCjyW9kvAoBJxJuii8k9eA@mail.gmail.com"
type="cite">
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Feb 13, 2017 at 8:58 AM, John
Hardy <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:john@seebitcoin.com" target="_blank">john@seebitcoin.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div
id="gmail-m_2300798131680571998divtagdefaultwrapper"
style="font-size:12pt;color:rgb(0,0,0);font-family:calibri,arial,helvetica,sans-serif"
dir="ltr">
<p>Hi Sergio,</p>
<p><br>
</p>
<p>Thanks for your response, interesting work, very
excited for RSK.</p>
<p><br>
</p>
<p>I like the ephemeral payload, I suppose that aspect
of my proposal could be described as
ephemeral blockspace.</p>
<p><br>
</p>
<p>I'm curious about the challenge phase, what
incentive do nodes to have to check other nodes'
responses?</p>
</div>
</div>
</blockquote>
<div>The reward is split between all full nodes. Therefore
each full node has an incentive to check at least some
other full nodes responses because there is a competition
for the full node reward. At the end, each full node
response will be checked by more than other node with high
probability. Also each full node does a small pre-deposit,
that is consumed if the node cheats.</div>
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div
id="gmail-m_2300798131680571998divtagdefaultwrapper"
style="font-size:12pt;color:rgb(0,0,0);font-family:calibri,arial,helvetica,sans-serif"
dir="ltr">
<p> Is any validation of responses mandatory, or does
policing the system rely on altruism?</p>
<p><br>
</p>
</div>
</div>
</blockquote>
<div>As previously said, validation is not mandatory.</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div
id="gmail-m_2300798131680571998divtagdefaultwrapper"
style="font-size:12pt;color:rgb(0,0,0);font-family:calibri,arial,helvetica,sans-serif"
dir="ltr">
<p>
</p>
<p>I also wondered how time-based responses are
enforced? What prevents a miner censoring challenge
responses so they do not get included in a block 'in
time' - if inclusion within a block is the
mechanism used?</p>
</div>
</div>
</blockquote>
<div>There is not many defenses against censorship but try
to hide your identity until the end of the protocol. But
if somebody knows that your transactions belong to you,
then there is little defense. We just wait more than a
single block for the commitments, so several miners must
collude in order to censor a transaction. </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div
id="gmail-m_2300798131680571998divtagdefaultwrapper"
style="font-size:12pt;color:rgb(0,0,0);font-family:calibri,arial,helvetica,sans-serif"
dir="ltr">
<p><br>
</p>
<p>I saw your tweet on Lumino - sounds very promising.
Would be keen to take a look at the paper if you're
looking for any additional review at this stage.</p>
</div>
</div>
</blockquote>
<div>I'm keeping it private against all my desire because I
want it to be reviewed before I publish it. Credibility is
very easily lost. </div>
<div>The same idea (Ephemeral Data) has been used to design
the Lumino Network.<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div
id="gmail-m_2300798131680571998divtagdefaultwrapper"
style="font-size:12pt;color:rgb(0,0,0);font-family:calibri,arial,helvetica,sans-serif"
dir="ltr">
<p><br>
</p>
<p>Regards,</p>
<p><br>
</p>
<p>John Hardy</p>
<br>
<br>
<div style="color:rgb(0,0,0)">
<hr style="display:inline-block;width:98%">
<div id="gmail-m_2300798131680571998divRplyFwdMsg"
dir="ltr"><font style="font-size:11pt"
face="Calibri, sans-serif" color="#000000"><b>From:</b>
Sergio Demian Lerner <<a
moz-do-not-send="true"
href="mailto:sergio.d.lerner@gmail.com"
target="_blank">sergio.d.lerner@gmail.com</a>><br>
<b>Sent:</b> Sunday, February 12, 2017 8:22 PM<br>
<b>To:</b> John Hardy; Bitcoin Protocol
Discussion<br>
<b>Subject:</b> Re: [bitcoin-dev] Proof of
Nodework (PoNW) - a method to trustlessly reward
nodes for storing and verifying the blockchain</font>
<div> </div>
</div>
<div>
<div class="gmail-h5">
<div>
<div dir="ltr">Hi John,
<div> RSK platform (a Bitcoin sidechain) is
already prepared to do something similar
to this, although very efficiently. We set
apart 1% of the block reward to
automatically reward full nodes.</div>
<div><br>
</div>
<div>We have two systems being evaluated:
the first is based on PoUBS (Proof of
Unique Blockchain Storage) which uses
asymmetric-time operations to encode the
blockchain based on each user public key
such that decoding is fast, but encoding
is slow. The second is more traditional
proof of retrievability, but it requires
some ASIC-resistance assumptions. </div>
<div><br>
</div>
<div>In both cases, a special smart contract
is being called at every block that
creates periodic challenges. Every full
node that wants to participate can submits
a commitment to the Merkle hash root of a
pseudo-random sequence of encoded blocks.
Then the smart contract chooses random
elements from the committed dataset, and
each full node has a period to submit
Merkle-proofs that such random elements
belong to the commitment.</div>
<div><br>
</div>
<div>To prevent blockchain bloat we designed
a very cool new type of transaction
payload: Ephemeral Payload. Ephemeral
payload is a payload in a transaction that
gets discarded after N blocks if no smart
contract does reference it. If is does,
it's solidified forever in the blockchain.</div>
<div>Then there is a challenge phase where
other full nodes can inform the smart
contract if they find an error in the
submitted responses. Then the smart
contract ONLY evaluates the responses
which have been questioned by users.</div>
<div><br>
</div>
<div>This way the smart contract does very
little computation (only when a user
misbehaves) and the blockchain normally
does not store any proof forever (only the
ones created by misbehaving users).</div>
<div><br>
</div>
<div>Because RSK/Rootstock has a very short
block interval (10 seconds), all this
happens very quickly and does not require
much computation. </div>
<div><br>
</div>
<div>Best regards,<br>
</div>
<div> Sergio Lerner</div>
<div> Chief Scientist RSK (aka Roostock)</div>
<div><br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Feb 7, 2017
at 8:27 AM, John Hardy via bitcoin-dev
<span dir="ltr"><<a
moz-do-not-send="true"
href="mailto:bitcoin-dev@lists.linuxfoundation.org"
target="_blank">bitcoin-dev@lists.<wbr>linuxfoundation.org</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div
id="gmail-m_2300798131680571998m_8783055025000134944divtagdefaultwrapper"
dir="ltr"
style="font-size:12pt;color:rgb(0,0,0);font-family:calibri,arial,helvetica,sans-serif">
<p><span
id="gmail-m_2300798131680571998m_8783055025000134944docs-internal-guid-4ac5038f-1853-2d21-3f80-3a53c5100e51"></span></p>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">Proof of Nodework (PoNW) is a way to reward individual nodes
for keeping a full copy of and verifying the blockchain.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">Hopefully they also do useful ‘traditional’ node activities
too like relay transactions and blocks, but there isn’t really any way I can think of to trustlessly verify this also.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">PoNW would require a new separate area of block space, a nodeblock,
purely concerned with administering the system. A nodeblock is committed to a block as with SegWit. A recent history of nodeblocks needs to be stored by nodes, however the data eventually becomes obsolete and so does not need to be retained forever.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">In order to prevent Sybil, a node must register an Bitcoin
address by submitting an addNode transaction - along with a security deposit to prevent cheating.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">This transaction will be stored in the nodeblock. Once a node
can see that its addNode transaction has been added it can begin the PoNW process. The node’s registered address will be hashed with the block header of the block it wants to work on. This will determine exactly where within the blockchain to begin the PoNW.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">The PoNW method could be as simple as creating a Merkle tree
from the randomly generated point on the blockchain, though a method that is CPU/Memory heavy and less likely to be replaced by dedicated hardware like ASICs would be better. This process could not begin until the most recent block has been fully verified,
and while being carried out should still enable normal relay activities to proceed as normal, since it shouldn’t tie up network at all. The data processed should also be mixed with data from the latest block so that it cannot be computed in advance.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">A node can do as much PoNW for a block as it likes. Once finished
it will then create a nodeWorkComplete transaction for that block with its final proof value, add how much ‘work’ it did - and create a couple of assertions about what it processed (such as there were x number of pieces of data matching a particular value
during calculating). These assertions can be accurate or inaccurate.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">The system will run in epochs. During each epoch of say 2016
blocks, there will be an extended window for PoNW transactions to be added to nodeblocks to limit minor censorship.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">The random hash generated from a node’s address and blockhash
will also be used to determine nodeWorkComplete transactions from a previous block that the node must also verify, and correctly calculate whether the assertions it made were true or false. The average PoNW that a node performed in its previous x nodeblocks
will be used to determine the target PoNW for the node to verify - and this will randomly be a large number of smaller PoNW transactions, or a smaller number of large PoNW. This process will be deterministic based on that block and address hash. All the data
will be put together in a transaction and then signed by the node addresses private key.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">If a nodeWorkComplete transaction contains any incorrect information
in an attempt to cheat the validation process a challenge transaction can be created. This begins a refereeing process where other nodes check the challenge and vote whether it is to be upheld or not. The losing node is punished by losing their accrued PoNW
for that epoch and a percentage of their security deposit.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">Nodes will also be punished if they broadcast more than one
signed transaction per block.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">In order to prevent nodes from having multiple keys registered
- which would enable them choose to perform PoNW on a subset of the data that they hold - the share of reward that the node gets will be multiplied based on the number of blocks within an epoch that the node performs PoNW on. The share of reward is limited
based on how much security deposit has been staked. The higher the PoNW the higher the deposit needed in order to claim their full allocation of any reward.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">At the end of an epoch, with a wait period for any delayed
or censored transactions or challenges to be included and settled up, the process of calculating the reward each node is due can begin. This will then be then paid in a regular block, and means for all the data involved in PoNW, the only permanent mark it
makes on the main blockchain is for a transaction that pays all addresses their share of the reward at the end of epoch. Any miner who creates a block without correctly calculating and paying the due reward will have mined an invalid block and be orphaned.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">The question of where and how much the reward comes from is
a different one. It could come from the existing miner reward, or a special new tx donation fee for nodes. If there was some way for users to ‘donate’ to the reward pool for nodes this would increase the incentive for additional nodes to participate on the
network in the event of centralisation.</span></p>
<br>
<p dir="ltr"
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">This is a relatively effective way to create a reward for all
nodes participating on a network. I’d be keen to field any questions or critiques.</span></p>
<div><span style="font-size:11pt;font-family:arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">
</span></div>
Thanks,
<p><br>
</p>
<p>John Hardy</p>
<p><a moz-do-not-send="true"
href="mailto:john@seebitcoin.com"
target="_blank">john@seebitcoin.com</a></p>
</div>
</div>
<br>
______________________________<wbr>_________________<br>
bitcoin-dev mailing list<br>
<a moz-do-not-send="true"
href="mailto:bitcoin-dev@lists.linuxfoundation.org"
target="_blank">bitcoin-dev@lists.linuxfoundat<wbr>ion.org</a><br>
<a moz-do-not-send="true"
href="https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev"
rel="noreferrer" target="_blank">https://lists.linuxfoundation.<wbr>org/mailman/listinfo/bitcoin-d<wbr>ev</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
bitcoin-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a>
<a class="moz-txt-link-freetext" href="https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev">https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Zcash wallets made simple: <a class="moz-txt-link-freetext" href="https://github.com/Ayms/zcash-wallets">https://github.com/Ayms/zcash-wallets</a>
Bitcoin wallets made simple: <a class="moz-txt-link-freetext" href="https://github.com/Ayms/bitcoin-wallets">https://github.com/Ayms/bitcoin-wallets</a>
Get the torrent dynamic blocklist: <a class="moz-txt-link-freetext" href="http://peersm.com/getblocklist">http://peersm.com/getblocklist</a>
Check the 10 M passwords list: <a class="moz-txt-link-freetext" href="http://peersm.com/findmyass">http://peersm.com/findmyass</a>
Anti-spies and private torrents, dynamic blocklist: <a class="moz-txt-link-freetext" href="http://torrent-live.org">http://torrent-live.org</a>
Peersm : <a class="moz-txt-link-freetext" href="http://www.peersm.com">http://www.peersm.com</a>
torrent-live: <a class="moz-txt-link-freetext" href="https://github.com/Ayms/torrent-live">https://github.com/Ayms/torrent-live</a>
node-Tor : <a class="moz-txt-link-freetext" href="https://www.github.com/Ayms/node-Tor">https://www.github.com/Ayms/node-Tor</a>
GitHub : <a class="moz-txt-link-freetext" href="https://www.github.com/Ayms">https://www.github.com/Ayms</a></pre>
</body>
</html>
--------------34D7B91459FFB166F762F2D2--
|