Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: mike@powx.org
Mime-Version: 1.0 (1.0)
Date: Tue, 18 May 2021 07:43:18 -0400
Message-Id: <03AA32FD-5AC0-42B0-B6D3-387BDC2B4238@powx.org>
References: <U-U9RmD3wRndUuQkzjsqm5X8BNnGKcxiIJs-fWbPMiGNaiSlENL4Yn4Ui8vUseIMse_rzgzBmV6EfkdROHEuPbA9vgf7Fkq39Hr9cs-zZbs=@protonmail.com>
In-Reply-To: <U-U9RmD3wRndUuQkzjsqm5X8BNnGKcxiIJs-fWbPMiGNaiSlENL4Yn4Ui8vUseIMse_rzgzBmV6EfkdROHEuPbA9vgf7Fkq39Hr9cs-zZbs=@protonmail.com>
To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Proposal: Low Energy Bitcoin PoW
Precedence: list

That=E2=80=99s interesting. I didn=E2=80=99t know the history of ASICBOOST.

Our proposal (see Implementation) is to phase in oPoW slowly starting at a v=
ery low % of the rewards (say 1%). That should give a long testing period wh=
ere there is real financial incentive for things like ASICBOOST

Does that resolve or partially resolve the issue in your eyes?=20

Sent from my iPhone

> On May 18, 2021, at 7:36 AM, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>=20
> =EF=BB=BFGood morning Michael,
>=20
>> That=E2=80=99s a fair point about patents. However, note that we were car=
eful about this. oPoW only uses SHA3 (can be replaced with SHA256 in princip=
le as well) and low precision linear matrix multiplication. A whole industry=
 is trying to accelerate 8-bit linear matrix mults for AI so there is alread=
y a massive incentive (and has been for decades).
>>=20
>> See companies like Mythic, Groq, Tesla (FSD computer), google TPU and so o=
n for electronic versions of this. Several of the optical ones are mentioned=
 in the BIP (e.g. Lightmatter)
>=20
>=20
> Please note that ASICBOOST for SHA256d is based on a layer-crossing violat=
ion: SHA256 processes in blocks, and the Bitcoin block header is slightly la=
rger than one SHA256 block.
>=20
> Adding more to a direct SHA3 (which, as a "sponge" construction, avoids bl=
ocks, but other layer-crossing violations may still exist) still risks layer=
 violations that might introduce hidden optimizations.
>=20
> Or more succinctly;
>=20
> * Just because the components have (with high probability) no more possibl=
e optimizations, does not mean that the construction *as a whole* has no hid=
den optimizations.
>=20
> Thus, even if linear matrix multiplication and SHA3 have no hidden optimiz=
ations, their combination, together with the Bitcoin block header format, *m=
ay* have hidden optimizations.
>=20
> And there are no *current* incentives to find such optimizations until Bit=
coin moves to this, at which point we are already committed and it would be h=
ighly infeasible to revert to SHA256d --- i.e. too late.
>=20
> This is why changes to PoW are highly discouraged.
>=20
>=20
> Remember, ASICBOOST was *not* an optimization of SHA256 *or* SHA256d, it w=
as an optimizations of SHA256d-on-a-Bitcoin-block-header.
> ASICBOOST cannot speed up general SHA256 or even general SHA256d, it only a=
pplies specifically to SHA256d-on-a-Bitcoin-block-header.
>=20
> Regards,
> ZmnSCPxj