MIME-Version: 1.0
References: <CAB0O3SVjhG19R61B78hFCPwfwWemTXj=tOsvgAgoNbjFYXXAtg@mail.gmail.com>
	<20171106195000.GA7245@fedora-23-dvm>
In-Reply-To: <20171106195000.GA7245@fedora-23-dvm>
From: Devrandom <c1.bitcoin@niftybox.net>
Date: Mon, 06 Nov 2017 22:39:02 +0000
Message-ID: <CAB0O3SVsXL_zVBs-OFEaFuKTXoyYAiB8TEZStOfou7mMkHLMnA@mail.gmail.com>
To: Peter Todd <pete@petertodd.org>
Content-Type: multipart/alternative; boundary="001a114132a4a2248f055d581f5a"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Introducing a POW through a soft-fork
Precedence: list

--001a114132a4a2248f055d581f5a
Content-Type: text/plain; charset="UTF-8"

Hi Peter, thank you for the review.  See below

On Mon, Nov 6, 2017 at 11:50 AM Peter Todd <pete@petertodd.org> wrote:

> On Wed, Nov 01, 2017 at 05:48:27AM +0000, Devrandom via bitcoin-dev wrote:
>
> Some quick thoughts...
>
> > Hi all,
> >
> > Feedback is welcome on the draft below.  In particular, I want to see if
> > there is interest in further development of the idea and also interested
> in
> > any attack vectors or undesirable dynamics.
> >
> > (Formatted version available here:
> > https://github.com/devrandom/btc-papers/blob/master/aux-pow.md )
> >
> > # Soft-fork Introduction of a New POW
>
> First of all, I don't think you can really call this a soft-fork; I'd call
> it a
> "pseudo-soft-fork"
>
> My reasoning being that after implementation, a chain with less total work
> than
> the main chain - but more total SHA256^2 work than the main chain - might
> be
> followed by non-supporting clients. It's got some properties of a
> soft-fork,
> but it's security model is definitely different.
>

The interesting thing is that the cost of attack varies smoothly as you
vary the POW weights.
To attack non-upgraded nodes, you still have to "51%" the original POW.
The reward going to that POW will vary smoothly between 1.0 * block_reward
and whatever
target value (e.g. 0.5 * block_reward) and the difficulty of attack will
tend to be proportional to that.

In a real hard-fork, your software just breaks at the fork point.  In this
case, it's just the non-upgraded
node security level declining from 100% to 50% over a long period of time.

I envision the transition of POW weights will be over 1-3 years, which
leaves plenty of time to
upgrade after the fork activates.


>
> > ### Aux POW intermediate block
> >
> > Auxiliary POW blocks are introduced between normal blocks - i.e. the
> chain
> > alternates between the two POWs.
> > Each aux-POW block points to the previous normal block and contains
> > transactions just like a normal block.
> > Each normal block points to the previous aux-POW block and must contain
> all
> > transactions from the aux-POW block.
>
> Note how you're basically proposing for the block interval to be decreased,
> which has security implications due to increased orphan rates.
>

Note that the total transaction rate and block size don't materially
change, so I don't
see why the orphan rate will change.  Normal blocks are constrained to have
all of the txs of the aux blocks, so propagation time should stay the
same.  Am I missing
something?


>
> > ### Heaviest chain rule change
> >
> > This is a semi-hard change, because non-upgraded nodes can get on the
> wrong
> > chain in case of attack.  However,
>
> Exactly! Not really a soft-fork.
>

"smooth-fork" perhaps? :)


>
> --
> https://petertodd.org 'peter'[:-1]@petertodd.org
>

--001a114132a4a2248f055d581f5a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Peter, thank you for the review.=C2=A0 See below<br><br=
><div class=3D"gmail_quote"><div dir=3D"ltr">On Mon, Nov 6, 2017 at 11:50 A=
M Peter Todd &lt;<a href=3D"mailto:pete@petertodd.org">pete@petertodd.org</=
a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 =
0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Wed, Nov 01, 2017 =
at 05:48:27AM +0000, Devrandom via bitcoin-dev wrote:<br>
<br>
Some quick thoughts...<br>
<br>
&gt; Hi all,<br>
&gt;<br>
&gt; Feedback is welcome on the draft below.=C2=A0 In particular, I want to=
 see if<br>
&gt; there is interest in further development of the idea and also interest=
ed in<br>
&gt; any attack vectors or undesirable dynamics.<br>
&gt;<br>
&gt; (Formatted version available here:<br>
&gt; <a href=3D"https://github.com/devrandom/btc-papers/blob/master/aux-pow=
.md" rel=3D"noreferrer" target=3D"_blank">https://github.com/devrandom/btc-=
papers/blob/master/aux-pow.md</a> )<br>
&gt;<br>
&gt; # Soft-fork Introduction of a New POW<br>
<br>
First of all, I don&#39;t think you can really call this a soft-fork; I&#39=
;d call it a<br>
&quot;pseudo-soft-fork&quot;<br>
<br>
My reasoning being that after implementation, a chain with less total work =
than<br>
the main chain - but more total SHA256^2 work than the main chain - might b=
e<br>
followed by non-supporting clients. It&#39;s got some properties of a soft-=
fork,<br>
but it&#39;s security model is definitely different.<br></blockquote><div><=
br></div><div>The interesting thing is that the cost of attack varies smoot=
hly as you vary the POW weights.</div><div>To attack non-upgraded nodes, yo=
u still have to &quot;51%&quot; the original POW.</div><div>The reward goin=
g to that POW will vary smoothly between 1.0 * block_reward and whatever</d=
iv><div>target value (e.g. 0.5 * block_reward) and the difficulty of attack=
 will tend to be proportional to that.</div><div><br></div><div>In a real h=
ard-fork, your software just breaks at the fork point.=C2=A0 In this case, =
it&#39;s just the non-upgraded</div><div>node security level declining from=
 100% to 50% over a long period of time.</div><div><br></div><div>I envisio=
n the transition of POW weights will be over 1-3 years, which leaves plenty=
 of time to</div><div>upgrade after the fork activates.</div><div>=C2=A0<br=
></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-=
left:1px #ccc solid;padding-left:1ex">
<br>
&gt; ### Aux POW intermediate block<br>
&gt;<br>
&gt; Auxiliary POW blocks are introduced between normal blocks - i.e. the c=
hain<br>
&gt; alternates between the two POWs.<br>
&gt; Each aux-POW block points to the previous normal block and contains<br=
>
&gt; transactions just like a normal block.<br>
&gt; Each normal block points to the previous aux-POW block and must contai=
n all<br>
&gt; transactions from the aux-POW block.<br>
<br>
Note how you&#39;re basically proposing for the block interval to be decrea=
sed,<br>
which has security implications due to increased orphan rates.<br></blockqu=
ote><div><br></div><div>Note that the total transaction rate and block size=
 don&#39;t materially change, so I don&#39;t</div><div>see why the orphan r=
ate will change.=C2=A0 Normal blocks are constrained to have</div><div>all =
of the txs of the aux blocks, so propagation time should stay the same.=C2=
=A0 Am I missing</div><div>something?</div><div>=C2=A0</div><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pa=
dding-left:1ex">
<br>
&gt; ### Heaviest chain rule change<br>
&gt;<br>
&gt; This is a semi-hard change, because non-upgraded nodes can get on the =
wrong<br>
&gt; chain in case of attack.=C2=A0 However,<br>
<br>
Exactly! Not really a soft-fork.<br></blockquote><div><br></div><div>&quot;=
smooth-fork&quot; perhaps? :)</div><div>=C2=A0</div><blockquote class=3D"gm=
ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le=
ft:1ex">
<br>
--<br>
<a href=3D"https://petertodd.org" rel=3D"noreferrer" target=3D"_blank">http=
s://petertodd.org</a> &#39;peter&#39;[:-1]@<a href=3D"http://petertodd.org"=
 rel=3D"noreferrer" target=3D"_blank">petertodd.org</a><br>
</blockquote></div></div>

--001a114132a4a2248f055d581f5a--