Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

eprint.iacr.org

Post reply on HN
Print view View original

31–40 of 72 posts

Re: Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

#31

Post by DennisP »

gvhst wrote: post #6
JohnJamesRambo wrote: post #5

How does this compare to the current implementation of proof of stake in Ethereum 2.0?

They claim (via formal verification, I cannot speak to their threat model with much accuracy) that they are able to achieve the same or better security properties as ETH 2.0 without lockups (staked funds earning income are like demand deposits) or slashing (penalties for bad behavior / bad network performance). The project as a whole (Cardano) has some other notable advantages. Personally, it has a built in governanc…

Without slashing, I'm wondering whether they've adequately accounted for attacks motivated by extraneous factors, rather than simply for profit within the system. The abstract says "we prove that, given this mechanism, honest behavior is an approximate Nash equilibrium," but does that still hold if an attacker has shorted the coin?

With slashing, even if someone finds it advantageous to attack, you quickly take away their ability to attack.

(I haven't yet read past the abstract, so for all I know they do address this.)

Re: Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

#32

Post by jude- »

martindale wrote: post #8

Proof of Stake not only replicates the same dynamics that Bitcoin was designed to eliminate (more wealth -> more power in system) but also can only be made secure against a maximum of ⅓ byzantine actors, compared to Proof of Work's superior ½. As for using it for Layer 1 systems, Andrew Poelstra nailed it in his conclusion [0]: "We showed that by depending only on resources within the system, proof of stake cannot be…

No distributed consensus algorithm can tolerate more than f faults with 3f+1 replicas and maintain liveness. This includes Bitcoin (replace "replicas" with "hashes per unit time").

Re: Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

#33

Post by latchkey »

gvhst wrote: post #9
martindale wrote: post #8

Proof of Stake not only replicates the same dynamics that Bitcoin was designed to eliminate (more wealth -> more power in system) but also can only be made secure against a maximum of ⅓ byzantine actors, compared to Proof of Work's superior ½. As for using it for Layer 1 systems, Andrew Poelstra nailed it in his conclusion [0]: "We showed that by depending only on resources within the system, proof of stake cannot be…

Not sure if you are claiming that BTC currently solves the "more wealth -> more power in system" problem but it clearly doesn't. The current state of affairs is more wealth -> more ASICS R&D and infrastructure budget -> more hash power -> more power in the system.

This doesn't work for ETH1, which is PoW, but memory hard, which ties the network to GPUs over ASICs due to the cost structure of producing ASICs. It is cheaper to buy an off the shelf GPU than it is to buy an ASIC.

You also have to factor in the fact that the latest GPUs are not necessarily the best ROI. If you can get lower speed GPUs for a fraction of the cost, then your return on that is much faster. Of course, that is starting to change now that mining is becoming so profitable again. But regardless, you are still tied to GPUs, so anything you can get there is good.

Re: Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

#34

Post by pjmorris »

Geee wrote: post #18
gvhst wrote: post #9

Earlier quoted context omitted.

Not sure if you are claiming that BTC currently solves the "more wealth -> more power in system" problem but it clearly doesn't. The current state of affairs is more wealth -> more ASICS R&D and infrastructure budget -> more hash power -> more power in the system.

There's a difference. You can't physically centralize energy production. Local energy price will increase when more energy is used. This ensures that no one can get in a position of control. In PoS, it's possible to get > 50% ownership, and it's game over.

> You can't physically centralize energy production.

But you can centralize ownership of energy production.

Re: Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

#35

Post by latchkey »

DennisP wrote: post #30
ypeterholmes wrote: post #22

Important paper here because almost all the next gen blockchains will be using POS. Ethereum is trying to switch mid-flight (yikes) but others like Cardano have incorporated it foundationally. If you're a no-coiner or Bitcoin maximalist, none of this really matters. But if you accept the premise that the future of financial infrastructure is moving towards decentralized, blockchain based systems, then a secure, scala…

Ethereum's PoS is a completely new chain that's currently running in parallel. After watching it run in production for about a year they'll merge in the old chain.

What is running in parallel is just a heartbeat chain that doesn't do anything of what ETH1 does (no EVM).

It will be much longer than a year. 2-3, at best.

Re: Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

#36

Post by vbuterin »

martindale wrote: post #8

Proof of Stake not only replicates the same dynamics that Bitcoin was designed to eliminate (more wealth -> more power in system) but also can only be made secure against a maximum of ⅓ byzantine actors, compared to Proof of Work's superior ½. As for using it for Layer 1 systems, Andrew Poelstra nailed it in his conclusion [0]: "We showed that by depending only on resources within the system, proof of stake cannot be…

There's a couple things wrong here:

> Proof of Stake not only replicates the same dynamics that Bitcoin was designed to eliminate (more wealth -> more power in system)

There is no legitimate sense in which PoS _is_ an instance of "rich have more power and get richer" but PoW is not. In fact, PoW is _worse_ than PoS in this regard, because PoW has economies of scale (if someone with a $100k investment earns $10k/year, someone with a $100m investment can earn significantly more than $10m/year). PoS on the other hand is much closer to a clean "what you earn is proportional to what you put in" design, which is realistically the best that you can do in an anonymous system where users can generate as many independent identities as they want.

> can only be made secure against a maximum of ⅓ byzantine actors, compared to Proof of Work's superior ½.

This is also not true. The 1/3 bound is for safety-under-asynchrony (a form of safety for which PoW's security margin is zero). If you assume synchrony, then PoS protocols' safety approaches 50% much like PoW does. Protocols like Casper FFG combine the "best of both worlds", giving you both of those security guarantees (50% BFT if the network is good, 33% BFT if the network is terrible) at the same time.

Re: Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

#37

Post by illustriousbear »

While Cardano is interesting, I believe IOTA's implementation of a ledger using a directed acyclic graph is much more interesting/scalable.

In addition IOTA's focus on micro-transactions / the machine economy seems like a no brainer and something that cryptocurrencies generally neglect..

Re: Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

#38

Post by DennisP »

latchkey wrote: post #35
DennisP wrote: post #30

Earlier quoted context omitted.

Ethereum's PoS is a completely new chain that's currently running in parallel. After watching it run in production for about a year they'll merge in the old chain.

What is running in parallel is just a heartbeat chain that doesn't do anything of what ETH1 does (no EVM). It will be much longer than a year. 2-3, at best.

Yes but what's running now is the hard part. Fundamentally, once you have reliable consensus, the data you reach consensus on is just an extra hash in each block.

There's software engineering to merge the client software, but from a research perspective it's not a big deal at all.

Re: Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

#39

Post by jude- »

vbuterin wrote: post #36
martindale wrote: post #8

Proof of Stake not only replicates the same dynamics that Bitcoin was designed to eliminate (more wealth -> more power in system) but also can only be made secure against a maximum of ⅓ byzantine actors, compared to Proof of Work's superior ½. As for using it for Layer 1 systems, Andrew Poelstra nailed it in his conclusion [0]: "We showed that by depending only on resources within the system, proof of stake cannot be…

There's a couple things wrong here: > Proof of Stake not only replicates the same dynamics that Bitcoin was designed to eliminate (more wealth -> more power in system) There is no legitimate sense in which PoS _is_ an instance of "rich have more power and get richer" but PoW is not. In fact, PoW is _worse_ than PoS in this regard, because PoW has economies of scale (if someone with a $100k investment earns $10k/year,…

> There is no legitimate sense in which PoS _is_ an instance of "rich have more power and get richer" but PoW is not.

In PoW, miners must sell their tokens to buy capital-intensive mining equipment and power to stay competitive. In PoS, stakers have no incentive to sell enough tokens to anyone who could turn around and stake them as a competitor, since that would cut into the seller's future staking rewards.

> The 1/3 bound is for safety-under-asynchrony (a form of safety for which PoW's security margin is zero). If you assume synchrony, then PoS protocols' safety approaches 50% much like PoW does.

First, consensus protocols can be trivially safe regardless of the network's behavior -- you simply require a majority vote for any proposed agreement. Second, any consensus protocol can only remain live as long as there are no more than f faults out of 3f+1 replicas. This is again irrespective of the network model -- Leslie Lamport's proofs do not make any assumptions about the network.

Re: Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol [pdf] (2019)

#40

Post by wmf »

regisg wrote: post #25
wmf wrote: post #24

Earlier quoted context omitted.

There are concerns (or concern trolls) about an attacker buying old keys for almost nothing, trashing the chain, then profiting by shorting. And there are concerns that the honest majority can't figure out how to switch to the honest fork.

That's why there are KES keys.

For people like me who haven't heard of this feature: https://docs.cardano.org/projects/cardano-node/en/latest/sta... It's true that this prevents an attacker from using current keys to perform a long-range attack but old keys can still be used for attacks.
Post reply on HN