Bitcoin Forum

Trying to understand how proof of stake vs proof workS...
also would like to hear opinions and strategies from people who walk the pos walk...

many thanks! 

POW  -  Mining equipment + CPU to generate blocks. The most times very expensive.


POS   -  CPU. Leave open your wallet to generate blocks.


So Wich for you is?    

Well, PoS is much cheaper than PoW. In PoS, you leave your wallet open to stake your coins, read carefully the coins specs and try to understand if leaving your wallet open (means your PC always on) is profitable or not. Usually developers propose high PoS rewards to attract investors.
In the other hand, PoW requires mining equipment that can be relatively cheap (like GPU cards) or professional (ASIC). Surely more expensive than PoS, but mining guarantees coin stability and strenght.

PoS is really just mining too, but your upfront cost is your computer running the wallet + holding the coins.

Some in depth research papers on PoS: https://github.com/ConsensusResearch/articles-papers/tree/master/articles

The more coins you have the higher your reward, thats the principle for POS, i prefer POW just because its more fun

You have to know that you can generate coin with POS using the wallet on a virtual machine and let it works h24.
So you can have a lot of coins without expensive hardware.

Yeah but you must have more coins to have more profit and also need to unlock your wallet to make it work.

POS also somehow bring more buy's on the coin.

"Proof of Stake" is a terrible name for a system that doesn't emulate, let alone simulate, the same functionality of Proof of Work.
What does "Proof" mean, in "Proof of Work"? It means that you can prove to anyone that you have caused a certain amount of entropy at the margin of a monotonically lengthening chain of these Proofs.
As long as no one particular entity controls more than ~50% of the hashpower (Ignoring selfish mining for the moment.) we can identify, over time, one -only one- monolithic chain of data. Only one set of these Proofs can have spent the most work. Only these Proofs allow this monolith to form in a sea of mutually distrusting parties.

What does "Proof" mean when talking about "Proof of Stake"? How can one take "Stake" and "Prove", to someone that doesn't trust you, anything about a piece of data?
Imagine you have a hundred people in a room and you dump a pile of receipts on the ground which lack any date indication, and then ask them to sort them. One person picks up a receipt and yells, "Look, this receipt that I picked up has the largest amount change returned on it! Now I'll tell you how all of these are ordered!"
That's meaningless! First of all, why should we trust someone just because they have a big receipt, and secondly what does it "Prove" exactly?

In other words, PoW is a method for a decentralized group of mutually distrusting parties to come to a consensus about a specific ordered set of data. PoS is no such thing. PoS should be called "Evidence of Receipt in Exchange for Trust".

https://download.wpsoftware.net/bitcoin/pos.pdf

You can't. Proof of stake is just providing proof that at a given instant in time, you owned X amount of currency.

The major problem with POS is that producing a block doesn't use up a limited resource; i.e. it costs nothing and therefore attacking the network also costs nothing.

This is good starting point: https://blog.ethereum.org/2014/07/05/stake/

It actually costs something, namely calculations of the alternate branches, which is somewhat similar to PoW

The distribution of the winning miner/staker uses the same SHA256 to randomize things. The differences between them are not as large as most people make it out to be.

The search space is pretty large to create a better chain, curious to know your estimate on the number of hashes needed to do this attack for nothing

At a higher level, both PoW and PoW allocate the winning blocks base on the same thing, ie money.
Money buys hashrate gets blocks vs Money buys coin stake which gets blocks.

The end result is that people with more money get more blocks.

James

That cost is trivially achievable though. It might as well be costless compared to POW.

Your equivalency is incorrect, here is the true equivalency:

* money buys mining equipment
* money buys coins

Note that after this step in either currency there is a massive difference when it comes to producing a block.

"cost is trivially achievable though" really?

please describe to me this trivial algorithm. I can then code it up and we can take over all the PoS coins. I will split the proceeds with you 50/50, I am just not smart enough to figure out a way to trivially achieve this as I am just a simple C programmer and dont know all the advanced algorithms that you must know.

As near as I can tell, I would need to create a large number of addresses with minimal amounts of funds and then start calculating all the permutations of recent blocks to create one with a larger weight. But without actually funding these accounts with meaningful amounts of coins (that costs money!) the chances of winning a block is quite small. And even this "costless" attack is costing a lot of computations. And if I have to buy 10% of the coin supply to attack it, that is far from a trivial and free attack.

I am not disagreeing that there is a difference in effort, as doing billions of hashes to find a block is a lot of work as opposed to hashing pubkey against previous block. What I am saying is that the random distribution of block winner (and that is primary purpose of PoW/PoW isnt it?) is pretty much the same between the two.

Anyway, it is trivial to say something is trivial, quite another thing to prove that claim.

James

There is no need for a proof, a simple Reductio ad absurdum will do:

The following two facts cannot both be true:

* Mining a POS block on very low performance hardware such as a PI is easily possible
* Producing a block is prohibitively expensive

that is your "proof"?

I do not recognize the math you are using. It seems you are using "common sense" to prove the behavior of complex mathematical system.

But I will play along as I can provide a counter example to your proof:

You have to have purchased significant stake in order for a low performance hardware to be able to generate blocks.
Such a significant stake is prohibitively expensive. So both your statements are possible at the same time.

Money -> stake -> blocks vs Money -> hashrate -> blocks

PoS: The mathematical properties of staking is distributed according to stake using statisical means
PoW: The mathematical properties of mining is distributed according to hashrate using statisical means

both stake and hashrate are purchased with the same money. If to use your level of math proofs, I have proved that PoW and PoW are identical! But I am not saying that. each has its own place where it has advantages over the other

But please, let us not just be making unsubstantiated statements, this would become some sort of illogical "debate" where logic and truth are not part of the process. You do want to have truth and logic part of the discussion, dont you?

James

Purchasing stake may well be expensive.... Let's say, for example that purchasing enough stake to attack a POS chain costs you as much as buying enough mining equipment to attack a POW one?

So, once you are ready to attack both chains, then what?

*) In the POS chain you can attack continuously at zero cost, since block production costs you nothing
*) In the POW chain you must spend continuously to produce a valid block, and what's more, you must outpace the entire network in order to produce a longer chain

Simplifying, in a POS chain the attack cost is a constant (the price of the stake) whereas in a POW chain, the attack cost is superlinear in the number of blocks you want to produce.

It all comes down to the same thing: money

And if we were to hypothetical bitcoin vs bitcoinPoS, then I would think that it would cost a lot less to buy 50% of hashrate than 50% of marketcap.

You need to take into account that prices are not static and any pre-attack accumulation will make the price go up exponentially.

And it seems that you are admitting that in the absence of an attack, there is not much difference. So the difference is the cost to conduct an attack.

So, what would it cost to buy half the hashrate for bitcoin?

James

P.S. Another twist that makes this not so trivial is that once the attacker has accumulated a large stake, he has a large stake! And now his decisions to attack need to take into account the cost to his stake.

I am saying that no matter the cost of acquiring stake, the attack cost is still a constant. In POW, the attack cost is superlinear.

In addition, POS is not proof of current stake, it is proof of historical stake - at time X there is a proof that you owned Y stake. This means you can buy a bunch of coins, keep the keys, sell the stake and then use the historical proof to produce fake, valid chains.

That's not really true, all you need is "proof" that at one point you had a large amount of stake. (See 4.2 Costless Simulation) Things like NXT get around this problem by time-locking changes and blah blah blah.
You can, of course, add enough rules to make a PoS currency kind of work, but that's not really surprising because their security model isn't novel. If you're willing to give up trustless decentralized consensus then there are much better ways than PoS to make a digital currency..

A properly designed PoS avoids history attacks

Bandaids on a broken system.

My point is that PoS has evolved from the initial attempts and it is becoming almost as secure as PoW. I do agree that PoW is more secure than PoS, but at a great cost. I am an agnostic as far as PoS vs PoW, each has cases where it is better than the other, ie neither dominates the other. This tells me the true solution is not yet.

As far as your claim about PoS needing to give up being trustless and decentralized, you seem to be just saying stuff without any proof.

As near as I can tell PoW and PoW are roughly equivalent in its trustlessness and decentralizedness. Of course you are probably much smarter than me, so I await some sort of logical set of statements that shows that PoS leads to centralization

James

If the hashrate in bitcoin drops x4 times comparing the current values... What would be the cost of attack?  ;D

Was the first PoW implementation perfect?

Why is it that anybody can potentially change the txid of an unrelated transaction in bitcoin?

Nothing is perfect.

James

Superlinear in the number of blocks

I quite agree. However, you must accept that you cannot have cost free block production without cost free chain attacks.

See "4.3 'Long-Range' versus 'Short-Range' Attacks"
https://download.wpsoftware.net/bitcoin/pos.pdf

"... new nodes joining the network, and nodes that appear online after a very long time, would not have the consensus algorithm reliably protecting them. Fortunately, for them, the solution is simple: the first time they sign up, and every time they stay offline for a very very long time, they need only get a recent block hash from a friend, a blockchain explorer, or simply their software provider, and paste it into their blockchain client as a “checkpoint”. They will then be able to securely update their view of the current state from there."
https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/

In other words, it's not just my claim that they need to give up trustless decentralized consensus, that's a pretty well accepted fact at this point.

I agree that once the attacker gets a 50% stake, then its game over for a PoS (unless the attacker starts to care about the coin he owns), while a PoW could eventually work its way out of such domination, ie cex-io had >50% for a while, but not anymore.

In PoW an attacker with >50% of hashrate might not care at all about the coin, this wont be the case for PoS

But to say it costs nothing to attack PoW is disingenuous. More accurate is "after you spend a lot of money, you can dominate a PoW without any incremental costs"

But it all seems like this is about which system would be more resilient under a massive attack scenario. The truth is that no blockchain is safe from a massive attack today, so to be debating about which one is less broken is not so productive. Hopefully we can make a system that is able to withstand any sort of attack.

James

Sure?
Hashrate drops x4 -- This means that 3/4 of current ASICs have been switched off because they are unprofitable to their owners.
How much the obsolete ASIC costs on market?
I think ~nothing.
How much money should you have to collect enough obsolete hardware for 51% attack?  ;D

Well sorry to give a counterexample, but what if when you are joining the network after a long time (or for the first time) to query a massive amount of nodes? In the case of an attacker conducting a massive sybil/eclipse attack, then both PoW and PoW will have a difficult time to find the right chain.

So you might accept one example from a hypothetical because it reinforces the conclusion you want, but I prefer to analyze the details a bit deeper.

If all nodes are queried, then how is it not decentralized? (of course, you can make it a bit more efficient and just query enough nodes to get to a confidence level that you are comfortable with)

James

I think you mean POS there.

Anyway, the point is, the attack cost is a constant. Once you have acquired stake X which gives you Y probability of producing a block, you can go on using that probability to produce double spent transactions, forever at zero cost.

X does not need to be 50% in order to cause a serious problem.

POW is good for Long life coin , because very hard to produce newcoin, you must rent Rig or build yopur own rig to mining it
and at POS is best choice for short life coin, you can profit more and more (if you stake at first time) i think POS coin is like ponzi scheme

This has got sybil attack written all over it.

if a PoW node is sybil attacked, how does it defeat the sybils?
Are you saying that if a PoW node bootstrapping is surrounded by only sybil nodes, it has a way to notice this?

With POW a node can easily verify that the POW is correct - that negates sybil attack.

really?

So if a new PoW node is bootstrapping and it is only connecting to sybil nodes that have created a totally fictional (but technically accurate) blockchain, there is some magic that PoW node can do that PoS cannot do?

I cannot imagine any such thing is possible

James

Producing a totally fictional blockchain is computationally equivalent to outpacing the network. Not impossible, but it requires 51% of the hashing power of the network to produce a chain longer than the best chain.

How so?
You can just make the hashrate constant and very low. Remember this is totally fictional chain, so the real network has nothing to do with it. I am pretty sure that with a bit of tweaking, you can generate blocks very quickly and still have it pass all the PoW verifications

If the only chain a new node sees is this one, then i dont see how it can differentiate it from the real chain, which it cant connect to in this hypothetical.

James

You're correct that in a hypothetical scenario where a user has no access to any other valid peer then it obviously can't validate it's version of events with a peer.
However, PoW can trivially bootstrap itself in the face of an overwhelming majority of hostile nodes. All it needs to find is a single node with proof that it has a blockchain with greater work on it and it's good to go. The valid chain has the most work. No human intervention required.
PoS cannot bootstrap itself in this manner. Even when there are valid nodes available, you would have to find somebody you trust and manually add a checkpoint.

PoW does have an easier time, but what do you think of querying 50%+ of nodes during bootstrap?
What trust is needed in that case?

The valid nodes would all be on the same chain and the attacker a different chain, the assumption is that the attacker chain has less weight from genesis than the main chain (otherwise the attacker's chain would technically be the main chain).

And why cant a PoS node validate the main chain? If there is a requirement that all nodes eligible for staking have a registered pubkey, then for each block, the bootstrapping node can calculate which account should have generated a block. Granted there wont be a way to know which nodes published the blocks that it could have, but this is also an issue for PoW as it would be possible for a fake PoW chain to have omitted valid hashes and in the absence of them in the blockchain, the bootstrapping node wont have a way to know it existed.

I think the bootstrapping PoS node is in a similar situation. Mathematically, it can rank the winning block being 1st, 2nd, 198th on the list of eligible accounts to stake. So if it is always the 1st, then there is no issue and if there is some crazy low account with a block, it would be detectable and require some additional correlations.

I am not saying it is easy, but if all the nodes are in consensus, then PoS vs PoW does not seem to matter so much. And resolving attack scenarios is a messy complex thing, regardless of how new coins are minted.

James

It is prone to sybil attack - the cost of pretending to be N nodes is tiny, so you can pretend to be 50% of the nodes on the network at very little cost.

Is any PoW needed to be a node on a network? I thought PoW is only used to create new blocks

Tier Nolan is proposing a QoS to create a PoW requirement to be a node, but to my knowledge this is not done yet. I have added such an anti-ddos to supernet protocol, but being a node on the network is independent from generating new blocks, so it has no relation to whether a coin is PoW or PoS or if it isnt even a coin

No POW is need to be a node. Not sure what your point is?

You were suggesting that querying 50% of the network is trustless, because that is a majority - however, that is prone to sybil attack, since pretending to be a node costs nothing.

OK, so query 60%, or 70% or 90% at some point you have to admit that the sybils are detected (unless the entire network is sybils)

If this policy is valid, why bother with any proof of stake at all in the main protocol? All you'd need would be to validate transactions against 60%, 70% or 90% of the nodes in the network, and bob's your uncle?

You still would not need any trust as a PoW cryptocurrency. Even if you started up your client and you happened to query 100% nodes at the time and they were all the wrong chain, the node can self-correct once it receives a block from the proper chain that reveals that higher work is occurring. It would reorganize and be fine from that point on.
Proof of Stake can't do that. If it gets bootstrapped without any kind of checkpoint then it will simply be wrong until a human intervenes. A new bootstrapping Proof of Stake software cannot detect a Sybil attack.

Sure, yes. If you have a centralized authority that keeps a register of valid pubkey's, then as long as you can trust that authority, you'll be able to bootstrap the correct PoS blockchain.

Again, of course a PoW blockchain can't figure out it's wrong if it never communicates with valid nodes, but once it does it can reorganize itself based purely on whichever chain has the most work.

It is not only messy with Proof of Stake, it's impossible without breaking the fundamental security model that Proof of Work has.

As an aside, I find that Proof of Work deals with attacks in ways that are elegant and very well understood whereas Proof of Stake is replete with ad-hoc rules and behaviors that I find highly arbitrary and difficult to follow, but your mileage may vary I guess.

this is only needed for bootstrap

what if the PoS network uses a PoW network as the trusted authority? Then as long as the PoW network is secure, the PoS can bootstrap using data from the PoW network

Maybe this hybrid mode is a good way to get the security of PoW in a PoS chain

This has been suggested before (https://bitcointalk.org/index.php?topic=1170713.msg12325428#msg12325428), but, of course, it only prevents re-orgs longer than the POW block interval.

...and this surely calls into question the point of having a POS chain at all.

I would suggest that there is no difference between a synced node and a bootstrapping node in terms of consensus design.

Not all PoS is the same, and if it's not done right it will have security flaws.

That said, PoS is like mining without mining gear or extra electricity, and that is why I like it. I used to be a Bitcoin miner for PoW but I am not anymore. You can eventually make more via PoS minting than with PoW mining. Essentially, Your coins are the miners. Think of it that way.

@monsterer et al.

Theory is one thing but what about empirical data:

- are there any PoW coins that have been killed by external attacks? (I believe BCX killed some, but don't know any details)
- are there any PoS coins that have been killed by external attacks (N@S, history rewriting, etc.)?

How do we define a block chain death?

PoS is nearly worthless because you do not need to make any kind of initial investment to start mining.

PoS is more secure imo

Good question. I used the word "killed" pretty ingenuously. What I wanted to imply was, that after a malicious third party interference the coin lost a massive amount of value, a massive amount of trust, market cap dropped big time and didn't restore after weeks, etc.

Let's collect some evidence first in this brainstorming phase and try to define "block chain death" later.

We often hear that the POS is less secure than POW because of the Nothing at Stake problematic. At least, this is the only reasoning against the POS by the POW people. Well this and the initial distribution problem, but I don't really see this as problem at all.

We can all see that the Ethereum will switch much sooner to POS than expected, in about a year, while their network will stall and switch will be unavoidable in about 16 months, the latest.

Vitalik claims that he has solved this Nothing at Stake problem!!
What are your thoughts about this?
Thanks!

Unless you expend some limited resource when producing a block, you have not addressed the key problem with POS.

Do you mind expending your explanation? This is very interesting topic to me.
Are you trying to say that his claims that he solved NaS problem permanently are not right?

If producing a block has no cost, then neither does attacking the chain - that is the key problem with POS, and is the thing which causes NaS to exist in the first place. Just fixing NaS doesn't address the key problem. It's like sticking another bandaid on a broken system, IMO.

OK, then after you, all POS coins are doomed and only POW has future, since it needs to be expensive to validate block in order to be secure.

I don't know have you had an opportunity to read this explanation, but Vitalik claims that you are not right.

https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/

I am not an expert, and correct me if I am wrong please.

Thanks!

It needs to be expensive to produce a block, not to validate one.

would you consider BTC a limited resource?
it is the BTC that is the resource needed to buy the stake that creates the PoS blocks.

In a sense, PoS could not exist before PoW.

What if producing a block is expensive due to opportunity costs (implicit costs are also "expensive", right)?

You buy BTC/NXT/BLAH to acquire your stake, yes... But producing a block after you own the stake costs nothing.

Can you give an example?

E.g. your investment losing value

OK my bad, to produce a block, not to validate. You still haven't answered my question though. Are all POS devs wrong then, even Vitalik even though he claims that he has solved a NaS problem. Will he then be putting his whole Ethereum project, that got 18 millions of investment  in danger, when he's implementing POS? I mean, can he be that wrong?

Not just him, but the NXT devs, all devs of the POS coins. I took Ethereum example, since the people have trusted them with 18 millions, nevertheless.

It seems you are fixated on "producing a block after you own the stake costs nothing"

Why cant the same logic be used for "producing a block after you own the mining gear costs nothing"?

I dont understand why it is such an important thing where you draw the line of incurring costs. Regardless of when the cost is incurred, it is  still a cost.

So the one advantage PoW has over PoS is that once PoS is 51% attacked, then it cant escape, while a PoW being 51% attacked is a temporary problem.

OK, so if somebody buys up half a PoS coin, then he can create whatever blocks he wants from then onward without any incremental cost. However, who in their right mind would spend multiples of marketcap, just so they can create new blocks without cost?

You seem to ignore the PoS characteristic of getting people who have more of it being more vested in it and less likely to attack it.

To put in perspective, if BTC was a PoS coin, it would probably take billions to get to a controlling stake. And for all that cost, it is not clear that even millions could be made and if any sort of attack is made from the controlling stake, the value will drop far in excess of any gains from an attack.

So I will give to you the point that once a PoS is controlled, it will be a permanent thing and PoW has an advantage here. However, I do not see it as any practical problem as it does not make economic sense to conduct such a financial attack

Because its not true? After you purchase all the mining gear, producing a block costs the entire network 25 BTC. So if you want to double spend, you have to outpace the network producing blocks, which is very expensive.


If I give you a loan which has a handling fee of X and an daily interest rate of Y, this is a very different cost model to a loan with just a handling fee. So, a cost is not equal to a cost. Same thing applies here.


You don't need to buy a majority stake in a POS coin - every bit of stake you own gives you constant probability of producing a block, and therefore a double spend. The more stake, the higher that constant value is.

In my opinion, a POS is just eco-friendly emulation POW. In the case of real need to spend a hacker could double spending in both systems, but it is too costly to be justified.

PoS is emulation of modern fiat currencies.
People who has majority of funds can dictate everything and make any changes in the "algorithms".

so my understanding and correct me if wrong
Proof of work performance has to do with the mining hardware one got
 and with proof of stake the more coins you hold the more you can produce???

what i don't really understand is how you actually generate coins with proof of stake...based on what???

Coins come from recycled transaction fees, and your chance to generate a block is proportional to the stake you owned at a given time.

all the china pool's hashrate sums up already far more than 51%...so..for those who said how POW so good so better so best blablabla..you guys should give up bitcoin now.

Vitalik Buterin explains the difference between PoS and PoW.

https://coincodex.tv/videos/496/vitalik-buterin-explains-the-difference-between-proof-of-stake-and-proof-of-work