Bitcoin Forum

I've got an idea, and I would like to share it with you here to discussed/ripped it apart:

Two-Round Proof Of Work:

We devised a process with two rounds we called Two-Round PoW: In the first round, we run a similar Bitcoin PoW with a small hash complexity for all the miners. And in the second round we run another Bitcoin PoW only among the winners of the first round.
Let's N1 be the number of all miners. The goal of the first round is to select the first N2 miners that succeed to resolve the first round PoW puzzle. In the first round, each miner will solve for its own ounce1. The second round competition is only among the winners of the first round, the N2 miners. i.e each one of the N2 miners will solve for its ounce2. The complexity of the second round can be made adjustable like in Bitcoin to maintain the block time.  

For example: if we have N1 = 100000 miners in the network, we can decide to chose to only work with N2=100 miners for the second round of TRPoW. We can set the complexity of the first round in such a way that it can be with minor electricity consumption. And then adjust the complexity of the second round. In addition, we can also adjust $N_2$ to maintain the block time. Like this we can reduce the electricity consumption by as much as we want. So here we have two rounds with two parametrable complexities. We can view Bitcoin PoW as a Tow-Round PoW where N2 = 1 and no complexity in the second round.

In short, In a Two-Round PoW system, all the miners compete in a first round where each miner solves for its ounce1 and the fastest N2 miners that solved the first round puzzle, i.e the winners of the first round advance to a second round where they get to choose between them the fastest miner to solve its ounce2.

For more details please read here. It is a very short algorithm: https://www.researchgate.net/publication/356188255_A_Two-Round_Proof_of_Work

or Here on google drive: https://drive.google.com/file/d/1XVwMuDHIEBYX2GbAI_rFzx8eEsM7Z5ps/view?usp=sharing

Anyway, I just wanted to throw the idea out here to see if there are any obvious reasons why it couldn't be implemented, and to hopefully spark a discussion amongst those better qualified than me.

Thank you very much in advance for your thoughts / suggestions / ideas / critics

This sounds like you're wasting more energy than you should. There are two rounds and there will be miners who'll solve the first PoW, but not the second and those who'll work for the second PoW, but they'll not solve it.

Could you give us the PDF in plain format and not via researchgate.net which requires us to sign up to read it?

However, even if I don't understand it that much, don't you consider it possible to have calculated something wrong? By that reasoning, we can have infinite rounds of PoW and no energy required.

Thank you for your quick reply. Once in the second round, the behavior is like Bitcoin PoW: If no one among the N2 miners finds a solution within the block time there will be adjustment to the complexity. etc. etc

I will attach the PDF. Here on google drive: https://drive.google.com/file/d/1XVwMuDHIEBYX2GbAI_rFzx8eEsM7Z5ps/view?usp=sharing

Thank you.

There was a coin with two phase Proof of Work called Luck and it failed, because it doesn't matter how many phases you have. Miners can always mine in a black box way. You can always implement mining as a single phase process and distribute rewards between N people by grouping them in mining pools. You know what happened in Luck, where people were trying to avoid pooled mining? People were disappointed, because mining a single block was taking more and more time, some miners received one block per month.

The problem is not splitting mining into more phases. The problem is to give each miner its own share. If someone solo mined N times easier block, that miner should receive N times lower block reward for that. The problem is: by doing that kind of things on-chain, you will flood the network with small transactions between miners. For now, centralized pools are handling rewards off-chain, miners just withdraw their coins later, when they accumulate some significant amount. So the whole problem in decentralized mining is about joining shares, joining transactions, and in general compressing all data related to payments for miners, so that could compete with centralized pools.

You can download my PDF directly here: https://drive.google.com/file/d/1XVwMuDHIEBYX2GbAI_rFzx8eEsM7Z5ps/view?usp=sharing

I think the Tow-Round PoW is different from the Luckcoin concept.

From what I read, it looks like Luckycoin was based on Proof of Work with minor modification in the complexity adjustment.
https://cryptomining-blog.com/tag/luckycoin-scrypt-crypto/
Or a mention here: https://www.goldmansachs.com/insights/pages/crypto-a-new-asset-class-f/report.pdf


Thank you for the input. Much appreciated.

TBH, you lost me here.

There is always the possibility that two blocks will be found by the same miner. How would you handle this?

Assuming you perfected the above issue, I would say that you should not reinvent the wheel. If however, you feel very strongly about your proposal, I would encourage you to create an altcoin with your proposal implemented. If it is superior to the status quo, the market will reflect your altcoin accordingly.

Yes. I totally agree with you. The best way to test the idea is to actually create a coin that is using the TRPoW.

Regarding the block fork. Here, we assume that we have a system like Bitcoin where we replace
PoW by TRPoW and everything else stays the same with minor adjustments due to the introduction of TRPoW.
Like in Bitcoin, a miner can decide to cheat and ignore the TRPoW instructions and the information that it receives from other nodes and continue solving for a block and take the reward for itself. It will create a fork. Later on, the miners in the network will simply go with the longest block and ignore the cheater block.

Thank you for your comments and the good suggestion.

Not Luckycoin, just Luck. Details are in this topic: https://bitcointalk.org/index.php?topic=5254068
Also there was some discussion about elimination of mining pools: https://bitcointalk.org/index.php?topic=5254327

I think learning something from their mistakes before starting a new project is a good idea.

Thank you very much for your reply. I read the thread. It is quite interesting indeed.
I was NOT able to download the Luck white paper because the link and the website are no longer working.

However, I read the different discussions here and It looks different from TRPoW.
Luck is using two phases of PoW to reduce the domination of large mining pools. While TRPoW is using two phases PoW but to reduce the network electricity consumption. Based on the few details in the discussions in the thread, It seems though that we are doing completely different things. TRPoW is not using any fancy formulae to calculate anything. Our changes are purely distributed algorithmic.   

Please share the white paper PDF here if you still have it.

Indeed it is important for me to learn from this experience. Also, I am not trying to reinvent the wheel as I was not aware of this project until you mentioned it.  

Thank you as always for your great sharing.

I don't believe your proposal reduces energy consumption. Energy consumption in PoW is limited by the value of the block reward, and is not related to the difficulty of the solution. The difficulty maintains the time between blocks.


How does the network decide which are the first N₂ solutions? Each miner could insert their solution to their list regardless of how many other solutions they have already received.

Hi Odolv,

It is explained actually in section 3 (Figure) and 4.

Anyway, In the TRPoW, each miner will hash the block header plus its public key plus an ounce repeatedly. The public key is added into the hash to avoid a miner using the result of other miner as its own result during the broadcasting of the result. The complexity of the first round is the same for all miners but each miner is solving for its own problem. In the second round, each winner miner will hash the block header plus its public key plus its ounce of the first round plus an ounce repeatedly.

Please have a second look.

The other byproduct benefit of using of the public key in the hash is to help reduce the domination of big pools. Though it is not the best solution as minors can still by pass it. The main goal of TRPoW is to reduce the electricity consumption.


Thank you for your comments and ideas

You don't explain how your system reduces the energy consumption. Miners are going to expend as much energy as they can afford in order to be included in the second round. Right?



It may not be important, but how are the "fastest" miners chosen? In Bitcoin, the first block produced is not necessarily the one ultimately added to the chain. In your system, each miner can have a different set of first N₂ blocks. Also, just to complicate matters, as I stated before, there is no reason for a miner not to submit their block as one of the "first" N₂ blocks, even if they have already seen N₂ blocks.


BTW, the word is "nonce", and not "ounce".

The electricity will be reduced by the fact that Round 1 is not computing-intensive and most of the miners won't be "allowed" by the rules (if followed) to advance to the second round. The second round will be only among the first N2. This will reduce the electricity greatly.

In the traditional PoW, all miners are hashing for big complexities most of the time. While TRPoW round 1 complexity is not electricity intensive. The complexity of Round 1 will be set to be small. So Round 1 is pure Luck and Round 2 is where the calculation power is needed.

The other points that you mentioned, their treatment is very similar to how Bitcoin is dealing with these issues.

Keep in mind here that we are changing only the PoW. Everything else stays the same.

the blocks mined by cheaters will be ignored like In Bitcoin and the network will always work with the longest valid chain.

I agree with you that it is possible that we have two sperate groups with two different N2 miners that will produce two valid Blocks. But again the same situation is happening in BTC. So the same treatment applies here.  

thank your for sharing and the correcting of "nonce". Much appreciated.

Regardless of the complexity, if I use more power to increase my hash rate, then I will have a better chance of getting to the second round. Right? So, why wouldn't I use as much power as I can to get into the second round?

I think a solution would be to eliminate the PoW in the second round and simply make it a random selection (somehow). That would cut the expected block reward by a factor of N₂, which would cut the power usage in the first round by that same factor.

The OP appears to be proposing something that will result in only 0.1% of the miners using their equipment in the second round of mining, and the remaining 99.9% of miners will turn off their equipment during the second round.

The above is not possible due to pool mining. As an example:
If there were 10,000 pools participating in the 1st round, only 10 would make it to the second round. Once the second round starts, the miners who were mining for the 9,990 pools that are not participating in the second round would switch to one of the 10 remaining pools.

There are currently 4 major mining pools (with the likelihood of there being more that are not public). Most likely, they would all be able to participate in the second round of mining, however in the event that one pool is unable to participate in the second round, the miners mining for that pool will switch to one of the remaining pools. If a "solo miner" would be able to make it to the second round, it would make financial sense for them to "sell" the ability for others to "mine in their name" and if no pools are able to participate in the second round, all of the pool miners would "buy" the ability to mine in one of the solo miners who are participating.

tl;dr - total electric consumption will not be reduced by implementing the OP's proposal.

Wayback Machine still has it, as well as some lucknet.club pages: http://web.archive.org/web/20201201172513/https://lucknet.club/doc/luck.pdf

But you know that Bitcoin blocks are produced in a similar way? Small miners include public keys for mining pools, so even if all blocks will be signed by miner's keys, it won't change anything. You can have one phase, two phases or N phases, it doesn't matter. Pools are going to download your client and behave like any other network participants. Then, they will be connected with hundreds of nodes and rewarding them "per share", no matter how complex that single share will be and how many phases will be needed to get it.

If you have something that is not computing-intensive, then the energy consumption is reduced, but along with security. I guess the same thing could happen as in Luck: if you have two phases and they are not equally hard, then miners can game the system by dividing it differently between those two phases than you did in the original software. For example, your official client can mine the first phase for a short time and spend the most of the time on the second phase. But some optimized version could do the opposite: spend a lot of time on the first phase to pretend there are millions of miners, and then quickly solve the easiest blocks by completing the second phase.

Or maybe they will find an equillibrium somewhere in between, maybe with the same amount of time for each phase, maybe 2/3 for the first and 1/3 for the second one, it really depends on your network parameters. In Luck it reached the highest limits they chose, as far as I remember their "alpha" value exponentially increased to the maximum value and stayed there, because that case was the most profitable for huge miners. In their first version there was no such limit, so without their first hard-fork, the network would be dominated by the biggest miners forever.

You cannot assume that all miners will follow the rules, just because you placed them in your client. Rules have to be wired in the protocol to be followed, if some rule is only client-specific, it can be bypassed. For every successful coin you can find custom miner software, where miners optimize things far beyond what you gave them in the official version.

Also, if there are millions of miners and you randomly select 100 of them, you encourage the rest of the miners to form mining pools. Then, you will end up in a situation where 100 miners are selected as before, but there are only 100 huge mining pools, they always get everything and distribute that to smaller miners. Almost no solo miner will follow your system if that miner will be rewarded once per month, because the risk of price drop after entering exchange is higher than the potential reward from solo mining.

I'm sure the miners wouldn't be supporting such a thing because it just makes it even harder for them to get a reward.


I wonder if the people that wrote that paper realized that. that's thinking ahead! ;D the bitcoin mining system is really hard to make changes to without causing things to get "out of whack" ;D

If you use more CPU power, you have always better chance to advance to Round 2. However, because Round 1 is not CPU computing, small players will be able to advance to Round 2 too. It is like we are giving more chances to small players to earn.

About your second point, let's me reflect on it.

So then, why would miners use less power?

You state "In the first round, we run a similar Bitcoin PoW..." If the first round is similar to Bitcoin PoW, then it has the same economic incentives, in which the cost of mining is limited only by the value of the block reward, regardless of the complexity. It seems to me (I may be wrong) that you may be succumbing to a fallacy similar to the belief that more efficient miners (in terms of J/hash) in the future will cause the overall power consumption of mining to fall.

In an ideal world with TRPoW, most miners will spend their time moving from one Block Round 1 to another Block Round 1 because the round 2 is limited only to the fastest few N2 miners. And hence we will able to reduce the electricity from not involving everyone to go on a spree of CPU intensive hashing all the time.

So the idea is not to advice for LESS CPU power but to create a system that do the same thing like BTC with less electricity consumption.

You could but if I'm understanding the OP proposal correctly is that he will only allow a certain # of miners into round 2, such as 100. How those would get chosen he said it is based on the first 100 that solve the puzzle. So in that sense, if you increased your hash rate then it would increase your chances of getting into round 2. So your question is valid. The answer is you would use as much power as is necessary to be in the top 100 but no more. ;D

Not sure on that. But why not just have a single round 1 and just select the winner at random without eliminating anyone? Why wouldn't that work?

This is similar to say that miners will organize themselves in big pools to organize a 51% attack on Bitcoin network. It did not happen so far.

No. The miners have incentives to not 51% attack the network. If they try this, the value of their equipment to drop >99% overnight.

Miners engaging in activity similar to what I described is similar to miners attempting to keeping their equipment that has a limited shelf life working as much as possible.

In a real world with TRPoW, most miners will spend their time working on Block Round 1, because the round 2 is limited only to the fastest few N2 miners, so attacking by kicking someone from that top100 and taking its place is more profitable than honestly waiting for the next block. Because kicking other miners from top100 is more profitable than doing nothing, everything can be reduced just to phase one, then phase two is the easiest part, needed only because consensus rules says so.

Also read this: https://www.truthcoin.info/blog/pow-cheapest/#nonproductive-investments-are-wasteful. Not only it explains why other solutions like Proof of Stake or Proof of Capacity are worse, but it also explains why any two-phases or N-phases solutions are pointless (and can be reduced to the old, plain, unobscured version of single-phase Proof of Work). The reason is the same: you have some simple economic rules, miners are trying to maximize their income, and making some official version that is "honest" is not enough to stop the coin from attacks. Even if your version is eco-friendly and stops mining when you didn't get into the second phase, other nodes may still keep mining, then an alternative version can be more popular, as it happened in many successful coins (including Bitcoin, because mining pools have their own optimized versions, they are not mining with their CPU's by using Bitcoin Core's default mining implementation).

It does not matter what is your goal. If you use the same tools to reach it, you will encounter the same problems. Even source code for Luck is still on GitHub, so you can still download it, see how they splitted the whole process into two phases and why it does not work as expected. Also you can see their Discord channel and watch some charts showing how some parameters of each phase changed in time, and how one huge mining pool reached 51% by gaming the first phase with his own software. Also I described it here, how they calculate their parameters: https://www.publish0x.com/vjudeu/two-phase-proof-of-work-as-a-solution-to-mining-pools-xrommel

I think there will be only a few miners in the testnet (assuming testnet coins will be worthless or destroyed after testing), a lot of miners in the first seconds after releasing the software (so that if it will be published on centralized servers, they could reach Error 500 because of too much traffic), then the difficulty will skyrocket and the coin will be worth a lot in some Discord-based P2P trades. And then it will enter some exchange, everyone will cash out and the price will go from All Time High to All Time Low.

But it happened in many altcoins, including Luck, when they splitted mining into two phases, many people were mining with the original software, and one mining pool gamed the whole system and reached 51% quite quickly. Also some FPGA miners gamed the system, they competed with CPU's, so they win, because mining algorithm was not resistant to that. Also, the question is: which hash function you are going to use? If you use just sha256d as Bitcoin, the competition will eat you one minute after release.

Could you please explain to me how you are going to attack by kicking someone from Top100 ?

Keep in mind that in order to move to Round 2 you need to Announce it to the network by Broadcasting your solution of Nonce1 and your list of N2** miners up to the moment you found your nonce1. For the round 2 you hash the following:

Hash(BlockHead + PublicKey + Nonce1 + RandomNonce)

So you will always need to show that you were in Round 1 at some points. And if you are late, the network will have already formed its lists of N2 and you will be outside of it.

And your block will be accepted ONLY if your name was in the List of N2 of other miners.

Thank you

The PoW job is also to maintain the Block Time at 10min. We can achieve that by just making everyone wait for that 10min minus delay/network broadcasting time etc.

I think you need to have some skin in the game if you want to have long term serious players in the network. PoW is achieving this skin in the game by asking for CPU power and PoS is achieving the same by asking for stakes.

The N2 number of miners of the second Round is also adjustable like the complexity algorithm in PoW that is adjusted every 2016 Block.
Plus In Round 1 we are hashing Hash(Block Head + PublicKey + Nonce). So I don't know how this is going to force miners to organize in big pools. The Public Key of a miner has the benefit of limiting the formation of pools. In BTC PoW there is no public key in the hash. In TRPoW, the hash result is public key dependent.    

 

But you can pretend that you were. How it is decided who were in the first round? By Proof of Work, right? So if you have some higher Proof of Work, you can pretend that the miner with the lower work came later. And if the total Proof of Work is used to decide who tells the truth, then miners with more power always win.

So each group of 100 miners can pretend that they were first. When you join the network after they are formed in some groups, how are you going to choose the right chain? You can see 100 honest miners with some Proof of Work and 100 dishonest miners with another Proof of Work. If the most Proof of Work after two phases dictates the truth, then people are encouraged to kick other players from top100 by creating their own lists of top100. You cannot assume that all miners are online 24/7, you have to assume that someone can be offline for a while and then there should be some way to know which chain is the right one. The same is true for new miners, they know nothing about the network, they connect for the first time and they see some groups of top100 miners from the first phase. They have to know somehow, which group is the right one.

Also, Luck coin encountered the same problem in the early stage. When the difficulty was low, everyone could pretend to be a true winner in the first phase. There were some alternative chains, the official block explorer showed block 500-something, but people were stuck at 200-something or 300-something. Then, when difficulty raised to some higher levels, everyone received the right chain, but then small miners were kicked and mined one block per week or so.

If there is no upper limit for the N2 number of miners, then it will grow exponentially ad infinitum, people will spam the chain by pretending there are millions of miners, even if there will really be only 10 or 20. But if there will be some limit, for example there will be max 5000 miners, then you will reach that maximum and then the second phase will behave exactly as any other single-phase Proof of Work.

Thank you very much Bro. I tried this morning on Way back machine but I did not find it.
Thank you for taking time to share it here. Much Appreciated.


Yea. I can see its use for mining pools.


You can't game because of the public key in the hash. Plus in order to move to Round 2 you will need to announce it to the network by broadcasting your nonce1. So if you are a bit late your name won't on the list of N2 miners in other miners lists.

In the second round you hash the following: Hash(Block Head + Public Key + Nonce1 + Nonce). So if you cheat, other miners will detect you and ignore your block. Exactly like Bitcoin.



I do think that TRPoW is doing something different from Luck. We are not solving the same problems. I did not read all the Luck whitepaper, but from what I saw, we are already different.  


Yes. But like in Bitcoin, You can cheat and not follow the rules. But the network will simply ignore you by using the longest chain. You will be served better by following the rules.


The N2 number of miners of the second Round is also adjustable like the complexity algorithm in PoW that is adjusted every 2016 Block.
Plus In Round 1 we are hashing Hash(Block Head + PublicKey + Nonce). So I don't know how this is going to force miners to organize in big pools. The Public Key of a miner has the benefit of limiting the formation of pools. In BTC PoW there is no public key in the hash. In TRPoW, the hash result is public key dependent

Did you see these instructions ?

TRPoW miners will execute the following instructions:

• 1- If a miner receive $N_2$ $nonce1$ or more broadcast from other miners before finding its own $nonce1$, it will broadcast the list of the first $N_2$ winners and drop the current block competition and move to the next block. In this case it failed the first round and the block reward.
• 2- If it finds its $nonce1$ before receiving $N_2 - 1$ solutions from other miners, it will broadcast its $nonce1$ with the list of all the miners that found the solution before it including itself. it will continue listening the network to build the full list of the first $N_2$ winners. And at the same time move to the next round competition. In this case it succeed the first round.
• 3- If it didn't find its $nonce1$ yet and did not receive yet the full list of $N_2$ winners, it will continue solving for its first round $nonce1$ and listening to the network broadcasting to build its list of $N_2$ winners. In this case it is still running the first round.
• 4- If it finds its $nonce2$ before receiving any valid $nonce2$, it will broadcast its $nonce2$ and update the ledger and register the block reward for itself. And move to the next block. In this case it won the current block reward.
• 5- If it receive an $nonce2$, it will verify the solution and verify that the miner is in its list of winners of the first round. If all is fine, it will move to the next block competition having failed the current block comeptition. If the miner is not in its list of winners of the first round, it will ignore what it received and continue solving for its own $nonce1$ or / and $nonce2$ and listening to the network.

you can pretend, but if you don't follow the TRPoW instructions, you will be ignored by the network. Keep in mind that in order to win a block reward, you need to be in the list of N2 miners of other miners.

You can pretend and create a fork. but your block will be ignored in similar fashion like in Bitcoin. No difference here with Bitcoin.

Again like in Bitcoin, we take the longest chain. No difference with Bitcoin. The honest and fastest miner will always win in the long run.

This is a good point, but slightly incomplete: it's the total of resource consumption that depends on the value of the block reward. So if the energy consumption goes down, competing miners would buy more hardware, which moves the pollution to a different location.

What's stopping the remaining miners from doing a "51% attack", trying to beat the select few by creating their own new Round 1 followed by their own Round 2?

There is an upper limit for N2 otherwise, the whole thing will be worthless. The idea is to limit the electricity consumption
so N2  <<< N1 = number of all miners.


Thank you for your great sharing and ideas. Much appreciated.

Say round 1 only takes 2 minutes to get 100 miners. Then you just wait 8 minutes to select the "winner".  That's a 10 minute block time. So it saves 8 minutes of hashing. Less global warming.

The first N2 solutions received by one miner could be different from the first N2 received by another. Do you have a way to achieve consensus on who is in the list? If there are different lists, then the network will split when miners don't agree on who is in the list.


If you don't accept a block by someone not in your list, then you can't follow the actual longest chain. If you allow a block from a miner not in your list then every miner can include themselves in their own list (as soon as they complete round 1), which you must accept in order to resolve a split.

We can imagine that a lot of fastest miners will always be in the second Round 2. So those will win the race for the Block. In short the honest and fastest will win in the long run.

Those disqualified in the first Round will lag behind and the block they will create will be a fork and it will discounted by the network as most miners will always go with the longest chain. 

This is true...

But I think miners need to have some skin in the game if we want to have long term serious players in the network. PoW is achieving this skin in the game by asking for CPU power and PoS is achieving the same by asking for stakes.

You would need a way to prevent the knowledge of the winner for 8 minutes so that nobody can start on the next block before the 10 minutes have past.

No. But we don't need it. If there are different lists the network with go with the longest chain like in BTC.


Please Read instructions 1) and 5) below.
 
===========TRPoW miners will execute the following instructions============================

1- If a miner receive $N_2$ $nonce1$ or more broadcast from other miners before finding its own $nonce1$, it will broadcast the list of the first $N_2$ winners and drop the current block competition and move to the next block. In this case it failed the first round and the block reward.
2- If it finds its $nonce1$ before receiving $N_2 - 1$ solutions from other miners, it will broadcast its $nonce1$ with the list of all the miners that found the solution before it including itself. it will continue listening the network to build the full list of the first $N_2$ winners. And at the same time move to the next round competition. In this case it succeed the first round.
3- If it didn't find its $nonce1$ yet and did not receive yet the full list of $N_2$ winners, it will continue solving for its first round $nonce1$ and listening to the network broadcasting to build its list of $N_2$ winners. In this case it is still running the first round.
4- If it finds its $nonce2$ before receiving any valid $nonce2$, it will broadcast its $nonce2$ and update the ledger and register the block reward for itself. And move to the next block. In this case it won the current block reward.
5- If it receive an $nonce2$, it will verify the solution and verify that the miner is in its list of winners of the first round. If all is fine, it will move to the next block competition having failed the current block competition. If the miner is not in its list of winners of the first round, it will ignore what it received and continue solving for its own $nonce1$ or / and $nonce2$ and listening to the network.

Even if you can successfully prevent that knowledge for 8 minutes, someone can still start working on some randomly chosen block and have hope it will give some boost on average, where other miners will be idle. Also, you need at least two candidates, in other case any obfuscation of the winner is pointless. Does it mean that nobody can start the chain alone by using the official miner?

Another thing is getting the right to mine: one miner can pretend to be N miners or can just own many mining machines and assign different keys to each of them. Then, if the list of participants is known, any miner can try to extend any block, just by checking each of them sequentially, or even assigning different threads to different blocks. Extending one of N blocks has the same probability as extending some chosen block. Because having a chance to mine the right block is better than having no chances by being idle, people will run their machines all the time.

How is #1 enforced? What prevents a miner from executing #2 if it finds its own $nonce1$ after it has already received $N_2$ $nonce1$? A violation of #1 cannot be detected.


Nothing in your miner instructions ensures that every miner has the same list of $N_2$ miners. Therefore, #5 will cause a split that cannot be resolved by the longest chain because a block by a miner not in another miner's list for that block is not considered valid by that miner.

Where is the energy saving here, when the miner will have lower electricity bills, but there will be more miners?

And the statements that Bitcoin "waste" energy (and consequently imply that something needs to be done about it) haven't been debunked many times?

What is the probability of an honest longest chain be outside the N2 List (Or we can extend it a bit to N2 List of N2 miners because each miner who succeed Round 1 is broadcasting its List. But we don't need to as we can just merge the lists and put a cap at N2)? Anyway, this probabilistic problem is similar to the AT2 problem discussed by Rachid Guerraoui team in EPFL. I will share the Math later.  But it can be found in their AT2 paper (In fact they published 3 papers). Based on AT2 papers, N2 does not need to be big to achieve our purpose.

I don't think that's the issue. I think the real issue is a blockchain has no way of measuring "time". It doesn't know how to measure 8 minutes. But there has to be a way.

The public key associated with the address 1KFHE7w8BhaENAswwryaoccDb6qcT6DbYY belongs to the mining pool f2pool. There are thousands (if not more) of miners who mine on f2pool, but all of f2pool's found blocks payout to the above address.

If f2pool makes it to the second round, any miner who is not participating in the second round will switch to mining on f2pool, or another pool that is participating in the second round. If a miner sits idle (or is not otherwise producing work that has the potential to find a block) during the second round, their equipment is losing out on potential value.

The difficulty of the first round could be "x", and the difficulty of the second round would be "10000x". Each of the miners who are "selected" during the first round could need to have their "block" include the hash of the previous block, and the first "block" in the first round would need to include the hash of block found in the second round. The found block in the second round would need to sign the hash of the last block of the first round. This is very similar to how bitcoin mining occurs today.

wait, so you're saying that 2 blocks are going to be produced? one in round 1 and one in round 2? that's starting to get confusing. maybe we need someone to break this down and explain exactly what is going on so that it is understandable because the way you explained it right now makes it seem like there are going to need to be 2 blocks, one for each round. does that double the blockchain size? ???

The energy saving comes from the fact that most of miners will spend a big part of their time on Round 1 that is not heavy-energy / CPU consuming. At least this is the target, the bet and the hope.  

I don't think it is possible to have a single N2 list. Each miner that completes round 1 will have a list that may be different from every other miner's list. Furthermore, there is no way to agree on which miners were the first miners to complete round 1 because there is no way to resolve the differences in the lists.

The complexity in Round 1 is supposed to be small. Which means that most of honest miners will quickly find out if they need to move to Round 2 or not. Round 2 being limited to the fasted few N2. This will make most of miners idle / preparing for the next block which is not Energy-consuming. In Bitcoin today, most miners spend their time calculating the Hash puzzle most of the Block time (7 to 10min). So if we reduce Round 1 time to 1-4min or even more, it will be great. It is yet to be tested in grandeur nature.
        

Please explain how a lower complexity reduces the amount of energy used when miners are encouraged to increase energy usage in order to be one of the first N2 miners. Whether it takes 1000000 tries on average or 10¹⁸ tries on average, miners are going to use as much energy as they can in order to be first.

Yes but Round one is only let's say 2min for the sake of argument. Once this 2min is over Only N2 miners will advance to Round 2 to work on the second puzzle. Let's assume Round 2 calculation time is 6min. We have N1 miners working for 2min and N2 miners working for (2+6)=8min. In Bitcoin we have all N1 working all 8min. We save energy on Round 2. N1-N2 miners are IDLE during 6min of Round 2. This is where we save energy. Now I do understand that miners can try to game the system and rent their machines to the winners of Round 2. But I don't know how practical it can be to do so.   

Doesn't this scheme compromise the security of the bitcoin network. I mean, the security aspect of it is based on the total hashrate at every moment in time. if at any moment it decreases...then there's a potential weakness.

Some of them are idle, some of them are not. You can release a software where the miner stops, but if it is open-source, then miners can decide they want to compute hashes all the time, because then they have a chance to produce another valid Proof of Work. Even if some old nodes will not accept that, still, there will be new nodes and new miners that will know nothing about the past events in that network and will have no way to check, which Proof of Work is the right one.

Yes it does. It makes half PoW and half of luck. If this is good, then make it 100% luck. does it work? No. Its not secure.
This propose just lower security for name of "economical".

I don't think so. We can find an optimal value of N2 that does not undermine the security of Bitcoin with TRPoW. Intuitively an upper bound of such value is O(SquareRoot N1). Assuming that the winner of Second Round is among N2 List of N2 miners instead of only N2 first miners. An optimal value of N2 is could be in O(Log(N1)) based on a similar calculation done by EPFL Distributed Algo team: https://arxiv.org/abs/1908.01738
You can also see that Bitcoin with PoW is equivalent to Bitcoin with TRPoW where N2 = N1.
If we assume for the sake of argument that N1 = 1000000 and N2 = Square Root of N1 = 1000.
The reduction of energy can go drastically because we will have 1000 000  - 1000 = 999 000 miners (99.9% of the network) not doing the Second Round. We will save huge amount of electricity without undermining the security of the blockchain.

I see what you are saying. But if CPU power is controlled by honest nodes, I don't think, this type of attack will undermine the network ?

I agree with you on this. It is a good solution for the pool miners to use public key in the hash but it increases the complexity of the problem they are trying to solving.


Let's me think of the last part slowly. 

Great point indeed.

I'm afraid exactly that you might be right, and you might succeed  :)

The newly mined coins plus the transaction fees for the transactions included in the block have a certain value.
So it is obvious that the market will seek equilibrium and to channel the resources needed to mine with a similar market value (I assume that mining is still to be permissionless, and we will not create a miners clique or cabal where market law does not apply).

The precedents are not really optimistic...
Memory intensive mining algorithm like Scrypt can effectively reduce the energy intensity of computation. But then the mining equipment itself becomes the main investment of the miner, and the benefit to the environment is disputable due to increased e-waste production.

It's not even necessarily economical. People will just ramp up their hashing power for round 1 to try and get into round 2 so the energy expenditure over those 2 minutes would rise way above normal.

And then for the other 8 minutes, they got the bitcoin network by the balls so to speak. Relying on a small subset of miner hashing power. Sounds like a recipe for disaster. But I do admire the OP for defending his proposal and taking the time and effort to discuss it here.

I don't think TRPoW is a recipe for disaster. Far from it. Keep in mind that Bitcoin worked with small group of miners for many years.

As I wrote to you previously. We can find an optimal value of N2 that does not undermine the security of Bitcoin with TRPoW. Intuitively an upper bound of such value is O(SquareRoot N1). Assuming that the winner of Second Round is among N2 List of N2 miners instead of only N2 first miners. I think an optimal value of N2 could be in O(Log(N1)) based on a similar calculation done by EPFL Distributed Algo team: https://arxiv.org/abs/1908.01738

You can also see Bitcoin with PoW as Bitcoin with TRPoW where N2 = N1.

If we assume for the sake of argument that N1 = 1000000 and N2 = Square Root of N1 = 1000.
The reduction of energy can go drastically because we will have 1000 000  - 1000 = 999 000 miners (99.9% of the network) not doing the Second Round. We will save huge amount of electricity without undermining the security of the blockchain.

Then go for it, release just another altcoin and see how it will turn out. You can release some kind of test network first, just to check if your theory works in practice.

You can make it backward-compatible, just by producing first-phase blocks as today and adding some rules to enforce second-phase for these blocks. The simplest way to do that could be using difficulty to decide, how long the second nonce should be. Then you have previous block hash with some zeros, you can place your second-phase nonce there, then taking a single 80-byte block header is enough.

For example:
Because you can see 0x1d value in the difficulty, you know that you can take three bytes from the previous block hash and there must be zeroes to be valid. Also, there is no need for adding any public key to the block header, because it is already calculated in the merkle root. Also, you can add more fields to each header in the coinbase transaction if you really need them, there is no need to add them directly to your headers.

Totally agreed with you. I think the idea needs to be tested. At least for the sake of the experiment. 


Thank you Garlonicon for these great and precious ideas/suggestions. Much appreciated. Let's me think of it. I will update you here in all cases.

that was before bitcoin exploded onto the world scene. the whole world depends on it now and i dont know if there's any justification for trying to reduce energy consumption. for example, do you think bitcoin miners are just going to let their hardware sit idle for 8 minutes? or however long the 2nd round lasts? they'll divert their hashing power to something else for that amount of time and then bring it back when the next round 1 starts. so all you're really accomplishing is weakening your own network by letting go of some of its hashing power which will get used somewhere else. it's not a net gain for the environment. it's neutral.

the hardware is there. it's going to be running and hashing something. you might as well take advantage of it fully, which is what bitcoin currently does. thats how i see it anyway. ;D we don't care about cardona or ethereum here. so we dont want bitcoin hardware being diverted to strengthen those networks.

Hi Larry,

I do see your point very well.
But I think the question is a bit more philosophical: Just because we have a machine does this means that we need to use it at all cost and all the time?
We don't use our Laptop / Car all the time just because we bought them. We only use them when we need them.
Although the mining hardware is there, we still need Electricity to make it work. So the question now what is the tradeoff between electricity consumption and the hardware usage over a long run ?
It is known that the intensive usage of a hardware make it wear quickly.
So We can see TRPoW as way of reducing usage of mining machines which will make them last longer.

For the sake of argument, let's say Round 1 lasts 2min each 10min of Block Time. This means that the mining machines will be used 20% of the time. We can hope this will extend their lifetime by a factor of 5! I know the equation is not linear. Which will help the environment by reducing the machines production and the electricity consumption. The other benefit is against the Selfish mining attack.
TRPoW will make Bitcoin great again!!!

What do you thing?          

On the contrary. Even if your scheme worked, and you could force miners to sit idle 80% of the time,
that means they'll reinvest the saved electricity costs into buying MUCH MORE hardware to stay competitive.

As long as Bitcoin issues $50M dollar's worth every day, we can expect miners to collectively spend nearly that much money in competing for it.

All you achieve is a shift from electricity costs to hardware costs.


Sorry; thinging is not my thing:-(

That's because at least in the way you are describing it, a laptop or car is something for personal use. Just like a toothbrush.



I think bitcoin miners are more than capable managing their hardware and determining the optimal settings to run it at.


I looked up a stat that said the mining difficulty increased by 45% in the last 90 days. it probably doesn't always increase at such a large rate but i think it's safe to say it is always getting bigger. harder. now. given that, one would expect bitcoin miners to want to get the most out of their hardware for the limited amount of time it has until it becomes unprofitable to run any longer. no one is going to extend their hardware's lifetime by a factor of 5 since it will become unprofitable long before that time ever comes.


I think it's great just how it is regarding Proof of work. But I'm always interested to learn of other blockchains using alternatives to pure proof of work. Like chiacoin.  ;D

Good point.  High prices will drive competition crazy and we can expect miners to do whatever needed to make more money.
TRPoW does not affect the competition edge of a miner. So If everything stays the same, a miner will have a lower electricity bill
with more or less the same earning potential.  So, it will reduce the miners business cost and increase their profit.

Proof of Space is driving the hard disk drive market crazy I read in the news. 

Yeah I know! thats kind of why I'm not a big fan of it because it raises the price of things for everyone else too. Kind of like ethereum did for video cards.

What would be the costs of a “two-round” Proof of Work algorithm compared to regular POW? More or less, for the same level of security? More or less, for the same incentives? What feature would make it more attractive for the mining cartel?

TRPoW does not affect the competition edge of a miner. So If everything stays the same, a miner will have a lower electricity bill
with more or less the same earning potential.  So, it will reduce the miners business cost and increase their profit.
The mining cartel will make more money with less running cost.  

Have you received some feeback from a Core Developer, or from someone who is not a pleb? No offense to the members of this forum. Plus no offense to you, but how can we know that your proposal isn’t like the Space Ghost meme that says, “I am new to Bitcoin, and I am here to fix it”?

Be cool baby. Things will come in their due time. Stay tuned.

I guess not. All changes described in the whitepaper from this topic are backward-incompatible, that would mean a hard fork (or an altcoin, if it would be based on its own Genesis Block). But even in a soft fork case I doubt miners will go for it. They have no reason to split the whole process into two phases. It will be just another obfuscated Proof of Work, where things are the same like in plain, old, single-phase Proof of Work, but only some people will know how to produce the best blocks.

Or even worse: if it would be backward-compatible, then it could be simplified as just another merge-mined coin: by producing coins valid in both chains, miners will never switch to your coin, they would just get the same amount of Bitcoins and YourCoins, then sell YourCoins for Bitcoins, so the price will fall. I guess the same things would happen as for example in Luck: first some discussions on bitcointalk, then some negative feedback, then some test version release without addressing any problems from that feedback, and then creating just another altcoin that would be pumped and dumped as usual.

It would be true only for a short period of time. Then, the difficulty will adjust. Miners can switch between Bitcoin and your coin, also they will probably sell everything when your coin will enter some exchange for the first time.

It probably is. But when people don't want to learn from mistakes made by others, then they have to make their own.

Satoshi first did a lot of coding and testing, and then wrote the whitepaper. I think in many coins, things are going backwards: first there is some unchecked idea with some whitepaper, then there is some coding and testing, and later there are many big surprises, because some things were not checked before releasing the whitepaper and they are getting out of control.

Thank you very much Vjudeu for your time and your great sharing and all the links. Much appreciated Bro. I learned a lot from you since the beginning of this thread. The content you shared is brilliant.

It is true that miners can/will organize themselves in pools and participate in the hash calculation all the time. TRPoW can still be able to reduce the total energy consumption in the network thanks to the non-pooled miners.
Now the question what is the fraction of non-pooled miners in Bitcoin network?

You can see for example here: https://github.com/taprootactivation/Taproot-Activation. As far as I know, only the biggest pools were contacted for taproot support, there were no solo miners having some significant power. That means even if your proposal would be backward-compatible, you would ask big mining pools for support, not some independent solo miners. Of course you can rely on solo miners, but then I expect you wouldn't get more than few percent of the mining power supporting your version.

So True. Pool domination is a reality. Now we need a way to complicate life for mining pools.
So I got this new idea that I called: Jakarta Proof of Work. Instead of running a Two-Round PoW, we just directly limit the miners that are going to participate in the hash competition for a block.
Read article here: https://www.researchgate.net/publication/356414880_JPoW_and_TRPoW_Variants_of_Proof_of_Work
or directly here or google drive: https://drive.google.com/file/d/1f_a2obArSQ9kmFVeqE11ApPYTk31IYv2/view?usp=sharing
==============Begin==============
The other simple idea is to do like Jakarta’s odd-even traffic policy to limit the number of cars entering Jakarta: the policy stipulates that cars whose license plate ends in an odd number are only allowed to circulate on odd-numbered dates and vice versa. So, like in the case of Jakarta, we don't want every miner to participate in the hash computation all the time. So, we propose a Jakarta PoW (JPoW) where only miners with (hash mod N < K) where, for each block, for each miner with its public key $PublicKey$:
Equation (1):  hash = Hash(Block Head + Public Key)
If (hash mod N < K), then the miner will go for the traditional Bitcoin PoW.  If (hash mod N > K), then the miner will move to the next block without calculating any hash. $N$ and $K$ are parameters to adjust to determine the number of miners participating in the hash competition. To get a similar model like Jakarta odd-even policy, we can just choose $N=2$ and $K=1$.  When a miner receives an $nonce$ from another miner, it can easily verify that the sender is authorized to participate in the hash computation. If all is fine, it accepts the $nonce$ and moves to the next block competition. If the miner sending the $nonce$ is not authorized to participate in the hash computation, the miner receiving the $nonce$ will ignore what it received and continue solving for its own $nonce$ and listening to the network like in Bitcoin. In JPoW, if a miner ignores the rules and just go for the hash calculation, such miner will be ignored by the honest nodes in the network.
With equation (1), it will be still possible for miners that cannot participate in a hash computation to rent their machines to miners that are authorized to hash as the public keys information is available to all miners. So, to resolve this issue, we replace $Public Key$ by $sign(Block Head)$:
Equation(2): hash = Hash(Block Head + sign(Block Head))
The $sign(Block Head)$ can be produced by the miner only. And it is not available to all the miners at the time of the block creation. If a miner wants to participate in a pool, it will need to send its $sign(Block Head)$ to its pool. The pool will still be able to help on the hash calculation.
Even though $sign(Block Head)$ will slow down the process as the pool will still need to wait for its arrival before starting looking for the nonce while hashing for $Hash(Block Head + sign(Block Head) +  nonce)$. To complicate the problem further for the pool, we slightly modify the PoW and search for a nonce while hashing the following equation (3):  PoW hash = Hash(Block Head + sign(Block Head) +  sign(nonce))
The replacement of $nonce$ in PoW by $sign(nonce)$ will force the miner to either share its private key with the mining pool or calculate the hash itself. Sharing one's private key is a significant constraint and it is expected to complicate mining pool formation.
===============End====

Your comments / suggestions / critics are the most welcome as always.

 Thank you

 

It is impossible in any decentralized system. You could have some difficulty and accept only blocks with hash modulo 2 equal to zero, that would be as hard as mining with doubled difficulty, you cannot expect that people will stop mining just because your official mining software is doing that. If N is some natural power of two, then it is the same as taking some last bits of the hash. By checking blocks for the classical Proof of Work and some condition with hash modulo N, you are just rising the difficulty in some obscured way.

It works, because license plates are distributed in centralized way.

Each miner would know that, so each miner would just continue mining. Mining some partially valid block when solo mining is the same as mining nothing. If you need a block with 32 leading zero bits, you don't send a block with 31 zero bits, you also don't stop your miner, you just mine all the time to reach a block with 32 leading zero bits. It doesn't matter if you split validation into checking leading and trailing bits or if you do it as usual, just by checking if the hash is lower than the target. Checking if the first 16 bits are set to zero and if the hash modulo 2^16 is zero is exactly as hard to mine as producing a single block with 32 leading zero bits.

No, it won't change anything. Miners will share their private keys with mining pools. Today they are mining directly to the pool's address, so sharing the key requires the same level of trust as today. But that's just one option. In any useful coin you can still make transactions. That means you can mine a block where you send your reward to yourself, but you can include a transaction sending some older coins to the pool. Then, the pool can accept your shares only if you paid them first, in this way you can reach the same system as you have today, but just with more transactions to obfuscate what is going on (if for example you will find a way to punish miners for sharing keys).

Maybe I'm ignorant about how bitcoin mining works but it seems like a miner could just compute the above hash for multiple public keys they own so as to guarantee one of them hashes out to the desired constraint (less than K, I believe??)


Once again, if a miner has multiple private keys they'll just compute the above hash for each one.

If i was a miner, that's what I would do. Unless it was computationally too expensive.

Indeed. You are right. This is why we proposed equation (2) and (3)

Indeed. But it reduces pool mining to be only between miners who can share their private keys with each others. A total trust is required. Which means that there a is large number of miners who won't be able to create pools unless they trust each other 100%. And this in itself will create a limitation in the pool formation. It won't stop it. But it is a huge limitation as miners will need first to find an address that is authorized to hash. And then run their mills using the private key of the authorized address. In comparison to today PoW, JPoW is a pain for the miners.

Yes. But like in Bitcoin, we bet that the network will be controlled by honest miners who will play by the rules. And even if they don't, their work will be simply ignored by the honest nodes and hence waste of money for the miners involved in such practice.  

Yes. There is no way to stop a miner from hashing if he want to launch his machine. But technically his hash work will go to dustbin.


Indeed. But it reduces pool mining to be only between miners who can share their private keys with each others. A total trust is required. Which means that there a is large number of miners who won't be able to create pools unless they trust each other 100%. And this in itself will create a limitation in the pool formation. It won't stop it. But it is a huge limitation as miners will need first to find an address that is authorized to hash. And then run their mills using the private key of the authorized address. In comparison to today PoW, JPoW is a pain for the miners.

But I still dont see how you are stopping individual miners. I guess you're just focused on controlling mining pools.


You didn't address the question about what is stopping an individual miner from just setting up a bunch of private keys and doing that hash on each one to guarantee they get a favorable hash result from at least one of them. They would most likely do that. So you must not be worried about them cheating the system in that way. ;D

If individual miners would do that then you can get dollars to donuts that larger miners would too somehow.


Which is why I doubt we would ever see something like this in bitcoin. Miners control the game. And they seem pretty happy with the way things are.


Well I wouldn't know that I agree with you that miners would be forced to share their private keys with each other to work your system. For example, what's stopping a group of miners from creating a multisignature taproot public key? i guess it's a theoretical work around but maybe not so doable in practice hopefully for your sake!

We are not stopping individual miners but only limiting the hash computation to a group of miners at each block.

They can do that. But it will create for them the issue of managing a long list of addresses and keys. And that each time they will need to spend time calculating the signatures and the hashes. Which at the end may not worth it. The other idea is again to inspire from the uniqueness of car plate numbers and force miners to have ONLY ONE UNIQUE address.  

Yea. But this is NOT a desired outcome. Because we have a system that was supposed to be decentralized became de facto centralized in the hands of few miners. What if these few miners decided to engage in 51% attack without announcing it and steal people money.

The idea is to create a system that is as decentralized as possible. The current state of affaires is not at the best interest of Bitcoin ideologically. Today, we have few miners running the show and they can create a monopoly whenever they want to. Just another Banking system with a different name. Check this link: https://github.com/taprootactivation/Taproot-Activation
If you take the Top 8 biggest mining pools they represent over 80% of total hash rate. Total dominance of these few pools over the entire Bitcoin network. Imagine if Google, Amazon, Apple, Facebook and Microsoft decide to join the mining party.

Yeah, I'm with you on that issue. I don't like the idea that big miners and big corporations took over mining bitcoin and the little guy got trampled on so it's no longer "one cpu one vote" i wish there was a way to go back to that.

democratizing bitcoin mining is what I say needs to be done but how?

democratic. : to make (something) available to all people


I think it should be one cpu one vote. An asic miner should count as one cpu just like my intel core 2 duo. they should both get the same weight/power to collect a mining reward but that's not how it works. i dont think satoshi meant it to be that way but that's how it turned out. and its a shame. i'm just not sure how one could implement that. it still needs to involve proof of work but leveling the playing field between different hash rate hardware seems a challenge. ;D

i actually do have some idea of how to go about that procedure maybe i'll post it sometime. i'm sure people will not want to do it though! for example, only let each miner perform one hash. whichever miner comes closest to the target is the winner. and they get to mine the block.

Did you know about HD wallets? You can have one key and derive every other key from that.

If you limit the number of addresses that miners can have, then they will be forced to form pools. Imagine you have one million miners and only 100 of them can do Proof of Work. Then the obvious solution is forming a pool. Finally you would have 100 big mining pools where each pool has its own address. You can even force all miners to have ONLY ONE UNIQUE address in the whole network, then that address could be worthless, everyone could mine a block with private key equal to one and include a transaction sending funds where they want.

For example by splitting rewards in P2P way. Now you have to solo mine a block matching the network difficulty. To get rid of pools, you need a way to mine N times easier block and receive N times lower coinbase reward in pure P2P way.

No, it should be proportional to the work you did. For example, now you have a block with hash 000000000000000000091ae845e53e648e536eddc25be691baab2cf59a0c9123 and you have 0x170c69ea difficulty, so the target is 0000000000000000000c69ea0000000000000000000000000000000000000000. In this block, some miner got 6.30623404 BTC, so 630623404 (0x25968cac) satoshis. If you multiply the target by the number of satoshis, you would get 000000000001d29bb35f21380000000000000000000000000000000000000000. That means to mine one satoshi, you should produce a block with hash below that target. If mining in the Lightning Network would be possible, then going to millisatoshis or even lower fractions should be possible to get reasonably low target for each CPU miner. The only problem with this approach is joining shares. You can collect N headers, but it will be always too low to cover every miner, so there is a need to join shares somehow, also to make it backward-compatible.

You cannot do that. Bigger miners can pretend to be N smaller miners to get more chances. In your proposal, the better connected miners always win, that means of course specialized mining pools with their own servers, not some small solo miner running a single CPU.

Not trying to hijack the OPs thread and proposal since it probably has some serious merit but no it should not be proportional to the work done. That's the whole point behind one cpu one vote. Some people don't have as powerful equipment as someone else but if they can do one single hash that should put them on equal footing with everyone else. at least that's what the phrase means to me. the idea that we need all the extra hashes from a single cpu is not true, i dont think. just one hash is enough, no more is needed or useful. there is enough cpus out there to secure the network with just one hash each maybe.


They can't pretend simply because it's "one cpu one vote". Unless they go and buy alot of cpus they won't get but one vote. they can knock themself out on getting more cpus though. But I don't think that would scale very well. which is good. :D now of course, you do run up against the issue of how do you make sure that each cpu is only submitting a single hash. i haven't figured that out yet.

The idea has a lot of merit. But we need to find a way to implement it in such a way that most of honest players comply with it. Because as said by Vjudeu, miners can always create N sub-miners etc.

The other idea that I suggested along side with JPoW was to create a Placebo Proof-of-Work (PPoW): a group of miners unknowingly run the real PoW and another group of miners unknowingly run only a placebo PoW, a PoW with no hashing computation at all. And we adjust the seize of each group accordingly to get the desired number of miners to run the hash competition. But the issue again is that miners can still ignore the Placebo PoW and just use the traditional PoW disregarding the rules to win the block reward. So, I need to find a way to stop such behavior which I haven't figured that out yet.

The problem with any variant of PoW is that it will push miners to compete on CPU ground and invest a lot of money on CPU. In such system, miners will always find a way to group themselves and form pools and monopolies. Which is against the ideal of the decentralization.


This idea you can implement it easily. Just ask everyone to calculate their A_hash: A_hash = Hash(Block Head + sign(Block Head))
And Everyone will broadcast its A_hash and everyone will know that this A_hash can be produced only by the miner itself and no one else.

Let's call this proposal: Proof of Hash Ownership: PHO. (Harsh Ownership  or Hard Ownership).

Now the issue is how to find the consensus on the winner:
1- The closest to the target like in PoW.
2- The closest to the arithmetic average mod a Big N of all the B_hash of the network.
3- The closest to the geometric average mod a Big N of all the B_hash of the network.
4- min of all the B_hash
5- max of all the B_hash
4- Others

And the idea is how to make sure that everyone is OK on the outcome? Bitcoin PoW proposed the criteria of the fastest miner which push people to invest heavily in CPU. The criteria 2 seems to me the best as it cannot be manipulated. And also after let's say 70% of network A_hash received/collected, a miner can conclude which miner is the winner. This is thanks to the Law of large numbers. Like in Monte Carlo method. If we have a fixed list of miners Criterias 4 and 5 are the best.

In this case, we can clearly expect miners to flood the system with their X sub miners in order to win the block. The network congestion can be a problem. To solve the broadcast / congestion problem in the network we can replace A_hash by B_hash where B_hash = Hash(Block Head + Public Key). And all the miners need to keep a list of all the miners updated and do the hash calculation by themselves instead of waiting to receive it from the senders. New miners will need to announce themselves to the network first if they want to be taken into account. The first let's say 100 winners will announce themselves by broadcasting the list of all the B_hash done by themselves and the criteria result. The network will accept the block of the fastest miner among the top 100 following the criteria. Here we don't need 70% of the miners because we have the nearly full list of miners (with some exception due to eventual network issues or manipulation). All miners will be able to do the same as the winner and contest the result in case there is need. The list of miners can be updated weekly at a specific time to avoid potential issues and congestion in the network and also for all the miners to be working with the same updated list. Top 100 (or another number) is needed to have a system working efficiently. Otherwise we can have cases where a winner of a block not broadcasting the block result etc. So we need a kind of competition to force miners to have good IT systems reliable. The Top 100 will create issue of two miners claiming the same block reward. But this can be resolved by making the priority goes first to the real winner as per the criteria 1-6 if we have a problem around a chain of the same length otherwise we go for the longest chain. The good thing here, we will always be able to know who is the legitimate winner of a block. An attacker from the miner list won't be able to highjack a block because its B_hash must be among the top 100 first. And attacker outside the list won't be able to do it because it is outside the list. And by design, a selfish mining attack is impossible here. Also, no 51% attack because the system is not based on CPU power. Because even if you have huge CPU, you will still need first to be able to put yourself in the top 100 which quite random.        

A potential issue will be the list of miners can be huge as everyone will be able to create 100-1000 addresses. And this can affect the Block Time. So we need a way to keep the block time fix.

To limit miners from creating 1000+ addresses, we can, during the weekly miner list update session, impose on each address to broadcast their B_hash message signed by the address key and run another PHO round to win the chance to update the miners list. The block time can be set to 10min to allow for all the miners to send their pings. The fastest will update the list and win a reward equivalent to a Block Reward and add the block to the blockchain. And everyone else should use the list sent and signed by the winner. Once the miner list updated, the block time can be updated too based on the new list.
This part will be only on a weekly basis. It goes without saying that the genesis block should be a block that updates the mining list.

More details on the whole PHO consensus protocol here: https://drive.google.com/file/d/1Py5nZWCW2YJ-E3IcEp4_trmeTKmGWgKQ/view?usp=sharing
or here https://www.researchgate.net/publication/356554200_Proof_of_Hash_Ownership

As usual your thoughts and spicy critics are powerful and most welcome as always. 

 

You know that miners in pools are mining on pool's address? If you force them to mine on their own addresses, then they will include a transaction sending coins back to the pool (or even directly distributing rewards to previous miners, selected by the pool).

True. True.

You don't have to add signatures to the block header. You can add them to the coinbase transaction, like it is done in signet, in this way you can make it backward-compatible. You can find all technical details in BIP-325: https://github.com/bitcoin/bips/blob/master/bip-0325.mediawiki.

In general, to start your network, all you need is constructing signet challenge to allow signing blocks only by those miners, which passed the initial selection. By default, signet challenge is set to 1-of-2 multisig, so only two miners can produce blocks (because it is needed to test things in more stable way than in testnet). You can change that signet challenge, just to allow only signatures that passed the first round and you will get your coin.

Thank you very much Garlonicon for the link. Yea. You are absolutely right on A_hash. It was my first intuition and then I switched to B_hash to avoid congesting the network as every miner can do all the B_hash calculation by itself. Your point on backward-compatibility is brilliant.