I think that there's a mixup between (a) and (b), objective 2 is achieved by (a) and objective 1 is achieved by (b) ?
Yes. Fixed that. Good eye.
I think that the core of your new idea is very intriguing. Instead of PoA where miners generate PoW blocks and stakeholders (derived deterministically from block hash with follow-the-satoshi) may or may not sign those blocks later (so signature for an earlier block appears in a later block), I think that a simplified version of your new idea can be described as follows: the miner who solved a block according to the current difficulty doesn't win yet, he has to broadcast the block that he solved to the network, and then the deterministically chosen stakeholder according to the hash of this solved block has to sign it, then announce to the network that the block is now valid, and now the blockchain can be extended from this block, by incorporating the hash of that stakeholder's signature in the next block.
This core idea might be cleaner than PoA, because now all the blocks are always signed, so we don't need to have questionable rules to decide the winning branch.
Yes. It can be simplified. In fact it could look just like PoA except that you must find one signer before beginning the next block. The simple system would probably work pretty well. However, the complexity incorporates added security features. There is a trade-off. If you want simple, I prefer the ABAB system discussed earlier. I could understand why someone would prefer the ABAB system to this. The ABAB system seems inferior, but it is very simple to implement and understand.
Regarding your particular suggestion of deriving 10 stakeholders deterministically via follow-the-satoshi instead of just 1 stakeholder, with the threshold of having the 5 first-derived stakeholders provide signatures before the block becomes valid
The five stakeholder threshold just makes overwhelming work majorities almost useless for competition with the main chain. It might be overkill (i.e. large signature requirements pose communication problems). I'm not sure. Clearly 100 sigs is not feasible. 1 may be too few (double-spends will be too easy). 3 is probably enough.
(BTW it isn't so clear where these signatures should reside, they aren't inside the current block and won't be in subsequent blocks, so I guess they should be wrapped together with the current block as an extended data structure),
I think you have pointed out a significant problem here. The solution is simple though. Just allow the next block to be built off the signature in any block from 5-10. Thus all signatures go in to blocks and you will have to add them before the next block is found. Block miners will extend the chain using the highest signature number. High sig numbers decrease the probability that the block will be orphaned. You could add dangling signatures to old blocks, but signers wouldn't want to do this because signing minority chains exposes them to risk of forgone interest.
I don't understand how trading coin-age for interest is supposed to work, could you elaborate?
As far as trading coin-age for interest. It should be really simple. The public key you sign with has a balance and the coins associated with this key have not been spent or won the lottery for a known time period (call this age). Age is measured in years (units of 52560 blocks). Call age a, the balance b, and the interest rate r, 0<r<0.015. 500 blocks after you sign, the miner includes a generation txn which sends b*(exp(a*r)-1) to this public key.
Winning the lottery frequently does not directly affect the amount of coins you earn. The lottery win allows you to withdraw early without facing an early withdrawal penalty (foregone interest). Winning frequently increases liquidity of your savings, but does not give you a bigger monetary reward. It is a very very small advantage. If you expect to win only extremely rarely, you will probably keep your coins in an online wallet. The online wallet can manage the mining for you. If you hold a large balance, then you will win frequently and can manage the coins yourself. Most of the wealth will be in large balances (wealth distributions are always highly unequal, e.g. in the US it is something like the top 1% has 40% of the wealth. The top 1% can handle their own mining. Everyone else could delegate.)
if I understand correctly the purpose here is (supposedly) that stakeholders wouldn't want to sign the attacker's branch because we expect that the attacker's branch will get only 5 signatures or so, while we expect that the branch of the honest network will get 10 signatures, and stakeholders receive larger rewards if there are more signatures. But isn't there a problem with your suggestion because a particular stakeholder who got chosen in the attacker's branch doesn't also get chosen in the honest branch (except for with negligible probability), so it would be rational for this particular stakeholder to sign that attacker's branch in order to have a chance to get his individual reward (in the honest branch he wasn't chosen and wouldn't get any reward). Maybe the way to fix this issue is that the individual stakeholders never get any reward for the signature that they provide, and instead just have the rule that if more signatures are provided (closer to 10 instead of 5) then all the stakeholders are rewarded collectively, via lower rate of inflation or some other kind of reward?
You are not getting a direct reward from signing. You can claim your interest in any case, just at a later date. You expect well-signed chains to remain well-signed. If you sign a well-signed chain, your expected interest rate is higher. If you sign a poorly-signed chain, your expected interest rate is lower. Therefore you are forgoing a benefit if you sign a poorly-signed chain (attack chain). It only makes sense to do this if you need to move your coins very soon and prefer no interest to a penalized amount of interest. In this case you sign everything you see. I assume that a substantial number of stake holders (it does not even have to be the majority) will prefer to wait in order to earn a higher rate of interest. These only sign well-signed chains. They will rationally reject a lottery win in an attack chain. It is fine if 90% of people sign everything and 10% sign selectively. I think it will be the other way around though.
Why are attack chains weakly signed? Attack chains are mined privately using an overwhelming amount of work. An attacker will only want to generate 5 signature long sequence because (for an attacker) this is orders of magnitude easier than generating 6 7 8 9 or 10 signature long sequences. If you try to help him out by signing his chain, then you will get penalized.
The idea is that people begin in default behavior, signing one chain only. If you deviate from default behavior, but some strictly positive fraction of people remain in default mode, then you will get penalized for the deviation. Thus default behavior is a nash equilibrium. This differs from PoA where default behavior is not a nash equilibrium.
I wonder if adjusting for 10 minutes block time is possible with this scheme, because of the dependency on the currently active stakeholders. There might also be new kinds of attacks by stakeholders, for examples stakeholders who collude by withholding the 5th signature, then releasing it at the same time in order to split the chain and create chaos?
Yes, you can withhold the fifth signature, but then some other block will be found and built upon. You will need to add the fifth signature and then secretly find a new block. Secretly finding a new block is nearly impossible.
From an economic perspective, I hope that objectives (1)+(2)+(3) can be achieved without a protocol that requires infinite monetary inflation. Maybe we could attempt to design two different protocols, one with infinite inflation, and one without, so that later the better protocol could be decided by also taking economic considerations into account. What do you think?
This is not really inflation at all. A small amount of new money is printed, but it is distributed proportionally evenly among people who already have money. Say productivity grows by 1% a year.
In this case, prices will remain close to constant in the long-run, but your $1.00 will slowly turn into $1.01 each year. [productivity growth shows up as an increase in your balance instead of falling prices]
With bitcoin, prices fall by 1% each year, and your $1.00 balance remains as $1.00. [productivity growth shows up as falling prices]
The two situations are almost equivalent.
The difference is that there is an implicit tax on txns. You are penalized via loss of interest if you move your coins. The penalty is very small. Think of buying a television for US$400.
You have a choice. Do I buy it now, or do I wait 6 months to earn interest and then buy it? At most, 6 months of waiting could decrease the price by US$6. In practice, however effects will be much smaller than this. You could hold your money in an online wallet. They would store 90% of their holdings to earn interest and handle liquidity needs with the remaining 10% (just like a normal bank, except with a 100% reserve).
The loss of interest would then be reduced to $0.60. I don't think you will delay your television purchase for 6 months to save 0.15% off the purchase price. The implict txn tax will be really really tiny.
Regarding the complexity issues, indeed those might be a huge problem. Even just attaching 10 ECDSA signatures to each block is quite huge (extra 640 bytes per block).
640 bytes per block is very little in additional storage. The main issue is how much extra info has to be transmitted. The bandwidth requirement is more worrying because you need to transmit more than you store.
It sounds really difficult and taxing on the network, but I think that it could actually be much easier than it sounds. The miners don't actually need to transmit a large number of tentative blocks. They just need to search for blocks that match keys that have recently signed the blockchain. i.e. they search for historically active keys. They discard potentially valid blocks with keys that are rarely seen in signatures. They then transmit blocks that historically active keys can sign. These tentative blocks are likely to become valid. The final signatures in the sequence allow the blockchain to constantly update the record of historical activity. [These final signatures are increasingly random rather than miner selected, particularly sigs 6-10.] Thus, by referring to the blockchain, the miners always know approximately what type of sequence they are looking for.
This search might sound hard, but really it isn't. You are most likely searching for the public keys of Mt. Gox, Bitinstant, Bill Gates, blockchain.info, etc. A small number of people will hold a huge amount of stake. Searching for a small number of keys is not that difficult. Searching for the key to an average person's wallet is probably not worth the time.
Have a good solution for delegating signing-keys might also be highly significant, and possibly add even more complexities. One major advantage of PoA is simplicity. We should try to simplify and minimize complexities wherever possible...
Yes delegation is essential and limited functionality singing-keys are also essential. You want blockchain.info to be able to participate using its users' money. We've discussed before that bitcoin could really benefit from limited-spend keys. The inability to make low-risk spend keys is a security risk. Atm cards have withdrawal limits for a reason. You shouldn't have to expose your entire bank account to the internet in order to send $10. It is silly.
Show Posts
Contributors are completely anonymous. In theory the foundation could be anonymous too.
