Ethereum “Dagger” PoW function is flawed (technical off-topic)

[justusranvier]

Not even necessarily attack the network, but to get data - that's such an obvious move...

What kind of sensitive data could such a company grab from a device that's designed to process the data in a public transaction ledger, that generally receives said data from a public mining pool anyone can join?

[jarhed]

A speedup from 256X to 2560X seems possible.

We are Ethereum ASIC!!!!!

[xeroc]

that's such an obvious move...

Wait .. what?

[TierNolan]

Not if it has a capacitor that keeps the timer ticking... how much energy does a wristwatch need?

Battery backup would be better.  A capacitor is not likely to be able to keep a timer running.

Asics not connected long term wont have the desired effect of shutting off simultaneously - so that case doesn't matter anyway.

It depends on what you mean by ASIC.  The actual IC isn't likely to be able to support such a function.

However, an ASIC miner where you connect an ethernet cable could "phone-home" every so often.

I mean its easier to just admit asics are dangerous than list all the risks... unless they are open source.  Then they could be OK; otherwise, do as cee-lo would do, and forget them.  You know?

There are limits to what you can do with ICs.

[Altoidnerd]

It doesn't need wires dude.  Wireless communications can be packed into tiny spaces.  Antennas are etched into the substrate.  http://www.semtech.com/images/datasheet/sx1242.pdf

Bitcoin ICs are power hungry, its not hard to allocate a little extra wattage.  Manufacturers routinely lie about power consumption anyway - bitcoin ICs dont even have to.

[Altoidnerd]

What kind of sensitive data could such a company grab from a device that's designed to process the data in a public transaction ledger, that generally receives said data from a public mining pool anyone can join?

Your movements around your house.  How often your body is within 7 feet of the machine.  The number of steps you take each day.  How often you use a microwave.

Again, an easier question may be what can't they do.  It's a black box man.  ICs are not getting less capable.  

I have designed an insanely sensitive (and expensive) burglar alarm in my lab before by accident.  You'd be surprised.

Pick up "Circuit Design for RF Transceivers" by Leenaerts.  Then convince yourself extremely high power ICs can't do the things I just said.

The takeaway: these frightening intrusions are unlikely to be going on now, but are absolutely possible.  The future of humanity is a long time; that which is possible will occur in the future.  Learn from the disclosures of 2013.

Therefore, it is wise to move away from these proprietary, closed source black boxes that we must trust in an open source trustless system.  The potential for technology to be harmful to us without our knowledge is ever increasing.  The reversal of this trend is very much in the spirit of bitcoin.

Don't trust a damn.  Just stick to open source.  

[Sergio_Demian_Lerner]

Our updates:

1. The problem that I have with scrypt or SeqMemoHash is that they are not memory-hard enough; they are just as memory-hard to verify as they are to compute, which puts a natural cap on how high the parameters can be tweaked. The reason why I came up with Dagger in the first place was to create a PoW that is memory-hard to compute but memory-easy to verify, since you only need a small amount of memory for one nonce, so that you can tweak up the memory requirement per thread to an extremely high value., proof-of-burn and proof-of-excellence based submissions will also be welcome in some category.

In the post I present a technique to limit the amount of work a node does, not to do any more work than the attackers work.

I repost part of the paper here:

Gradual verification

When SeqMemoHash or RandMemoHash are used as PoW, an attacker may try
a DoS attack by cheating on the difficulty of the PoW, and forcing the verifier to
invest CPU resources in computing the (invalid) MemoHash digest. One way of
protecting from this attack is by creating a PoW that consist of the concatenation
of all intermediate results produced at steps that are power of two (e.g. at hashing
steps 1,2,4,8, ..), and the final result. For the configuration given in the previous
section, this requires 17 intermediate hash digests and the final hash digest (total-
ing 576 bytes). The verifier must check each intermediate state against the given
values during the computation. This protection assures that the attacker must have
performed at least half of the operations performed by the verifier

Also I added RandMemoHash, which (as I tested it) is almost as fast as scrypt also using Salsa20/8 core.

With the parameters I suggest for ASIC resistance, it takes 30 msec to verify on a PC. Using the Salsa20/8 core, it takes less.

Best regards!

[Altoidnerd]

Let's beat a dead horse.

http://www.storagecraft.com/blog/cpu-sounds-allow-cyber-security-crack-potential/

You certainly wouldn't want one of those in your bitcoin miner - that would totally stink eh?

Now whether you believe this crap or not, the message should be clear. Bitcoin is stuck with ASICs forever now, so lets at least get some that are open source.

The way that could work is that the schematics are fully specified and they are then testable to prove that no added functionality exists.  I think.

[justusranvier]

Your movements around your house.  How often your body is within 7 feet of the machine.  The number of steps you take each day.  How often you use a microwave.

Again, an easier question may be what can't they do.  It's a black box man.  ICs are not getting less capable.  

I have designed an insanely sensitive (and expensive) burglar alarm in my lab before by accident.  You'd be surprised.

Oh, you assuming that home mining is still going to be a thing for much longer.

Yeah, in that case I can see why you'd be as concerned.

The amount of mischief they are capable of in a data center environment is not zero, but not quite so personally intrusive.

[grau]

Don't trust a damn.  Just stick to open source.  

Even open source is usually executed on hardware black boxes. I understand your concern, but believe that bitcoin mining with ASIC is one of the least concerning black boxes.

[Altoidnerd]

Don't trust a damn.  Just stick to open source.  

Even open source is usually executed on hardware black boxes. I understand your concern, but believe that bitcoin mining with ASIC is one of the least concerning black boxes.

I know.  It's not like I'm gonna burn my asic miner.  My points are more for the purpose of future slant we can place on our thinking.  I mean look at my mug.  I loooovvveee ICs.  I just think they need to phased out of open-stuff, or made open somehow, OR alternatively made by companies I might actually trust.

I kinda wanna see TI absolutely flood the market with asics so they are sitting inside gumball machines, traffic lights...everywhere.  That I'd be more likely to trust than random companies popping up with silicon.  

And looking at the track record of bitcoin asic distributers...well what do you see?  Shitheads.  I'd like to see a real IC company step in and end the bullshit.

[justusranvier]

I know.  It's not like I'm gonna burn my asic miner.  My points are more for the purpose of future slant we can place on our thinking.  I mean look at my mug.  I loooovvveee ICs.  I just think they need to phased out of open-stuff, or made open somehow.  Not sure how the latter would work though.

ASICs are a very competitive space right now. Anything that uses extra power and does not increase the hash rate puts an ASIC at a severe disadvantage compared to its competitors. For the specific case of hashing I'm not sure how much of a threat really exists.

Now if specialized hardware is ever used to select transactions and construct blocks, that's something I'd be more concerned about.

[Altoidnerd]

Justus I hear your points.  My anti-asic comments apply more to cryptocurrency as a technology going forward.  For bitcoin you can't look back.

About a year ago I was absolutely puzzled by the economics of money printing machines.  What on earth could that mean?  Well after a year we have seen that what hapened was a NEW brand of engineering firm that both makes ICs and also participates in speculative gambling.

If and when texas instruments steps in, so will national semi and samsung and others...and they will not bother at all to play the bitcoin price game.  Only then will the asics be priced fairly, because producing inane quantities of chips is really dirt cheap for these companies.

TI shipped 6 billion ICs last year.

[justusranvier]

My anti-asic comments apply more to cryptocurrency as a technology going forward.  For bitcoin you can't look back.

We'll see if there is any future in non-Bitcoin cryptocurrencies...

I know all the VCs and traders want that kind of a world, but they might not get what they want.

[Altoidnerd]

Oh, its inevitable...the technology exists. The bitcoin centric mindset is pretty short sighted. If people feel, in any given community, for the rest of time, like they are not being served by bitcoin, they can have their own currency at basically the push of a button.  They will exist and be traded.  They may ever be bigger than BTC, but they're obviously going to exist...I know this because I would make one for just my family, inside my home...

I think it's ridiculous to assume otherwise.  Cities will adopt local ones...there will be crytocurrencies circulating in high schools.  Poor countries and impoverished slums will rock their own coins.  

[oakpacific]

Oh, its inevitable...the technology exists. The bitcoin centric mindset is pretty short sighted. If people feel, in any given community, for the rest of time, like they are not being served by bitcoin, they can have their own currency at basically the push of a button.  They will exist and be traded.  They may ever be bigger than BTC, but they're obviously going to exist...I know this because I would make one for just my family, inside my home...

I think it's ridiculous to assume otherwise.  Cities will adopt local ones...there will be crytocurrencies circulating in high schools.  Poor countries and impoverished slums will rock their own coins.  

They can always be 51% attacked if they are smaller than Bitcoin, or if they are PoS, using even easier means.

[justusranvier]

Oh, its inevitable...the technology exists. The bitcoin centric mindset is pretty short sighted. If people feel, in any given community, for the rest of time, like they are not being served by bitcoin, they can have their own currency at basically the push of a button.  They will exist and be traded.  They may ever be bigger than BTC, but they're obviously going to exist...I know this because I would make one for just my family, inside my home...

I think it's ridiculous to assume otherwise.  Cities will adopt local ones...there will be crytocurrencies circulating in high schools.  Poor countries and impoverished slums will rock their own coins.  

I remember a time when there was no global Internet. Every city had their own little BBS, with a handful of national ones. Each was its own walled garden with little-to-no communication between them.

Then flat rate ISPs showed up and wiped all competition off the map*.

Do you think Compuserve and GEnie and AOL really wanted to have their business model steamrollered like that? Too bad - the network effect was too powerful for them.

The advantages of a single currency are too overwhelming for alternatives to become anything more than hobbyist toys that never amount to more than a rounding error.

Maybe it won't be Bitcoin that becomes that single currency, but anything that aims to overthrow it has a high barrier to overcome.



* For that matter, when was the last time anyone used IPX/SPX? How many people even remember it other than that weird network protocol that you sometimes had to use for Starcraft 1 LAN parties?

[coinrevo]

You're assuming the future is going to be like the past. Next generation cryptocurrencies will remove global dependencies from miners and developers. there will be tech which allows to overcome fundamental weakness in PoW. but it's not going to etherum and some academic figuring out a new PoW algorithm.

[justusranvier]

there will be tech which allows to overcome fundamental weakness in PoW.

Forgive me for being skeptical about claims of Bitcoin's PoW having fatal weaknesses.

Bitcoin could have been invented in 1988 instead of 2008, except that everybody who understood cryptography well enough considered the economic properties Bitcoin possesses to be fatally flawed and so never even tried.

Incidentally, Bitcoin's reliance on economic theories that so many people consider to be a flawed are exactly what enabled it to succeed where ever prior attempt failed..

I wish everybody involved with altcoins who do not understand this dynamic the best of luck, since they'll need it.

[Altoidnerd]