A Two-Round Proof of Work instead of PoW

[garlonicon]

You would need a way to prevent the knowledge of the winner for 8 minutes so that nobody can start on the next block before the 10 minutes have past.

Even if you can successfully prevent that knowledge for 8 minutes, someone can still start working on some randomly chosen block and have hope it will give some boost on average, where other miners will be idle. Also, you need at least two candidates, in other case any obfuscation of the winner is pointless. Does it mean that nobody can start the chain alone by using the official miner?

Another thing is getting the right to mine: one miner can pretend to be N miners or can just own many mining machines and assign different keys to each of them. Then, if the list of participants is known, any miner can try to extend any block, just by checking each of them sequentially, or even assigning different threads to different blocks. Extending one of N blocks has the same probability as extending some chosen block. Because having a chance to mine the right block is better than having no chances by being idle, people will run their machines all the time.

[1714681509]

1714681509

[1714681509]

1714681509

[1714681509]

1714681509

[1714681509]

1714681509

[1714681509]

1714681509

[odolvlobo]

1- If a miner receive $N_2$ $nonce1$ or more broadcast from other miners before finding its own $nonce1$, it will broadcast the list of the first $N_2$ winners and drop the current block competition and move to the next block. In this case it failed the first round and the block reward.
2- If it finds its $nonce1$ before receiving $N_2 - 1$ solutions from other miners, it will broadcast its $nonce1$ with the list of all the miners that found the solution before it including itself. it will continue listening the network to build the full list of the first $N_2$ winners. And at the same time move to the next round competition. In this case it succeed the first round.
...

How is #1 enforced? What prevents a miner from executing #2 if it finds its own $nonce1$ after it has already received $N_2$ $nonce1$? A violation of #1 cannot be detected.

If you don't accept a block by someone not in your list, then you can't follow the actual longest chain. If you allow a block from a miner not in your list then every miner can include themselves in their own list (as soon as they complete round 1), which you must accept in order to resolve a split.

Please Read instructions 1) and 5) below.

Nothing in your miner instructions ensures that every miner has the same list of $N_2$ miners. Therefore, #5 will cause a split that cannot be resolved by the longest chain because a block by a miner not in another miner's list for that block is not considered valid by that miner.

[zbig001]

Where is the energy saving here, when the miner will have lower electricity bills, but there will be more miners?

And the statements that Bitcoin "waste" energy (and consequently imply that something needs to be done about it) haven't been debunked many times?

[Epictetus]

If you don't accept a block by someone not in your list, then you can't follow the actual longest chain. If you allow a block from a miner not in your list then every miner can include themselves in their own list (as soon as they complete round 1), which you must accept in order to resolve a split.

Please Read instructions 1) and 5) below.

Nothing in your miner instructions ensures that every miner has the same list of $N_2$ miners. Therefore, #5 will cause a split that cannot be resolved by the longest chain because a block by a miner not in another miner's list for that block is not considered valid by that miner.

What is the probability of an honest longest chain be outside the N2 List (Or we can extend it a bit to N2 List of N2 miners because each miner who succeed Round 1 is broadcasting its List. But we don't need to as we can just merge the lists and put a cap at N2)? Anyway, this probabilistic problem is similar to the AT2 problem discussed by Rachid Guerraoui team in EPFL. I will share the Math later.  But it can be found in their AT2 paper (In fact they published 3 papers). Based on AT2 papers, N2 does not need to be big to achieve our purpose.

[larry_vw_1955]

The PoW job is also to maintain the Block Time at 10min. We can achieve that by just making everyone wait for that 10min minus delay/network broadcasting time etc.

Say round 1 only takes 2 minutes to get 100 miners. Then you just wait 8 minutes to select the "winner".  That's a 10 minute block time. So it saves 8 minutes of hashing. Less global warming.

You would need a way to prevent the knowledge of the winner for 8 minutes so that nobody can start on the next block before the 10 minutes have past.

I don't think that's the issue. I think the real issue is a blockchain has no way of measuring "time". It doesn't know how to measure 8 minutes. But there has to be a way.

[PrimeNumber7]

tl;dr - total electric consumption will not be reduced by implementing the OP's proposal.

I'm sure the miners wouldn't be supporting such a thing because it just makes it even harder for them to get a reward.

Also, if there are millions of miners and you randomly select 100 of them, you encourage the rest of the miners to form mining pools. Then, you will end up in a situation where 100 miners are selected as before, but there are only 100 huge mining pools, they always get everything and distribute that to smaller miners. Almost no solo miner will follow your system if that miner will be rewarded once per month, because the risk of price drop after entering exchange is higher than the potential reward from solo mining.

I wonder if the people that wrote that paper realized that. that's thinking ahead! the bitcoin mining system is really hard to make changes to without causing things to get "out of whack"

This is similar to say that miners will organize themselves in big pools to organize a 51% attack on Bitcoin network. It did not happen so far.

No. The miners have incentives to not 51% attack the network. If they try this, the value of their equipment to drop >99% overnight.

Miners engaging in activity similar to what I described is similar to miners attempting to keeping their equipment that has a limited shelf life working as much as possible.

The N2 number of miners of the second Round is also adjustable like the complexity algorithm in PoW that is adjusted every 2016 Block.
Plus In Round 1 we are hashing Hash(Block Head + PublicKey + Nonce). So I don't know how this is going to force miners to organize in big pools. The Public Key of a miner has the benefit of limiting the formation of pools. In BTC PoW there is no public key in the hash. In TRPoW, the hash result is public key dependent.    

 

The public key associated with the address 1KFHE7w8BhaENAswwryaoccDb6qcT6DbYY belongs to the mining pool f2pool. There are thousands (if not more) of miners who mine on f2pool, but all of f2pool's found blocks payout to the above address.

If f2pool makes it to the second round, any miner who is not participating in the second round will switch to mining on f2pool, or another pool that is participating in the second round. If a miner sits idle (or is not otherwise producing work that has the potential to find a block) during the second round, their equipment is losing out on potential value.

The PoW job is also to maintain the Block Time at 10min. We can achieve that by just making everyone wait for that 10min minus delay/network broadcasting time etc.

Say round 1 only takes 2 minutes to get 100 miners. Then you just wait 8 minutes to select the "winner".  That's a 10 minute block time. So it saves 8 minutes of hashing. Less global warming.

You would need a way to prevent the knowledge of the winner for 8 minutes so that nobody can start on the next block before the 10 minutes have past.

The difficulty of the first round could be "x", and the difficulty of the second round would be "10000x". Each of the miners who are "selected" during the first round could need to have their "block" include the hash of the previous block, and the first "block" in the first round would need to include the hash of block found in the second round. The found block in the second round would need to sign the hash of the last block of the first round. This is very similar to how bitcoin mining occurs today.

[larry_vw_1955]

The difficulty of the first round could be "x", and the difficulty of the second round would be "10000x". Each of the miners who are "selected" during the first round could need to have their "block" include the hash of the previous block, and the first "block" in the first round would need to include the hash of block found in the second round. The found block in the second round would need to sign the hash of the last block of the first round. This is very similar to how bitcoin mining occurs today.

wait, so you're saying that 2 blocks are going to be produced? one in round 1 and one in round 2? that's starting to get confusing. maybe we need someone to break this down and explain exactly what is going on so that it is understandable because the way you explained it right now makes it seem like there are going to need to be 2 blocks, one for each round. does that double the blockchain size?

[Epictetus]

Where is the energy saving here, when the miner will have lower electricity bills, but there will be more miners?

And the statements that Bitcoin "waste" energy (and consequently imply that something needs to be done about it) haven't been debunked many times?

The energy saving comes from the fact that most of miners will spend a big part of their time on Round 1 that is not heavy-energy / CPU consuming. At least this is the target, the bet and the hope.  

[odolvlobo]

What is the probability of an honest longest chain be outside the N2 List (Or we can extend it a bit to N2 List of N2 miners because each miner who succeed Round 1 is broadcasting its List. But we don't need to as we can just merge the lists and put a cap at N2)?

I don't think it is possible to have a single N2 list. Each miner that completes round 1 will have a list that may be different from every other miner's list. Furthermore, there is no way to agree on which miners were the first miners to complete round 1 because there is no way to resolve the differences in the lists.

[Epictetus]

Where is the energy saving here, when the miner will have lower electricity bills, but there will be more miners?
And the statements that Bitcoin "waste" energy (and consequently imply that something needs to be done about it) haven't been debunked many times?

The energy saving comes from the fact that most of miners will spend their time on Round 1 that is not heavy-energy / CPU consuming.
At least this is the target, the bet and the hope.  

In your system, consuming more electricity in round 1 gives a miner a better chance of going to round 2. How will your system limit the amount of electricity consumed in round 1?

The complexity in Round 1 is supposed to be small. Which means that most of honest miners will quickly find out if they need to move to Round 2 or not. Round 2 being limited to the fasted few N2. This will make most of miners idle / preparing for the next block which is not Energy-consuming. In Bitcoin today, most miners spend their time calculating the Hash puzzle most of the Block time (7 to 10min). So if we reduce Round 1 time to 1-4min or even more, it will be great. It is yet to be tested in grandeur nature.
        

[odolvlobo]

Where is the energy saving here, when the miner will have lower electricity bills, but there will be more miners?
And the statements that Bitcoin "waste" energy (and consequently imply that something needs to be done about it) haven't been debunked many times?

The energy saving comes from the fact that most of miners will spend their time on Round 1 that is not heavy-energy / CPU consuming.
At least this is the target, the bet and the hope.  

In your system, consuming more electricity in round 1 gives a miner a better chance of going to round 2. How will your system limit the amount of electricity consumed in round 1?

The complexity in Round 1 is supposed to be small. ...

Please explain how a lower complexity reduces the amount of energy used when miners are encouraged to increase energy usage in order to be one of the first N2 miners. Whether it takes 1000000 tries on average or 10¹⁸ tries on average, miners are going to use as much energy as they can in order to be first.

[Epictetus]

Where is the energy saving here, when the miner will have lower electricity bills, but there will be more miners?
And the statements that Bitcoin "waste" energy (and consequently imply that something needs to be done about it) haven't been debunked many times?

The energy saving comes from the fact that most of miners will spend their time on Round 1 that is not heavy-energy / CPU consuming.
At least this is the target, the bet and the hope.  

In your system, consuming more electricity in round 1 gives a miner a better chance of going to round 2. How will your system limit the amount of electricity consumed in round 1?

The complexity in Round 1 is supposed to be small. ...

Please explain how a lower complexity reduces the amount of energy used when miners are encouraged to increase energy usage in order to be one of the first N2 miners. Whether it takes 1000000 tries on average or 10¹⁸ tries on average, miners are going to use as much energy as they can in order to be first.

Yes but Round one is only let's say 2min for the sake of argument. Once this 2min is over Only N2 miners will advance to Round 2 to work on the second puzzle. Let's assume Round 2 calculation time is 6min. We have N1 miners working for 2min and N2 miners working for (2+6)=8min. In Bitcoin we have all N1 working all 8min. We save energy on Round 2. N1-N2 miners are IDLE during 6min of Round 2. This is where we save energy. Now I do understand that miners can try to game the system and rent their machines to the winners of Round 2. But I don't know how practical it can be to do so.   

[larry_vw_1955]

Please explain how a lower complexity reduces the amount of energy used when miners are encouraged to increase energy usage in order to be one of the first N2 miners. Whether it takes 1000000 tries on average or 10¹⁸ tries on average, miners are going to use as much energy as they can in order to be first.

Yes but Round one is only let's say 2min for the sake of argument. Once this 2min is over Only N2 miners will advance to Round 2 to work on the second puzzle. Let's assume Round 2 calculation time is 6min. We have N1 miners working for 2min and N2 miners working for (2+6)=8min. In Bitcoin we have all N1 working all 8min. We save energy on Round 2. N1-N2 miners are IDLE during 6min of Round 2. This is where we save energy. Now I do understand that miners can try to game the system and rent their machines to the winners of Round 2. But I don't know how practical it can be to do so.  

Doesn't this scheme compromise the security of the bitcoin network. I mean, the security aspect of it is based on the total hashrate at every moment in time. if at any moment it decreases...then there's a potential weakness.

[vjudeu]

N1-N2 miners are IDLE during 6min of Round 2.

Some of them are idle, some of them are not. You can release a software where the miner stops, but if it is open-source, then miners can decide they want to compute hashes all the time, because then they have a chance to produce another valid Proof of Work. Even if some old nodes will not accept that, still, there will be new nodes and new miners that will know nothing about the past events in that network and will have no way to check, which Proof of Work is the right one.

[Meitzi]

Please explain how a lower complexity reduces the amount of energy used when miners are encouraged to increase energy usage in order to be one of the first N2 miners. Whether it takes 1000000 tries on average or 10¹⁸ tries on average, miners are going to use as much energy as they can in order to be first.

Yes but Round one is only let's say 2min for the sake of argument. Once this 2min is over Only N2 miners will advance to Round 2 to work on the second puzzle. Let's assume Round 2 calculation time is 6min. We have N1 miners working for 2min and N2 miners working for (2+6)=8min. In Bitcoin we have all N1 working all 8min. We save energy on Round 2. N1-N2 miners are IDLE during 6min of Round 2. This is where we save energy. Now I do understand that miners can try to game the system and rent their machines to the winners of Round 2. But I don't know how practical it can be to do so.  

Doesn't this scheme compromise the security of the bitcoin network. I mean, the security aspect of it is based on the total hashrate at every moment in time. if at any moment it decreases...then there's a potential weakness.

Yes it does. It makes half PoW and half of luck. If this is good, then make it 100% luck. does it work? No. Its not secure.
This propose just lower security for name of "economical".

[Epictetus]

Please explain how a lower complexity reduces the amount of energy used when miners are encouraged to increase energy usage in order to be one of the first N2 miners. Whether it takes 1000000 tries on average or 10¹⁸ tries on average, miners are going to use as much energy as they can in order to be first.

Yes but Round one is only let's say 2min for the sake of argument. Once this 2min is over Only N2 miners will advance to Round 2 to work on the second puzzle. Let's assume Round 2 calculation time is 6min. We have N1 miners working for 2min and N2 miners working for (2+6)=8min. In Bitcoin we have all N1 working all 8min. We save energy on Round 2. N1-N2 miners are IDLE during 6min of Round 2. This is where we save energy. Now I do understand that miners can try to game the system and rent their machines to the winners of Round 2. But I don't know how practical it can be to do so.  

Doesn't this scheme compromise the security of the bitcoin network. I mean, the security aspect of it is based on the total hashrate at every moment in time. if at any moment it decreases...then there's a potential weakness.

I don't think so. We can find an optimal value of N2 that does not undermine the security of Bitcoin with TRPoW. Intuitively an upper bound of such value is O(SquareRoot N1). Assuming that the winner of Second Round is among N2 List of N2 miners instead of only N2 first miners. An optimal value of N2 is could be in O(Log(N1)) based on a similar calculation done by EPFL Distributed Algo team: https://arxiv.org/abs/1908.01738
You can also see that Bitcoin with PoW is equivalent to Bitcoin with TRPoW where N2 = N1.
If we assume for the sake of argument that N1 = 1000000 and N2 = Square Root of N1 = 1000.
The reduction of energy can go drastically because we will have 1000 000  - 1000 = 999 000 miners (99.9% of the network) not doing the Second Round. We will save huge amount of electricity without undermining the security of the blockchain.

[Epictetus]

N1-N2 miners are IDLE during 6min of Round 2.

Some of them are idle, some of them are not. You can release a software where the miner stops, but if it is open-source, then miners can decide they want to compute hashes all the time, because then they have a chance to produce another valid Proof of Work. Even if some old nodes will not accept that, still, there will be new nodes and new miners that will know nothing about the past events in that network and will have no way to check, which Proof of Work is the right one.

I see what you are saying. But if CPU power is controlled by honest nodes, I don't think, this type of attack will undermine the network ?

[Epictetus]

tl;dr - total electric consumption will not be reduced by implementing the OP's proposal.

I'm sure the miners wouldn't be supporting such a thing because it just makes it even harder for them to get a reward.

Also, if there are millions of miners and you randomly select 100 of them, you encourage the rest of the miners to form mining pools. Then, you will end up in a situation where 100 miners are selected as before, but there are only 100 huge mining pools, they always get everything and distribute that to smaller miners. Almost no solo miner will follow your system if that miner will be rewarded once per month, because the risk of price drop after entering exchange is higher than the potential reward from solo mining.

I wonder if the people that wrote that paper realized that. that's thinking ahead! the bitcoin mining system is really hard to make changes to without causing things to get "out of whack"

This is similar to say that miners will organize themselves in big pools to organize a 51% attack on Bitcoin network. It did not happen so far.

No. The miners have incentives to not 51% attack the network. If they try this, the value of their equipment to drop >99% overnight.

Miners engaging in activity similar to what I described is similar to miners attempting to keeping their equipment that has a limited shelf life working as much as possible.

The N2 number of miners of the second Round is also adjustable like the complexity algorithm in PoW that is adjusted every 2016 Block.
Plus In Round 1 we are hashing Hash(Block Head + PublicKey + Nonce). So I don't know how this is going to force miners to organize in big pools. The Public Key of a miner has the benefit of limiting the formation of pools. In BTC PoW there is no public key in the hash. In TRPoW, the hash result is public key dependent.    

 

The public key associated with the address 1KFHE7w8BhaENAswwryaoccDb6qcT6DbYY belongs to the mining pool f2pool. There are thousands (if not more) of miners who mine on f2pool, but all of f2pool's found blocks payout to the above address.

If f2pool makes it to the second round, any miner who is not participating in the second round will switch to mining on f2pool, or another pool that is participating in the second round. If a miner sits idle (or is not otherwise producing work that has the potential to find a block) during the second round, their equipment is losing out on potential value.

I agree with you on this. It is a good solution for the pool miners to use public key in the hash but it increases the complexity of the problem they are trying to solving.

The PoW job is also to maintain the Block Time at 10min. We can achieve that by just making everyone wait for that 10min minus delay/network broadcasting time etc.

Say round 1 only takes 2 minutes to get 100 miners. Then you just wait 8 minutes to select the "winner".  That's a 10 minute block time. So it saves 8 minutes of hashing. Less global warming.

You would need a way to prevent the knowledge of the winner for 8 minutes so that nobody can start on the next block before the 10 minutes have past.

The difficulty of the first round could be "x", and the difficulty of the second round would be "10000x". Each of the miners who are "selected" during the first round could need to have their "block" include the hash of the previous block, and the first "block" in the first round would need to include the hash of block found in the second round. The found block in the second round would need to sign the hash of the last block of the first round. This is very similar to how bitcoin mining occurs today.

Let's me think of the last part slowly. 

[Epictetus]

You would need a way to prevent the knowledge of the winner for 8 minutes so that nobody can start on the next block before the 10 minutes have past.

Even if you can successfully prevent that knowledge for 8 minutes, someone can still start working on some randomly chosen block and have hope it will give some boost on average, where other miners will be idle. Also, you need at least two candidates, in other case any obfuscation of the winner is pointless. Does it mean that nobody can start the chain alone by using the official miner?

Another thing is getting the right to mine: one miner can pretend to be N miners or can just own many mining machines and assign different keys to each of them. Then, if the list of participants is known, any miner can try to extend any block, just by checking each of them sequentially, or even assigning different threads to different blocks. Extending one of N blocks has the same probability as extending some chosen block. Because having a chance to mine the right block is better than having no chances by being idle, people will run their machines all the time.

Great point indeed.

[zbig001]

The energy saving comes from the fact that most of miners will spend a big part of their time on Round 1 that is not heavy-energy / CPU consuming. At least this is the target, the bet and the hope.  

I'm afraid exactly that you might be right, and you might succeed 

The newly mined coins plus the transaction fees for the transactions included in the block have a certain value.
So it is obvious that the market will seek equilibrium and to channel the resources needed to mine with a similar market value (I assume that mining is still to be permissionless, and we will not create a miners clique or cabal where market law does not apply).

The precedents are not really optimistic...
Memory intensive mining algorithm like Scrypt can effectively reduce the energy intensity of computation. But then the mining equipment itself becomes the main investment of the miner, and the benefit to the environment is disputable due to increased e-waste production.