Topic: NeuCoin's 40-page white paper rebuts all nothing at stake objections (Read 5977 times)

koubiac · « **on:** March 25, 2015, 11:17:54 pm »

The NeuCoin white paper just released - rebutting all “nothing at stake” objections to proof-of-stake

The NeuCoin Project just released a 40-page technical white paper on proof-of-stake. It is available as a PDF version on this link: neucoin.org/en/whitepaper

We hope to gather comments and questions from the PoS community as we consider this to be a first draft. Our work attempts to highlight how PoS is a superior alternative to Proof-of-Work. It offers arguments and data to stand up against the unsubstantiated “nothing at stake” claims made by many in the PoW camp. Bounties will be awarded for all constructive feedback, positive or negative; see details below.

The white paper starts with a discussion of PoW’s severe flaws: its increasing centralization, the prospect of much higher transaction fees over time, and the diverging interests of corporate miners and Bitcoin holders. It then explains how PoS solves all these flaws. Then it moves on to answering objections and addressing attack vectors.

Answering the “nothing at stake” argument

Thus far, PoS has been dismissed by much of the crypto community - especially large holders of Bitcoin - based on the umbrella objection that there is “nothing at stake.” What is meant is that since PoS mining does not consume any outside resources (electricity, computing power), miners have no costs, so nothing prevents them from endlessly trying to commit double-spends, or mining on multiple branches, no matter how low the odds of success. The critics ask, “how can you have security without paying anything for it?”

What PoW advocates neglect to see is that PoS security does have a cost: the capital cost of acquiring and holding coins. The brilliance of PoS is that it turns all coin owners into security providers, and requires any would-be attacker to purchase a large amount of the currency to attempt an attack, which would be an attack on his own wealth.

Besides ignoring the reality of capital costs, PoS critics are also prone to depicting scary-sounding attack vectors against PoS - grinding through the blockspace, rewriting history with old private keys, long-range, pre-programmed double spends - without explaining the details of how these attacks would be conducted or demonstrating mathematically that they have any chance of success.

Perhaps by leaving the critiques abstract, the point is made that PoS’s “nothing at stake” flaw is fundamental and nothing can be done to fix it. Or it could be that actually taking the time and effort to analyze the actual odds of success of a given attack vector against PoS is hard, time consuming and may not lead to the desired result (that PoS is hopelessly doomed). NeuCoin has taken the time to analyze the attack vectors and their chances of success. We hope that our white paper will be a contribution to the entire PoS community, and invite you to comment, give feedback and help take this technology even further.

White paper bounty program

NeuCoin bounties will be awarded by the NeuCoin Code foundation for all constructive input, both positive and critical, you will find details here: forum.neucoin.org/t/white-paper-bounty-program/

PoW is centralized, costly and inefficient - and has been attacking PoS on flimsy grounds. We hope the wider PoS community will join us in this debate.

aronmu · « **Reply #1 on:** March 26, 2015, 08:00:11 am »

Welcome Koubiac and cheers for strengthening the "POS camp"!

Has the presale started?

Daedelus · « **Reply #2 on:** March 26, 2015, 10:25:00 am »

Hello Koubiac,

Nxt has a research group (Consensus Research, fronted by Kushti) that has done some in depth research and modelling into N@S you might be interested in.

See https://bitcointalk.org/index.php?topic=897488.0 for discussion of his findings.

Generally, they have a sub forum here: https://nxtforum.org/consensus-research/

koubiac · « **Reply #3 on:** March 26, 2015, 02:29:24 pm »

Quote from: aronmu on March 26, 2015, 08:00:11 am

Has the presale started?

Hi aronmu,

The presale will start in April.

Daedelus, thanks for the link

I think what kushti is doing on N@S is really great

kushti · « **Reply #4 on:** March 28, 2015, 03:46:19 am »

Hope to read within next few days(a lot of papers around now

).

koubiac · « **Reply #5 on:** March 30, 2015, 02:27:49 pm »

Hey,

We're trying to spark a debate on proof-of-stake versus proof of work on bitcoin's subreddit. (NOT focused on neucoin)

Feel free to join and help get proof-of-stake back on the map!!

reddit.com/r/Bitcoin/comments/30t3k4/proofofstake_is_more_decentralized_efficient_and/

Sandrine · « **Reply #6 on:** April 15, 2015, 02:42:57 pm »

Hi, this is Sandrine, I’m working with koubiac on the NeuCoin Project.

I’m reaching out to ask for the NXT community’s feedback on another topic. We are considering a distribution program whereby a fraction (3-5%) of NeuCoin’s 3 billion coin premine would be distributed to existing holders of select digital currencies: Peercoin, NXT, Bitshares, Blackcoin, Nubits, Ripple(?), Stellar(?) and potentially Dogecoin (Jackson Palmer is a strategic advisors and Doge has been a pioneer in terms of wide distribution and micro-transactions).

The goal of the program would be to involve the PoS community and achieve the fairest and widest possible distribution of NeuCoins to early adopters who are experienced with crypto in general and PoS in particular. The program fits with NeuCoin’s foundational principle of distributing the currency not just to miners, but to all participants in proportion to their contribution to growth in value and utility - so to consumers, merchants, developers, content creators, service providers like exchanges, wallets, processors, etc.

We ask you for your general feedback on this program, as well as input on the following specific questions:

What factors should we consider when deciding which altcoins to include? Just PoS coins? Ripple, Stellar? Certain PoW coins like Doge and LTC?
What percentage of the program’s coins should be allocated to each altcoin? We want to be “fair” but more importantly want to allocate in the way that optimizes the growth and adoption of NeuCoin.
What should the distribution rules be? We want wide, fair distribution, meaning that we don’t want the majority of the coins going to a small number of altcoin whales. Should distribution be pro rata above/below a certain line? We are considering having a fixed payout ratio for each altcoin (X NeuCoins per NXT) with a minimum and maximum payout for each address. What kind of minimum and maximum payouts per address do you think make sense?
A last question - on what date should we take a snapshot of each altcoin’s blockchain to determine eligibility for this program?
Any other aspect or consideration you want to bring up?

We hope you find this interesting and look forward to your feedback.

If you want more information about NeuCoin’s distribution, we just published a Strategic Plan on neucoin.org. We also just released a new questionnaire in which we ask respondents about the above distribution program among other things - and we’re rewarding everyone who completes the questionnaire with up to 2,500 free NeuCoin. We also just announced the details of our presale that starts on April 28.

Thanks, and let me know if you have any questions!

Sandrine · « **Reply #7 on:** April 15, 2015, 02:51:06 pm »

I actually created a dedicated topic here: https://nxtforum.org/general-discussion/neucoin-distribution-program-to-nxt-holders/, if you want to join it!

toenu · « **Reply #8 on:** April 15, 2015, 03:06:30 pm »

I noticed that Neucoin is advertising with the slogan "the first secure proof-of-stake technology". Does this mean you think Nxt (and other PoS implementations) are inherently insecure, and if so could you provide specific reasons for that? (I'm too lazy to read a 40 page document)

Sandrine · « **Reply #9 on:** April 15, 2015, 05:58:02 pm »

Hi toenu!

Not necessarily inherently insecure, but there are indeed major differences, one of them is the design of the mining incentives.

As you are probably aware of, mining participation is a critical aspect of proof-of-stake security. Most PoS coins use a 1% fixed annual interest rate for mining which has empirically proved to be insufficient to incentivize users to mine (participation I believe is ~10-15%). NeuCoin's distribution through PoS rewards instead of PoW creates very high incentives to mine.

Moreover, NeuCoin's stake modifier reduces the chance of a grinding attack and also greatly improves the efficiency of the duplicate stake detection mechanism which prevents miners from mining on multiple chains in case of a network fork.

In the case of NXT, the difference is that NXT uses a "floating checkpointing system" (called a "moving threshold") which doesn't provide the same type of consensus than Bitcoin for instance. Without going too much into the technical details, in Bitcoin for instance, you can bootstrap a new node or go offline/online without having to use a trusted source to get the currently accepted state of the network. The goal of NeuCoin is to offer an implementation of PoS that allows to do the same.

Hope this helps!

kushti · « **Reply #10 on:** April 17, 2015, 01:47:31 pm »

Finally, I've read the paper carefully. Feedback:

1. As kernel = fn(timestamp, fn(UTXO)), and timestamp could be shifted, time-grinding is possible(a miner can play with timestamp of current kernel aiming to have better kernel within some timerange in future as well). Paper describes only some sort of protection against UTXO-grinding.

In Nxt, kernel is hash(lastBlock.kernel, account.publicKey) , and so there're no grinding attacks at all.

2. Is any incentive to split outputs to have more hits(even with less target)? Unclear

3. Paper states punishments for contributing to multiple forks, but no any details given. To punish miner for contributing, evidence should be published somehow into the chain(otherwise it will be not possible for a node joined a network after to say why a miner was punished).

4. Isn't stake modifier calculation leading to costly chain validation?

5. Pg 12, Nxt was launched in Nov, 2013, not 2014. And probably Nxt has more forks.

kushti · « **Reply #11 on:** April 17, 2015, 01:56:23 pm »

Quote

In the case of NXT, the difference is that NXT uses a "floating checkpointing system" (called a "moving threshold") which doesn't provide the same type of consensus than Bitcoin for instance. Without going too much into the technical details, in Bitcoin for instance, you can bootstrap a new node or go offline/online without having to use a trusted source to get the currently accepted state of the network. The goal of NeuCoin is to offer an implementation of PoS that allows to do the same.

1. Bitcoin has few hardcoded checkpoints as well ( https://github.com/bitcoin/bitcoin/blob/master/src/chainparams.cpp )
2. Entering into Bitcoin / Nxt / other cryptocurrency p2p network using some trusted points, your node isn't scanning ports around the globe to find other peers

3. A node in Nxt is downloading a chain in similar way as in Bitcoin (there is some protection to not rely on one other peer, don't sure whether Bitcoin has the same level of that though).

koubiac · « **Reply #12 on:** April 17, 2015, 04:55:04 pm »

Quote from: kushti on April 17, 2015, 01:47:31 pm

Finally, I've read the paper carefully. Feedback:

1. As kernel = fn(timestamp, fn(UTXO)), and timestamp could be shifted, time-grinding is possible(a miner can play with timestamp of current kernel aiming to have better kernel within some timerange in future as well). Paper describes only some sort of protection against UTXO-grinding.

In Nxt, kernel is hash(lastBlock.kernel, account.publicKey) , and so there're no grinding attacks at all.

Hi Kushti,

Thanks for the quality feedback!

1/The answer depends on what your definition of grinding is.
By grinding I mean "being able to go through kernels in order to obtain more proof than you would normally".
What you're pointing out isn't grinding because it merely allows the user to compute a certain number of proofs in advance and potentially generate a block with a timestamp in the future and broadcast it.
Let's take Peercoin's example to study this possibility.

If the block generated has a timestamp that is larger than current adjusted time + max clock drift (max clock drift =2h in Peercoin) then the block is rejected by the node. ( github.com/ppcoin/ppcoin/blob/master/src/main.cpp#L1889 )
Now let's suppose the attacker only shifts his timestamp and finds a valid proof only 1 hour in the future. He broadcasts this block which gets accepted by the network. However, in average, the rest of the network will be finding ~6 blocks within one hour so users can continue working on the previous block and the attacker's block will get orphaned.

Correct me if I'm wrong, but this prevents an attacker from getting any advantage from shifting his timestamp.

Quote

2. Is any incentive to split outputs to have more hits(even with less target)? Unclear

I'm not sure what you mean by that.
As described on pages 28-29 of the white paper, if an attacker wants to fork the main chain, he absolutely must split his outputs.
If you're thinking about a user trying to maximize his returns by splitting his stake into a large number of smaller stakes, than that won't work.
If you have a specific concern, I'd be glad to provide a more detailed answer.

Quote

3. Paper states punishments for contributing to multiple forks, but no any details given. To punish miner for contributing, evidence should be published somehow into the chain(otherwise it will be not possible for a node joined a network after to say why a miner was punished).

Maybe there's some confusion about what "punished" means. It simply means that the selfish miner's block has been rejected by the network because he tried mining on multiple forks. I'm not sure how this is a concern for nodes joining the rest of the network. This mechanism does not prevent him from trying to use this proof in a fork for example. It simply prevents his block from making it into the main chain.

Quote

4. Isn't stake modifier calculation leading to costly chain validation?

This is a good point. The stake modifier calculation is "relatively" costly. Sigmike has been doing some work to reduce this cost.

Quote

5. Pg 12, Nxt was launched in Nov, 2013, not 2014. And probably Nxt has more forks.

The date refers to the publication of the source code not the launch. And concerning the number of forks it seems like Peercoin has more significant forks.

durerus · « **Reply #13 on:** April 18, 2015, 11:06:08 am »

This is an interesting approach. So the stakeholders of the initially 100 million coins together with the founders' and investors' 400 million coins will fully control the foundations with their 2,5 billion coins via voting system? The stake of the foundations is not allowed to vote?

kushti · « **Reply #14 on:** April 18, 2015, 06:45:16 pm »

Quote from: koubiac on April 17, 2015, 04:55:04 pm

Quote from: kushti on April 17, 2015, 01:47:31 pm
Finally, I've read the paper carefully. Feedback:

1. As kernel = fn(timestamp, fn(UTXO)), and timestamp could be shifted, time-grinding is possible(a miner can play with timestamp of current kernel aiming to have better kernel within some timerange in future as well). Paper describes only some sort of protection against UTXO-grinding.

In Nxt, kernel is hash(lastBlock.kernel, account.publicKey) , and so there're no grinding attacks at all.

Hi Kushti,

Thanks for the quality feedback!

1/The answer depends on what your definition of grinding is.
By grinding I mean "being able to go through kernels in order to obtain more proof than you would normally".
What you're pointing out isn't grinding because it merely allows the user to compute a certain number of proofs in advance and potentially generate a block with a timestamp in the future and broadcast it.
Let's take Peercoin's example to study this possibility.
If the block generated has a timestamp that is larger than current adjusted time + max clock drift (max clock drift =2h in Peercoin) then the block is rejected by the node. ( github.com/ppcoin/ppcoin/blob/master/src/main.cpp#L1889 )
Now let's suppose the attacker only shifts his timestamp and finds a valid proof only 1 hour in the future. He broadcasts this block which gets accepted by the network. However, in average, the rest of the network will be finding ~6 blocks within one hour so users can continue working on the previous block and the attacker's block will get orphaned.
Correct me if I'm wrong, but this prevents an attacker from getting any advantage from shifting his timestamp.

Ok, here's the more detailed description of the problem I see:

Kernel is tuple (timestamp, utxoParams). Let's consider timestamp is measured in seconds, and new block is just arrived. So, instead of computing new kernel each second, greedy forger can iterate over 2*60*60 = 7200 hashes to find the best one(and btw, it's better to start iteration from current_time+2, as target is better there). As Neucoin uses longest chain rule, new block will be ok(and there's no requirement for time increase probably, as well as in Bitcoin, http://bitcoin.stackexchange.com/questions/915/why-dont-the-timestamps-in-the-block-chain-always-increase).

Even worse thing, (almost) all forgers are greedy, so all the network eventually will start to publish all possible blocks for next 2 hours immediately.

Quote from: koubiac on April 17, 2015, 04:55:04 pm

Quote
2. Is any incentive to split outputs to have more hits(even with less target)? Unclear

I'm not sure what you mean by that.
As described on pages 28-29 of the white paper, if an attacker wants to fork the main chain, he absolutely must split his outputs.
If you're thinking about a user trying to maximize his returns by splitting his stake into a large number of smaller stakes, than that won't work.
If you have a specific concern, I'd be glad to provide a more detailed answer.

Right, splitting stake doesn't make sense.

Quote from: koubiac on April 17, 2015, 04:55:04 pm

Quote
3. Paper states punishments for contributing to multiple forks, but no any details given. To punish miner for contributing, evidence should be published somehow into the chain(otherwise it will be not possible for a node joined a network after to say why a miner was punished).

Maybe there's some confusion about what "punished" means. It simply means that the selfish miner's block has been rejected by the network because he tried mining on multiple forks. I'm not sure how this is a concern for nodes joining the rest of the network. This mechanism does not prevent him from trying to use this proof in a fork for example. It simply prevents his block from making it into the main chain.

Well, if alternative chain has longest length, why it should be rejected? And in many cases, contribution to multiple chains couldn't be easily caught. E.g. forgers A, B, C are having patched Neucoin node with contribution to multiple chains. E.g. they're revealing chain suffix of length 3(made by A,B,C) instead of suffix of length 2(made by E,F) in main chain, and if A,B or C in main chain suffix, they not going to reveal a better fork.

koubiac · « **Reply #15 on:** April 23, 2015, 03:12:07 pm »

Quote from: kushti on April 18, 2015, 06:45:16 pm

Ok, here's the more detailed description of the problem I see:

Kernel is tuple (timestamp, utxoParams). Let's consider timestamp is measured in seconds, and new block is just arrived. So, instead of computing new kernel each second, greedy forger can iterate over 2*60*60 = 7200 hashes to find the best one(and btw, it's better to start iteration from current_time+2, as target is better there).

First of all sorry for the delayed answer

I'm not exactly sure of what you mean so tell me if I misunderstood anything.
Timestamp is indeed measured in seconds. You (generally) don't need to wait for the last block because unlike Bitcoin, the hash of the previous block is not included in the kernel.
I'm not sure what you mean by "the best one" nor why the target would be better at current_time+2, could you please elaborate?

Why can't a miner gain any advantage by behaving this way?

I'm not 100% sure I got your argument, so correct me if I'm not answering your question

When the greedy miner iterates over the 7200 possibilities, he's not going through more possibilities than he would've normally had gone through. He's only going through them earlier.

If a time t=0 he goes through the 7200 possibilities (t=0 to t=7200), and at time t=1200 he goes through the next 6000 possibilities (t=1200 to t=7200), he will create valid proofs for the exact same timestamps.
So he cannot create more blocks than he should've.

He can however broadcast them in advance. But what would that do for him?
NeuCoin (like Peercoin) does not use the longest chain rule. It actually uses the most trust rule.
We could detail the design of the trust rule but basically, when you mine a block, the score of the block depends on the current difficulty (or target, the two are of course directly linked) and it is retargeted at every block.

So let's imagine a scenario where one greedy user owns 5% of the coins. Since NeuCoin's blocktime is 1mn, he will in average mine 6 blocks in the next 2 hours.
Let's imagine he mines at timestamps= 130, 2142, 2686, 3227, 6764, 6866
The rest of the network will mine its first 6 blocks at timestamps= 60, 120, 180, 240, 300, 360 (for example)

Two scenarios:

The greedy miner and the rest of the network mine on different branches.
The greedy miner's fork will be orphaned extremely quickly even if he broadcasts all his blocks at once and the rest of the network acts normally. The reason is that the network's fork will have a much larger cumulated trust even though both forks have the same length.
They both mine on the same branch. Then nothing happens, the attacker gets his rewards in advance but I don't see why this would be an advantage.

Of course everybody could broadcast their blocks 2h in advance this wouldn't change anything in practice.
I'm not sure I've answered your question so let me know if I haven't

Quote

Well, if alternative chain has longest length, why it should be rejected?

It wouldn't be.

Quote

And in many cases, contribution to multiple chains couldn't be easily caught.

The goal is not to prevent miners from broadcasting a fork using duplicate proofs (i.e. broadcasting a large number of blocks at once), what we prevent is people trying not to get orphaned in case of a natural blockchain fork by mining on both chains and broadcasting a block on both chains.
I'm not sure I got the rest of the scenario, if you'd care to expand, that'd be great!

mably · « **Reply #16 on:** April 23, 2015, 04:09:22 pm »

Quote from: koubiac on April 23, 2015, 03:12:07 pm

So let's imagine a scenario where one greedy user owns 5% of the coins. Since NeuCoin's blocktime is 1mn, he will in average mine 6 blocks in the next 2 hours.

Hi koubiac. Just wondering: how do you calculate this? I guess it depends on the percentage of coins being minted.

koubiac · « **Reply #17 on:** April 23, 2015, 04:42:00 pm »

Quote from: mably on April 23, 2015, 04:09:22 pm

Quote from: koubiac on April 23, 2015, 03:12:07 pm
So let's imagine a scenario where one greedy user owns 5% of the coins. Since NeuCoin's blocktime is 1mn, he will in average mine 6 blocks in the next 2 hours.

Hi koubiac. Just wondering: how do you calculate this? I guess it depends on the percentage of coins being minted.

Absolutely, to be more precise I should've said "5% of the percentage of coins mining".

mably · « **Reply #18 on:** April 23, 2015, 04:43:56 pm »

Quote from: koubiac on April 23, 2015, 04:42:00 pm

Quote from: mably on April 23, 2015, 04:09:22 pm
Quote from: koubiac on April 23, 2015, 03:12:07 pm
So let's imagine a scenario where one greedy user owns 5% of the coins. Since NeuCoin's blocktime is 1mn, he will in average mine 6 blocks in the next 2 hours.

Hi koubiac. Just wondering: how do you calculate this? I guess it depends on the percentage of coins being minted.
Absolutely, to be more precise I should've said "5% of the percentage of coins mining".

Ok thanx koubiac, I'm trying to build up a doc describing this type of "attack" for Peercoin, may I borrow a few elements from your posts?

mably · « **Reply #19 on:** April 23, 2015, 04:50:56 pm »

Quote from: koubiac on April 23, 2015, 04:42:00 pm

Quote from: mably on April 23, 2015, 04:09:22 pm
Quote from: koubiac on April 23, 2015, 03:12:07 pm
So let's imagine a scenario where one greedy user owns 5% of the coins. Since NeuCoin's blocktime is 1mn, he will in average mine 6 blocks in the next 2 hours.

Hi koubiac. Just wondering: how do you calculate this? I guess it depends on the percentage of coins being minted.
Absolutely, to be more precise I should've said "5% of the percentage of coins mining".

Question? Doesn't NeuCoin have coin maturity like Peercoin?

News:

Author Topic: NeuCoin's 40-page white paper rebuts all nothing at stake objections (Read 5977 times)