[up](squid.md) [back](squid-money.md) [next](squid-fed.md)
# Proof of What? Proof of Trust!
It is pretty obvious that BitCoin went back all the way through human money
history, and uses the same principle shell money had to give value to a coin:
the miners do a proof of work. Like the shells, the amount is limited, and
the difficulty raises with the amount of work available. The limited amount
of mineable BitCoins mimics another property of shell money, and with a
quickly growing economy that actually uses cryptocurrencies, it becomes a
quickly deflating currency. That makes it ideal as speculation object, and
very bad as trade token.
There is a disastrous side effect to this: Mining burns energy, ASICs are
developed and manufactured, if you try to avoid ASIC mining, all available
cost-efficient GPUs are bought and gamers are frustated, because they simply
can't get hold of them. This is far worse to hoarding gold, because nobody
actually needs gold anywhere near the available quantities used as money.
And all that big amount of work is converted into very few actual
transactions. BitCoin exchanges pop up that allow people to trade with them
without actually making transactions in the BitCoin protocol; and without
those transactions, that money is not secured. Virtual bankrobbery occurs,
and it shows that people who don't know history are doomed to repeat it:
Regulation is there for good reasons.
Note that the energy consumption is not a function of how many transactions
happen, it's a function of how much reward the miners get. That means higher
bitcoin prices result in higher energy consumption, because the proof of work
scales with the amount of available work, and that inflates with the price per
coin.
That means that the lightning network, while improving scalability, does not
cut down the hidden transaction costs: the liquidity required for the
lightning network will drive the price per coin up, so that mining is so
lucrative that miners will buy more ASICs and burn more coal in turn.
## What is a BlockChain?
We need an actual definition; technically, even a git repository has
some important properties of a BlockChain. The chain of hashed blocks
is one aspect, the consensus algorithm the other:
* Merkle-tree or equivalent hash-it-all approach (loose definition)
* no single point of trust
* consensus algorithm based on the contents only (no external arbiter)
## How to cheaply secure the BlockChain
So let's take a step back, and look why there's a need for the proof of work
(the consensus algorithm): The basic idea is that of securing the BlockChain
against an attack that allows double spending. The BlockChain itself is
immutable if you have access to the last hashed block: Through a link of
hashes, every other block before can't be changed without changing the last
block, too. The problem is: how do you know it's _the_ valid last block?
BitCoin's proof of work concept is that you need to invest a certain amount of
work to sign a block, so the older a block is, the more work it takes to forge
it, and reciprocal, the more work that went into a chain, the more “true” it
is. That concept originates from a crypto-anarchic design: in the BitCoin
world, everybody is pseudonymous, so even the signature for the blocks are
done by anonymous cowards (and that is just a hash, there's no identity
associated with that hash). We are back before the first promissory notes,
who at least had identifyable individuals or institutions as signers.
We have to go one more step back, to see where that attack originates
in the threat model: it's a man in the middle (MITM) attack to prevent
the proper spread-out of the current block. A MITM attack to a P2P
network. Preventing MITM attacks has other attempts to solve them,
either, even trust on first use (TOFU) does a descent job. And that's
likely the explanation, why even AltCoins with very little work didn't
get hacked on that part.
Any sane secure peer to peer network ought to have something better
than nothing: TOFU or PKIs that improve trust. And that a full-blown
PKI takes away the anonymity is not a problem: A big warehouse of
ASICs to mine BitCoins also completely blows the anonymity of the
miner. The miner or signer doesn't need anonymity; the parties that
actually exchange coins are the ones who want anonymity.
So to secure the BlockChain requires two things: First, the operators
of full nodes (those who take and validate transactions) need to have
known keys, so you can connect to them without MITM attacks.
Second, you can just make sure you have enough sanctions and auditable
signers of these blocks. The block chain with the highest amount of
trust wins. How do you **measure** trust? Can you enumerate trust?
Reliable signers have signed many blocks. Game theory shows that
repeated collaborative interactions are more rewarding than cheating,
which can be punished with long-term effects. Also: the more signers
you have, the better. Verified signers are better than anonymous
signers, because anonymous signers can be a sybill attack.
To avoid intruders re-signing older blocks, rotate signature subkeys each
round. A well-behaving signer will lose the old key each round (just keep it
long enough so that the commitment of the new key in the next block is
confirmed), and therefore is unable to tamper old blocks; similar to ephemeral
encryption, where you are unable to decrypt the traffic yourself later.
You can have a proof of work to prevent sybill attacks, e.g. mandating that to
enter the trust ring, you need to have a key with a certain prefix. That
would be one-off work, because then you want to stay there with that identity,
and accumulate more trust by signing in consensus. It just creates an entry
barrier and avoids DDoSing the ledgers with applications for participation.
Of course, every transaction within the block ought to include the
previous block's hash as starting key for the hash calculation, so
that they contribute to the unchangeable chain, and can't be moved to
any other fake chain (they won't verify there). Furthermore, each
transaction (despite being anonymous) adds to the trust value: more
transactions in one block means that it is more trustworthy, because
more people found its way to this branch of BlockChain reality.
Note that the partitioned BlockChain below makes it far more expensive
to fake a chain: You need to generate signatures and activities in all
of them; the fake activities you generate are with the coins you own;
you have no others. Sanctions for misbehavoir can make sure these
coins are lost; the fake chain is the proof of misbehavior.
Those additional coins could be used to compensate for the loss of the
victim of double spending.
## Where to hijack the proof of work BlockChain
Let's assume we can attack BitCoins block chain: Where would we attack it? At
the end, which allows us to do double spending of the coins we own? Who would
do that? Probably someone with a lot of coins inside, so proof of stake is a
bad idea (especially, since that allows you to spend the same coin not just
twice, but many times; even if you lose the stake in question, it's still a
big win).
Or attack it at the front, where most coins have not yet been mined,
and by producing a fake fork of all the transactions afterwards, you
could turn over all the coins in the entire BitCoin universe to you.
All you need is enough power to calculate a full chain considerably
faster than the miners.
Is that viable? It won't go in undetected, but since the early mining
was more profitable in numbers of coins, and far easier (because the
difficulty was much less than today), it's technically not that hard.
And “longest chain” is not sufficient to defend that attack: It needs
to be the chain with most work involved in. The fake chain could be
one where the adjustment for the difficulty is set too low.
BitCoin addresses that, the chain length is the sum of the
difficulties. But the problem remains: Let's say China confiscates
the ASIC miner's equipment, which will result in a significantly
reduced difficulty in the rest of the world's BlockChain. And then it
uses the confiscated equipment to construct a chain that has more
difficulty in it than the entire chain from the rest of the world — it
might take a year or two, but it's doable.
And then it busts the entire BitCoin ledger by releasing that chain, which
essentially has only unspendable coins inside (coins owned by the Chinese),
because in that revision of history, they were all mined by someone else.
You still need to spend more effort on that as the miners spend, but
you then own all the cheap, easy to earn early coins.
But in fact the by far easiest hijack is to create a slightly incompatible
protocol. This is deliberately splitting the network, out in the open, with
effectively not much work required, and this allows to double-spend, even
though the BitCoin fork doesn't have the same price. But the price is not the
point: The point is the promise of the unique asset. Just think of real
estate in the BlockChain. By having forks, BitCoin shows that it can only
fulfill that within a consent of the protocol, and that's actually outside the
chain itself.
So the executable protocol spec, the code for checking a block for
validity itself should be part of the chain, and only updated in
consensus. And any transaction need to link to the protocol block,
and if a transaction is found that links to a not accepted protocol
block, it will cause a quarantine of the corresponding coin. That
means you get punished for spending it in the fork.
It needs to be done in a way to keep the balance.
[up](squid.md) [back](squid-money.md) [next](squid-fed.md)