1
00:00:00,470 --> 00:00:04,110
In this lecture, we're going to talk
about alternatives to Bitcoin's existing

2
00:00:04,110 --> 00:00:05,500
proof of work mining puzzle.

3
00:00:05,500 --> 00:00:07,880
Mining puzzles are at
the very core of Bitcoin,

4
00:00:07,880 --> 00:00:11,760
because mining puzzles determine
the incentive system in Bitcoin.

5
00:00:11,760 --> 00:00:15,480
Bitcoin miners get rewards for
the puzzles that they solve.

6
00:00:15,480 --> 00:00:18,630
We expect that miners will spend
considerable effort trying to find any

7
00:00:18,630 --> 00:00:23,200
shortcuts available to them to solve
these puzzles faster or more efficiently.

8
00:00:23,200 --> 00:00:26,190
There's a faster way to solve
puzzles we think they'll take it.

9
00:00:26,190 --> 00:00:29,400
Also if there's extra stuff to do
that might help the network, but

10
00:00:29,400 --> 00:00:32,390
doesn't directly help them
solve puzzles any faster,

11
00:00:32,390 --> 00:00:35,820
we expect that they might eventually
not bother to do so at all.

12
00:00:35,820 --> 00:00:39,540
Therefore, the nature of the puzzle plays
a very important role in steering and

13
00:00:39,540 --> 00:00:41,239
guiding participation in the network.

14
00:00:42,860 --> 00:00:46,962
Now, we've talked about some of the basic
feature that Bitcoin's existing SHA2

15
00:00:46,962 --> 00:00:50,460
hash-based mining puzzle
already satisfies.

16
00:00:50,460 --> 00:00:54,260
So for example, it's fairly difficult to
solve a whole bunch of puzzle solutions.

17
00:00:54,260 --> 00:00:59,400
This makes the tax on the Bitcoin network
very costly or unlikely to succeed.

18
00:00:59,400 --> 00:01:03,350
On the other hand, puzzle solutions
are found at a fairly predictable rate.

19
00:01:03,350 --> 00:01:05,600
Once every ten minutes by someone.

20
00:01:05,600 --> 00:01:08,560
This means that honest
miners to participate have

21
00:01:08,560 --> 00:01:13,180
some incentive to keep participating and
compensate themselves for

22
00:01:13,180 --> 00:01:14,970
the resources that they
put into the network.

23
00:01:14,970 --> 00:01:19,800
Now if we were going to design
a new puzzle system from scratch or

24
00:01:19,800 --> 00:01:23,300
modify Bitcoin's puzzle system
to be different somehow.

25
00:01:23,300 --> 00:01:26,170
What else could we design
the puzzle to achieve?

26
00:01:26,170 --> 00:01:29,690
What other kinds of behaviors would we
like to encourage or disincentivize?

27
00:01:29,690 --> 00:01:32,740
In this lecture,

28
00:01:32,740 --> 00:01:36,730
we're going to talk about a variety of
possible alternative puzzle designs.

29
00:01:37,830 --> 00:01:41,750
Some of them are already used in
practice in altcoins existing today,

30
00:01:41,750 --> 00:01:45,250
others are research ideas that might
turn out to be used in the future.

31
00:01:46,950 --> 00:01:51,700
The puzzles that we'll look at can achieve
a variety of possible goals, such as ASIC

32
00:01:51,700 --> 00:01:55,440
resistance, which means leveling the
playing field between users with ordinary

33
00:01:55,440 --> 00:02:01,000
computing equipment and users with
special optimized custom hardware.

34
00:02:01,000 --> 00:02:05,960
We'll also look at puzzles that discourage
users from delegating their participation

35
00:02:05,960 --> 00:02:09,770
to directors of large centralized pools.

36
00:02:09,770 --> 00:02:13,899
And we'll look at useful proofs of work
that have some intrinsic social benefit.

37
00:02:16,200 --> 00:02:18,970
We'll also talk about some of
the essential security requirements for

38
00:02:18,970 --> 00:02:20,040
mining puzzles.

39
00:02:20,040 --> 00:02:24,100
It doesn't do any good to have some fancy
secondary feature if the puzzle doesn't

40
00:02:24,100 --> 00:02:28,570
still satisfy the basic requirements
that it needs to keep Bitcoin secure.

41
00:02:30,000 --> 00:02:33,720
Before going into the alternate puzzle
designs, let's talk a little bit about

42
00:02:33,720 --> 00:02:37,510
some of the essential requirements that
any viable mining puzzle has to satisfy.

43
00:02:38,810 --> 00:02:40,880
Now there are many possible requirements.

44
00:02:40,880 --> 00:02:43,060
We've talked about some of them before.

45
00:02:43,060 --> 00:02:46,950
Mining puzzles need to be cheap to verify
the solutions because every node on

46
00:02:46,950 --> 00:02:49,520
the network validates all
of the puzzle solutions.

47
00:02:49,520 --> 00:02:51,960
Even ones that aren't
involved in mining directly.

48
00:02:53,237 --> 00:02:56,105
Puzzles also have to have
adjustable difficulty so

49
00:02:56,105 --> 00:03:00,306
that the difficulty of the puzzle can
be adjusted over time as new users join

50
00:03:00,306 --> 00:03:03,990
the network with increasing
amounts of hash power contributed.

51
00:03:05,520 --> 00:03:08,800
Now, I'm going to talk in detail right
now about one other essential requirement

52
00:03:08,800 --> 00:03:10,750
which is a little bit subtle.

53
00:03:10,750 --> 00:03:14,350
This is that the chance of winning
a puzzle solution in any unit of time

54
00:03:14,350 --> 00:03:17,709
should be roughly proportional
to the hash power contributed.

55
00:03:19,220 --> 00:03:19,780
In particular,

56
00:03:19,780 --> 00:03:23,680
this means that really large miners with
very powerful hardware should only have

57
00:03:23,680 --> 00:03:28,250
a proportional advantage in being
the next miner to find a puzzle solution.

58
00:03:28,250 --> 00:03:31,150
Even small players should have
some proportional chance of

59
00:03:31,150 --> 00:03:33,477
being successful in
receiving compensation.

60
00:03:36,356 --> 00:03:37,818
Now to illustrate this point,

61
00:03:37,818 --> 00:03:41,709
let me show you an example of a bad puzzle
that doesn't satisfy this requirement.

62
00:03:43,320 --> 00:03:47,420
Consider a mining puzzle that takes
exactly N steps to find a solution.

63
00:03:47,420 --> 00:03:51,960
There are examples of puzzles like this so
I don't need to go into details though,

64
00:03:51,960 --> 00:03:53,920
but consider these
a sequential proof of work.

65
00:03:55,610 --> 00:03:59,500
A miner would be able to find one of these
proof of work solutions by computing

66
00:03:59,500 --> 00:04:02,490
N steps in order in a sequence.

67
00:04:02,490 --> 00:04:04,500
Once it reaches N steps,
it finds a solution.

68
00:04:07,020 --> 00:04:10,600
Now, the problem is that if it takes
exactly N steps in a sequence to find

69
00:04:10,600 --> 00:04:14,970
a puzzle solution, then the fastest miner
in the network will always be the one who

70
00:04:14,970 --> 00:04:17,130
wins the next reward, right?

71
00:04:17,130 --> 00:04:21,510
So consider a scenario with two equally
powerful miners and a third miner that's

72
00:04:21,510 --> 00:04:25,000
slightly faster at making computational
steps than the other two.

73
00:04:26,470 --> 00:04:30,900
For every step that the small miners take,
the large miner takes two steps here.

74
00:04:30,900 --> 00:04:35,530
This means that the large miner finds its
puzzle solution at the end of N steps,

75
00:04:35,530 --> 00:04:38,230
while the smaller miners
are still computing theirs.

76
00:04:39,280 --> 00:04:39,790
In this case,

77
00:04:39,790 --> 00:04:43,350
the fastest miner would be the only one
who would receive any compensation at all.

78
00:04:43,350 --> 00:04:46,240
Therefore, none of the other nodes would
have any incentive to participate in

79
00:04:46,240 --> 00:04:46,770
the first place.

80
00:04:48,770 --> 00:04:50,310
So the alternative to this,

81
00:04:50,310 --> 00:04:55,000
a good puzzle, is one that gives
every miner a chance of winning

82
00:04:55,000 --> 00:04:59,680
the next puzzle solution in proportion to
the amount of hash power they contribute.

83
00:04:59,680 --> 00:05:02,280
This forms a weighted sample
of all of the miners.

84
00:05:02,280 --> 00:05:04,793
So imagine throwing a dart
at a board randomly.

85
00:05:04,793 --> 00:05:07,120
At a board of different size targets,

86
00:05:07,120 --> 00:05:09,820
where the size of the target
corresponds to the mining power.

87
00:05:09,820 --> 00:05:12,620
The more hash power you contribute
the better your chance of

88
00:05:12,620 --> 00:05:15,170
being the node that finds
the next puzzle solution.

89
00:05:16,290 --> 00:05:18,944
A puzzle that has this property is
sometimes called progress-free.

90
00:05:21,220 --> 00:05:23,080
Now this was just one of the requirements.

91
00:05:23,080 --> 00:05:27,390
There are others, but for now, we're going
to move onto types of alternative puzzles.

92
00:05:27,390 --> 00:05:29,970
And we'll discuss essential
requirements as they come up.