eip-1057: Proposal for a new Proof-of-Work algorithm

[ifdefelse]

proposal for a programmatic proof-of-work algorithm that is tuned for commodity hardware to minimize optimizations available for specialized ASICs

[ifdefelse]

Continued from:
ethereum/pm#40 (comment)

@fulldecent
Hash rate would not triple if ASICs are already deployed. There's no reason for existing ASICs not to already be mining.

I agree that forking often is bad. Moreover, unexpected forks are worse. If we need to wait for complaints first before detecting problems, that would be another thing that banks would frown upon.

I don't propose this as an independent fork, but rather as something that would be rolled in after much review, along with other worthwhile improvements. I propose this in the vein of buying time and promoting stability, so that we never need a unexpected urgent fork.

The greatest strength of Ethereum is its steady progress with highly effective community governance. TheDao was a heartening example rapid and effective community decision making in the face of a challenge. However, preempting a possible need for that kind of action again might be worthwhile. Preempting risks would seem like good governance.

[goobur]

I'm with @ifdefelse on this issue. ASICs currently being produced, this is a fact. While I do agree that, if we saw a large increase in hash power in a short amount of time, that would mean somebody would have created an ASIC with a that gave them significant advantage in terms of network hash rate, it is a logical fallacy to assume the inverse is true. You cannot assume that the lack of a short burst of increase in hash rate implies that there are no ASICs on the network (denying the antecedent). The natural intuition is that "if I have a large investment in ASICs, and the network can brick them, I should bring them online in such a way that the chance of them being detected is minimised".

You can see this almost exactly with XMR. Leading up to the PoW hard-fork (specifically over the past 6-8 months) there was a slight but steady incline in both difficulty and network hash rate. This made up for a greater than 4 fold increase in hash rate from late November/early December to April (5/6)th. What about after the hard fork? The network hash and difficulty have both dropped by over 50%. Algorithm implementation could cause some of the change in hash-rate, but not difficulty (and I doubt that much in hash rate). So what accounts for the 50%? It has to be someone with the inability or unwillingness to fork. ASICs are likely one component of that demographic.

If we were to fork, I wouldn't expect exactly the same behaviour, as the expected gain for an Eth ASIC is comparatively lower than it is for an Xmr ASIC (although there are rumblings of FPGA based miners for Cryptonight v7). I would, however, expect a significant drop in difficulty.

This is necessarily risky business for any company producing ASICs for chains or coins that claim to be ASIC resistant. You cannot trust that the hardware you're making is going to sell. This is likely why the E3, when it was originally announced, cost only $800 USD. When the last attempt at switching the PoW algorithm was shrugged off, the price steadily rose to $2150 USD. It makes sense that any company producing these would pre-mine, the risk/reward ratio is too high not too.

Of course Ethereum was only claimed to be ASIC "resistant" from the get go, which is fine (and will fully be achieved with PoS), but the development of this ASIC shows a weakness in Ethash that I've been concerned with for awhile. Ethash is too focused on being too memory hard and not much-hard anything else. Keccak is easy to implement in software (except for some grumbles I have with the state size) and even easier in hardware. Up until now, this has been fine, and has worked fairly well to ensure that mining Ethereum is fairly egalitarian. This ASIC (and the ASICs coming for other memory hard algorithms) show memory hardness itself is not enough. The next logical step is in PoW design is to design an algorithm does the one thing that ASICs are bad at, change. This proposal at least attempts to do this, and I'm fully supportive of it (I would like it to be reviewed by more people though, and it needs some more thought put into how its byte code is executed/interpreted). Some of these ideas will be part of ASIC resistant PoW in the future, if not in Etherem, then in some other coin.

I think that the eventual move to PoS has investors placated to the point where this weakness doesn't bother them, since there's no immediate obvious threat. The lack of an obvious threat is how most accidents happen -- this is why preventative maintenance exists. We have more control over "now" than we do over the future. It's important to remember that we are still a PoW coin, so PoW issues should concern us until we switch to PoS. This is, at the very least, something that should shoud be discussed, and not shrugged off as it has been up until now.

[Arachnid]

Please format as per EIP-X and EIP-1: Headers should be in lowercase, and empty headers should be omitted.

[ifdefelse]

Thanks. Fixed.

[Arachnid]

Please either use "Real Name (@username)" or "Real Name " format, and separate with commas.

[Arachnid]

This should be "Standards Track".

[fulldecent]

The usage of ASICs in the Ethereum network is not specifically bad. Only concentration of mining is bad.

More specifically: only concentration of mining power that is specifically used to perform bad actions is bad.

[ifdefelse]

While 100% true, that doesn't capture the nature of the issue.

To use a slightly inaccurate analogy: It's like saying a proliferation of opiates isn't bad, only their misuse is bad.

ASICs drive natural centralizing and monopolistic tendencies: 1. Only those specifically motivated to participate in PoW coin economics will have them, thus there will be less natural distribution and no reserve capacity of hash power. 2. Not only do economics (economy of scale and leader advantage) drive producers to converge to standard pareto distribution for market ownership, it further drives these producers to leverage their disproportionate ownership to control and stabilize the market for themselves as the direction of coin development affects their livelihood.

This proposal is trying to allow Ethereum to develop as independently from naturally vested interests as possible.

[fulldecent]

That analogy is contrived.

The availability of ASICs does not necessarily lead to a centralization of mining. In fact, the demonstrated success of an ASIC miner would lead to demand for a new entrant into the market to make a second ASIC.

[ifdefelse]

Yes, a bit contrived. Meant to show that psychology and economic incentives are important. Perhaps did a poor job there.

More entrants into the market doesn't imply that producers would split the market such that no player has a majority. In fact, dominance tends to be a more stable steady state in markets as mature markets consolidate.

Even if share is split more evenly, collusion is also a natural tendency as producers try to maximize returns, preserve producer livelihood and improve market stability. See memory or oil markets.

[ifdefelse]

fixed.

[ifdefelse]

Thanks. Fixed.

[ifdefelse]

@Arachnid, sorry about the screwed up formatting. Thanks for pointing that out. I should have paid more attention. When you get a chance, would you take another look?

[goobur]

@fulldecent I think that the statement "the demonstrated success of an ASIC miner would lead to demand for a new entrant into the market to make a second ASIC" is ignorant to the fact that it takes a lot of capital and capable engineers and time to create an ASIC. It would take a minimum of 6 months for a new entrant to produce a chip (and at that rate, it would be fairly expensive) add on a few more months for design, verification, assembly, shipping. Plus a lot of talented people, plus a lot of money. I'd say it would be at least a year before another ASIC could even make it into the hands of miners. How close will we be to PoS by then?

Even if it could happen, then we have an oligopoly and I fail to see how this is any better than a monopoly. Oligopolies can and /do/ conspire to do illegitimate things (see, for example, the lawsuits against DRAM price fixing.) More players in the game does not guarantee that they can't conspire together (as @ifdefelse said).

You also can't assume that the ASICs would be equally distributed among the populous of willing miners. It's much easier, cheaper and faster to get Ant miners in China compared to the Americas (Bitmain also often has restrictions on where they'll ship to in certain batches). Compare this to GPUs which are more readily available over the counter at retail stores around the world. Moreover, postal services in developing nations have been known to steal packages containing mining equipment and other valuable electronic gear. The distribution channel for ASICs is nowhere near as robust and mature as it is for commodity hardware, and this necessarily creates an unlevel playing field for miners.

I also don't agree with the argument that improving ASIC resistance would be "a change [that] would be a distraction to the normal course of business now". I'm sure there are plenty of developers that would be interested in working on improved ASIC resistance -- whereas the people who are interested in the "normal course of business" can continue with the "normal course of business".

[ifdefelse]

@Arachnid Anything else required on my end for a pull acceptance?

[Arachnid]

I'm happy to merge this as a draft, but note that if you want it to progress beyond that, you will need to actually specify the algorithm in the EIP, not just describe its high-level attributes.

[thunder02dragon]

https://blog.sia.tech/the-state-of-cryptocurrency-mining-538004a37f9b
Just for some thoughts so that we can consider something what is inevitable

[sulmone]

Is there a performance penalty for proof of work verification?

[cryptomined]

I vote For implementation, For changing algo from Ethash to ProgPOW.
Equal playground is ideal.

[RadixPi]

Is there a performance penalty for proof of work verification?

Each of the loop iterations reads twice as much data (256 bytes instead of 128 bytes), so verification will take nominally twice as long. If that's an issue the loop count could be dropped from 64 to 32, resulting in roughly the same verification time as Ethash.

All the random math will take much less time than either calculating (light client) or accessing (mining client) the DAG, so shouldn't effect verification time.

[ghost]

lol bitmain will crack this in under a month

[Miner356]

I vote for Implementation for Changing algo to ProgPOW

[thunder02dragon]

I vote for implementing change of algo to ProgPOW.

[solardiz]

FWIW, I pre-reviewed the pre-proposal of ProgPoW to Zcash and got some helpful answers from its designers here: ZcashFoundation/GrantProposals-2018Q2#15

I also created another issue with my own thoughts/pre-proposal on possible Zcash PoW change, which may be partially applicable to Ethereum too: ZcashFoundation/GrantProposals-2018Q2#25 (summary: realistically and long-term, we'd have to target the 2x to 10x range of ASIC advantage over GPUs)

[reiddean]

I vote For implementation, For changing algo from Ethash to ProgPOW.

[abrahamjuliot]

Same -- I vote "Yes" to change algo from Ethash to ProgPOW.

[woodaxed]

yes implement

[ghost]

I Vote Yes for ProgPOW

[ArcaneAlexander]

I vote NO. See https://medium.com/@alex_6580/disclosure-my-name-is-alexander-levin-jr-president-of-gpushack-com-60e5543ef6ef

[Arachnid]

Please take discussion to the permanent discussion URL.