Indistinguishable Proofs of Work or Knowledge

Abstract

We introduce a new class of protocols called Proofs of Work or Knowledge (PoWorKs). In a PoWorK, a prover can convince a verifier that she has either performed work or that she possesses knowledge of a witness to a public statement without the verifier being able to distinguish which of the two has taken place. We formalize PoWorK in terms of three properties, completeness, f -soundness and indistinguishability (where f is a function that determines the tightness of the proof of work aspect) and present a construction that transforms 3-move HVZK protocols into 3-move public-coin PoWorKs. To formalize the work aspect in a PoWorK protocol we define cryptographic puzzles that adhere to certain uniformity conditions, which may also be of independent interest. We instantiate our puzzles in the random oracle (RO) model as well as via constructing "dense" versions of suitably hard one-way functions.We then showcase PoWorK protocols by presenting a number of applications. We first show how non-interactive PoWorKs can be used to reduce spam email by forcing users sending an e-mail to either prove to the mail server they are approved contacts of the recipient or to perform computational work. As opposed to previous approaches that applied proofs of work to this problem, our proposal of using PoWorKs is privacy-preserving as it hides the list of the receiver's approved contacts from the mail server. Our second application, shows how PoWorK can be used to compose cryptocurrencies that are based on proofs of work ("Bitcoin-like") with cryptocurrencies that are based on knowledge relations (these include cryptocurrencies that are based on "proof of stake", and others). The resulting PoWorK-based cryptocurrency inherits the robustness properties of the underlying two systems while PoWorK-indistinguishability ensures a uniform population of miners. Finally, we show that PoWorK protocols imply straight-line quasi-polynomial simulatable arguments of knowledge and based on our construction we obtain an efficient straight-line concurrent 3-move statistically quasi-polynomial simulatable argument of knowledge.

Regulating Storage Overhead in Existing PoW-based Blockchains

“…When we consider a function = id, we refer to the identity function. We adapt and extend the model from [3] to formalize the notion of PoW. Roughly speaking, a PoW system allows to generate cryptographic puzzles that are easy to generate, hard to solve, and whose potential solutions are easy to verify.…”

“…To generate a block, miners must find a block header that represents the solution of a PoW and include it (as well as the additional fields) into a new block, allowing any entity to verify the PoW. Upon successfully generating a block, a miner is granted a monetary reward (i.e., in the form of a coinbase transaction 3 that specifies the ID of the recipient of the reward). The resulting block is forwarded to all peers in the network, who can then check its correctness by verifying the hash computation.…”

“…In more detail, a mining pool sets between 1 and the blockchain's target difficulty (denoted in the sequel as pool target level). Subsequently, a share is assigned to 3 The coinbase contains on the one hand fixed information about the miner (so that the mining reward can be claimed afterwards) and also a field (typically of 100 bytes) that can be fully changed depending on the underlying mining pool protocol. 4 That is, the block contains correctly formed transactions that have not been previously spent, and has a correct PoW.…”

Blockchains: a Systematic Multivocal Literature Review

“…Rather than using computer power as a scarce resource to generate security, Proof of Stake uses the scarcity of the coin itself. Therefore nodes that participate in a PoS consensus protocol are more commonly referred to as forgers instead of miners [9,76].…”

Symmetrically and Asymmetrically Hard Cryptography

“…This concept can also be linked to the proof of work or knowledge presented in [BKZZ16]. It is a proof of work where a solution can be found in a more efficient way if a secret is known.…”