Proofs of Space

Abstract

Abstract. Proofs of work (PoW) have been suggested by Dwork and Naor (Crypto'92) as protection to a shared resource. The basic idea is to ask the service requestor to dedicate some non-trivial amount of computational work to every request. The original applications included prevention of spam and protection against denial of service attacks. More recently, PoWs have been used to prevent double spending in the Bitcoin digital currency system. In this work, we put forward an alternative concept for PoWs -so-called proofs of space (PoS), where a service requestor must dedicate a significant amount of disk space as opposed to computation. We construct secure PoS schemes in the random oracle model (with one additional mild assumption required for the proof to go through), using graphs with high "pebbling complexity" and Merkle hash-trees. We discuss some applications, including follow-up work where a decentralized digital currency scheme called Spacecoin is constructed that uses PoS (instead of wasteful PoW like in Bitcoin) to prevent double spending. The main technical contribution of this work is the construction of (directed, loop-free) graphs on N vertices with in-degree O(log log N ) such that even if one places Θ(N ) pebbles on the nodes of the graph, there's a constant fraction of nodes that needs Θ(N ) steps to be pebbled (where in every step one can put a pebble on a node if all its parents have a pebble).

Proofs of Space: When Space Is of the Essence

“…However, there are two main differences between our work and [16] that make their work quite compelling:…”

“…Their original construction generalizes the hash-based PoW of Cash [6] and does not employ the pebbling framework of [15] (cf. Appendix A of [16]). A major overhaul version of their paper later appeared on the IACR Crypto Eprint repository [16], along with ours [3].…”

“…Appendix A of [16]). A major overhaul version of their paper later appeared on the IACR Crypto Eprint repository [16], along with ours [3]. Their new version does use pebbling and adopts techniques similar to ours.…”

“…The definition of proof of space in [16] is stronger in that it allows a two-stage protocol. The first stage can be executed once while the second stage can potentially be executed many times after the first.…”

Equihash: Asymmetric Proof-of-Work Based on the Generalized Birthday Problem

“…The first one by Dziembowski et al [23] suggests an interactive protocol, called a proof-of-space, where the prover first computes a memory-hard function and then a verifier requests a subset of memory locations to check whether they have been filled by a proper function. The verification can thus be rather quick.…”