Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block...
Transcript of Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block...
![Page 1: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/1.jpg)
Low-Variance Mining with Bobtail
– or – Why Variance is the Root of All Evil
College of Information & Computer Sciences
Brian Neil Levine
George Bissias and
![Page 2: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/2.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Overview• The variance of Bitcoin’s inter-block delay is more than an annoyance.
• It’s at the root of doublespend, selfish mining, and eclipse attacks.
• We propose a simple method of low-variance mining
• We evaluate its performance and show how it increases security
• We talk about consequences of deployment
![Page 3: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/3.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Problem Definition
5% of blocks take at least 30 minutes 80% of blocks are between 1–21 minutes
0 10 20 30 40 50 60 70 80 90 100 110
0
1000
2000
0 10 20 30 40 50 60 70
seconds per block (Ethereum)
minutes per block (Bitcoin)
coun
t
![Page 4: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/4.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Problem Definition0 5 10 15 20 25 30 35 40 45 50 55 60
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0 5 10 15 20 25 30 35 40
seconds per block (Ethereum)
minutes per block (Bitcoin)C
DF
0 10 20 30 40 50 60 70 80 90 100 110
0
1000
2000
0 10 20 30 40 50 60 70
seconds per block (Ethereum)
minutes per block (Bitcoin)
coun
t
5% of blocks take at least 30 minutes 80% of blocks are between 1–24 minutes
![Page 5: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/5.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Problem Definition0 5 10 15 20 25 30 35 40 45 50 55 60
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0 5 10 15 20 25 30 35 40
seconds per block (Ethereum)
minutes per block (Bitcoin)C
DF
0 10 20 30 40 50 60 70 80 90 100 110
0
1000
2000
0 10 20 30 40 50 60 70
seconds per block (Ethereum)
minutes per block (Bitcoin)
coun
t
5% of blocks take at least 30 minutes 80% of blocks are between 1–24 minutes
![Page 6: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/6.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Problem Definition0 5 10 15 20 25 30 35 40 45 50 55 60
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0 5 10 15 20 25 30 35 40
seconds per block (Ethereum)
minutes per block (Bitcoin)C
DF
0 10 20 30 40 50 60 70 80 90 100 110
0
1000
2000
0 10 20 30 40 50 60 70
seconds per block (Ethereum)
minutes per block (Bitcoin)
coun
t }5% of blocks take at least 30 minutes 80% of blocks are between 1–24 minutes
![Page 7: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/7.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Variance in PoW Mining• Inter-block time variance is due to
Proof of Work mining. • Each miner samples from a uniform
distribution • The first miner to find 1 sample below a
target wins.
• Until they pick a number that meets the target.
• When the network of miners get lucky, blocks come early.
• When the network of miners get very unlucky, blocks come late.
A
C D E
B
0 2256target
![Page 8: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/8.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Variance in PoW Mining• Inter-block time variance is due to
Proof of Work mining. • Each miner samples from a uniform
distribution • The first miner to find 1 sample below a
target wins.
• Until they pick a number that meets the target.
• When the network of miners get lucky, blocks come early.
• When the network of miners get very unlucky, blocks come late.
A
C D E
B
0 2256target
A B A
![Page 9: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/9.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Variance is the root of all evil• With low variance between blocks, blockchains would perform more consistently.
• Fast blocktimes are what some competitors have over Bitcoin. • Waiting 6 blocks to overcome fear of doublespend is a drag.
• Wouldn’t it be better if blocks almost always arrived within 7–12 minutes? • And if we were confident about waiting just 1 block?
• But variance is not just an inconvenience:
• High variance mining is the cause of low security in blockchains.
![Page 10: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/10.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Variance is the root of all evil• When you enter a casino, the house has the advantage.
• In expectation the house will win. • Your goal is to keep betting until you are ahead, and then exit. • This strategy is possible because you are taking advantage of variance • The house occasionally loses, possibly a few times in a row.
![Page 11: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/11.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Doublespend Attacks• Doublespend attacks are
a race between honest and attacking miners.
• Just like in the casino, there is a non-zero chance she’ll win.
• She’s waiting for either: • the honest miners to hit a
sequence of unlucky block discovery times
• for herself to hit a sequence of lucky block discovery times.
good evil
![Page 12: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/12.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Doublespend Attacks• Doublespend attacks are
a race between honest and attacking miners.
• Just like in the casino, there is a non-zero chance she’ll win.
• She’s waiting for either: • the honest miners to hit a
sequence of unlucky block discovery times
• for herself to hit a sequence of lucky block discovery times.
good evil
![Page 13: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/13.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Doublespend Attacks• Doublespend attacks are
a race between honest and attacking miners.
• Just like in the casino, there is a non-zero chance she’ll win.
• She’s waiting for either: • the honest miners to hit a
sequence of unlucky block discovery times
• for herself to hit a sequence of lucky block discovery times.
good evil
![Page 14: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/14.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Doublespend Attacks• Doublespend attacks are
a race between honest and attacking miners.
• Just like in the casino, there is a non-zero chance she’ll win.
• She’s waiting for either: • the honest miners to hit a
sequence of unlucky block discovery times
• for herself to hit a sequence of lucky block discovery times.
good evil
![Page 15: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/15.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Doublespend Attacks• Doublespend attacks are
a race between honest and attacking miners.
• Just like in the casino, there is a non-zero chance she’ll win.
• She’s waiting for either: • the honest miners to hit a
sequence of unlucky block discovery times
• for herself to hit a sequence of lucky block discovery times.
good evil
![Page 16: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/16.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Doublespend Attacks• Doublespend attacks are
a race between honest and attacking miners.
• Just like in the casino, there is a non-zero chance she’ll win.
• She’s waiting for either: • the honest miners to hit a
sequence of unlucky block discovery times
• for herself to hit a sequence of lucky block discovery times.
good evil
![Page 17: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/17.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Doublespend Attacks• Doublespend attacks are
a race between honest and attacking miners.
• Just like in the casino, there is a non-zero chance she’ll win.
• She’s waiting for either: • the honest miners to hit a
sequence of unlucky block discovery times
• for herself to hit a sequence of lucky block discovery times.
good evil
![Page 18: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/18.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Doublespend Attacks• Doublespend attacks are
a race between honest and attacking miners.
• Just like in the casino, there is a non-zero chance she’ll win.
• She’s waiting for either: • the honest miners to hit a
sequence of unlucky block discovery times
• for herself to hit a sequence of lucky block discovery times.
good evil
![Page 19: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/19.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Doublespend Attacks• Doublespend attacks are
a race between honest and attacking miners.
• Just like in the casino, there is a non-zero chance she’ll win.
• She’s waiting for either: • the honest miners to hit a
sequence of unlucky block discovery times
• for herself to hit a sequence of lucky block discovery times.
good evil
![Page 20: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/20.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Doublespend Attacks• Doublespend attacks are
a race between honest and attacking miners.
• Just like in the casino, there is a non-zero chance she’ll win.
• She’s waiting for either: • the honest miners to hit a
sequence of unlucky block discovery times
• for herself to hit a sequence of lucky block discovery times.
good evil
![Page 21: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/21.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 22: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/22.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 23: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/23.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 24: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/24.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 25: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/25.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 26: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/26.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 27: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/27.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 28: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/28.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 29: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/29.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 30: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/30.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 31: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/31.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining Attacks
good evil
• Selfish mining attacks have the same story.
• Several countries are considering launching blockchains
• Some countries are starting to not like them.
• What is the current defense against Nation/state-based SM attacks on a currency?
![Page 32: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/32.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining
0 2256
target
A
C D E
B
• Bobtail: the mean of the k-lowest samples must be below the target. • The samples come from all miners.
k = 4
![Page 33: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/33.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining
0 2256
target
A
C D E
B
• Bobtail: the mean of the k-lowest samples must be below the target. • The samples come from all miners.
k = 4
![Page 34: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/34.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining
0 2256
target
A
A
C D E
B
• Bobtail: the mean of the k-lowest samples must be below the target. • The samples come from all miners.
k = 4
![Page 35: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/35.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining
0 2256
target
A
A
C D E
B
• Bobtail: the mean of the k-lowest samples must be below the target. • The samples come from all miners.
Ak = 4
![Page 36: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/36.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining
0 2256
target
A A
A
C D E
B
• Bobtail: the mean of the k-lowest samples must be below the target. • The samples come from all miners.
Ak = 4
![Page 37: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/37.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining
0 2256
target
A A
A
C D E
B
• Bobtail: the mean of the k-lowest samples must be below the target. • The samples come from all miners.
ACk = 4
![Page 38: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/38.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining
0 2256
target
A A
A
C D E
B
• Bobtail: the mean of the k-lowest samples must be below the target. • The samples come from all miners.
ACk = 4
![Page 39: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/39.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining
0 2256
target
A B A
A
C D E
B
• Bobtail: the mean of the k-lowest samples must be below the target. • The samples come from all miners.
ACk = 4
![Page 40: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/40.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining
0 2256
target
A B AC
A
C D E
B
• Bobtail: the mean of the k-lowest samples must be below the target. • The samples come from all miners.
ACk = 4
![Page 41: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/41.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining
0 2256
target
A B AC
A
C D E
B
• Bobtail: the mean of the k-lowest samples must be below the target. • The samples come from all miners.
ACk = 4
![Page 42: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/42.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Reducing Variance in PoW Mining• Target is adjusted so there is no change in the expected number of samples.
• k can be raised or lowered from one block to the next without issues.
• This is basic applied statistics: • if you want a better estimate, take more samples. • Compared to Bitcoin, variance of inter-block time is reduced:
Reduction in variance:
![Page 43: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/43.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
0 10 20 30 40 50 60 70 80 90 100 110
0
1000
2000
0 10 20 30 40 50 60 70
seconds per block (Ethereum)
minutes per block (Bitcoin)
coun
t
0 5 10 15 20 25 30 35 40 45 50 55 60
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0 5 10 15 20 25 30 35 40
seconds per block (Ethereum)
minutes per block (Bitcoin)C
DF k
1
5
10
20
40
0 5 10 15 20 25 30 35 40 45 50 55 60
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0 5 10 15 20 25 30 35 40
seconds per block (Ethereum)
minutes per block (Bitcoin)C
DF
Problem Definition
5% of blocks take at least 30 minutes 80% of blocks are between 1–24 minutes
![Page 44: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/44.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
0 10 20 30 40 50 60 70 80 90 100 110
0
1000
2000
0 10 20 30 40 50 60 70
seconds per block (Ethereum)
minutes per block (Bitcoin)
coun
t
0 5 10 15 20 25 30 35 40 45 50 55 60
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0 5 10 15 20 25 30 35 40
seconds per block (Ethereum)
minutes per block (Bitcoin)C
DF k
1
5
10
20
40
Problem Definition
5% of blocks take at least 30 minutes 80% of blocks are between 1–24 minutes
k: 1k: 5
k: 10k: 20
k: 40
0 10 20 30 40 50 60 70 80 90 100 110
0 10 20 30 40 50 60 70
010002000
010002000
0100020003000
020004000
0200040006000
seconds per block (Ethereum)
minutes per block (Bitcoin)
coun
t
k1
10
20
40
5
![Page 45: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/45.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
k: 1k: 5
k: 10k: 20
k: 40
0 10 20 30 40 50 60 70 80 90 100 110
0 10 20 30 40 50 60 70
010002000
010002000
0100020003000
020004000
0200040006000
seconds per block (Ethereum)
minutes per block (Bitcoin)
coun
t
k1
10
20
40
5
0 5 10 15 20 25 30 35 40 45 50 55 60
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0 5 10 15 20 25 30 35 40
seconds per block (Ethereum)
minutes per block (Bitcoin)C
DF k
1
5
10
20
40
Problem Definition
5% of blocks take at least 30 minutes 80% of blocks are between 1–24 minutes
![Page 46: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/46.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Problem DefinitionFor Bitcoin now (k=1):
• Worst 5% of blocks take 30–70 minutes.
0 5 10 15 20 25 30 35 40 45 50 55 60
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0 5 10 15 20 25 30 35 40
seconds per block (Ethereum)
minutes per block (Bitcoin)
CD
F k1
5
10
20
40
![Page 47: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/47.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Problem DefinitionFor Bitcoin now (k=1):
• Worst 5% of blocks take 30–70 minutes.
• Middle 80% of blocks take 1–24 minutes.
0 5 10 15 20 25 30 35 40 45 50 55 60
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0 5 10 15 20 25 30 35 40
seconds per block (Ethereum)
minutes per block (Bitcoin)
CD
F k1
5
10
20
40}
![Page 48: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/48.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
}Problem Definition0 5 10 15 20 25 30 35 40 45 50 55 60
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0 5 10 15 20 25 30 35 40
seconds per block (Ethereum)
minutes per block (Bitcoin)
CD
F k1
5
10
20
40}
For k=40:
• Worst 5% of blocks take 13–18 minutes.
• eclipse attacks are trivial to detect.
• Middle 80% of blocks take 7–12 minutes.
![Page 49: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/49.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Increased Security: Doublespend
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
●●
●
●
●
●
●●
●
●
●
●
●●●
●
●
●
0%
10%
20%
30%
40%
50%
60%
70%
1 2 3 4 5 6 7 8 9 10k
Prob
of s
ucce
ssfu
l dou
ble
spen
d
attacker mining power●
●
●
●
●
●
0.10.2
0.30.4
0.450.49
Bitcoin
For Bitcoin now (k=1):
• A 20% miner has a 13% chance of doublespend at z=1 blocks.
• And 1% chance at z=6 blocks.
When k=5, the 20% miner at z=1 block is 1%.
z=1
![Page 50: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/50.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Increased Security: Doublespend
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
●●
●
●
●
●
●●
●
●
●
●
●●●
●
●
●
0%
10%
20%
30%
40%
50%
60%
70%
1 2 3 4 5 6 7 8 9 10k
Prob
of s
ucce
ssfu
l dou
ble
spen
d
attacker mining power●
●
●
●
●
●
0.10.2
0.30.4
0.450.49
Bitcoin
For Bitcoin now (k=1):
• A 20% miner has a 13% chance of doublespend at z=1 blocks.
• And 1% chance at z=6 blocks.
When k=5, the 20% miner at z=1 block is 1%.
z=1
![Page 51: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/51.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
• When k=40, Bitcoin double spending after z=1 blocks requires ~40% of the mining power to get above 1% chance of success.
• 50x improvement.
Doublespend for z=1 block
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
●●
●
●
●
●
●●
●
●
●
●
●●●
●
●
●
●●●
●
●
●
●●●
●
●
●
●●●
●
●
●
●●●
●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
0%
10%
20%
30%
40%
50%
60%
70%
0 10 20 30 40 50 60 70 80 90 100k
Prob
of s
ucce
ssfu
l dou
ble
spen
d
attacker mining power●
●
●
●
●
●
0.10.2
0.30.4
0.450.49
Bitcoin
z=1
![Page 52: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/52.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
• When k=40, Bitcoin double spending after z=1 blocks requires ~40% of the mining power to get above 1% chance of success.
• 50x improvement.
Doublespend for z=1 block
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
●●
●
●
●
●
●●
●
●
●
●
●●●
●
●
●
●●●
●
●
●
●●●
●
●
●
●●●
●
●
●
●●●
●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
●●●●
●
●
0%
10%
20%
30%
40%
50%
60%
70%
0 10 20 30 40 50 60 70 80 90 100k
Prob
of s
ucce
ssfu
l dou
ble
spen
d
attacker mining power●
●
●
●
●
●
0.10.2
0.30.4
0.450.49
Bitcoin
z=1
![Page 53: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/53.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
●
●
●
●
●
●
●
●
●
●
●
●●
● ●●
●
●
●
●
●
●
●
●
●●
● ● ● ●●
●
●
●
●
●
●
●
●
● ● ● ● ●●
●
●
●
●
●
●
●
● ● ● ● ● ● ●
●
●
●
●
●
●
● ● ● ● ● ● ● ●
●
●
●
●
●
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0.0 0.1 0.2 0.3 0.4 0.5attacker mining power
Prop
ortio
n of
blo
cks
on m
ain
chai
n k●
●
●
●
●
●
125102040
Selfish Mining can be eliminated • With Bitcoin, any amount of
mining power enables the attack.
![Page 54: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/54.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Selfish Mining can be eliminated • With Bitcoin, any amount of
mining power enables the attack.
• When k≥5, attackers need 43% of the mining power to selfish mine.
• When k≥20, attackers need 49% of the mining power to selfish mine.
• No other defense against DoS attacks are available.
• k can be adjusted on the fly.●
●
●
●
●
●
●
●
●
●
●
●●
● ●●
●
●
●
●
●
●
●
●
●●
● ● ● ●●
●
●
●
●
●
●
●
●
● ● ● ● ●●
●
●
●
●
●
●
●
● ● ● ● ● ● ●
●
●
●
●
●
●
● ● ● ● ● ● ● ●
●
●
●
●
●
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0.0 0.1 0.2 0.3 0.4 0.5attacker mining power
Prop
ortio
n of
blo
cks
on m
ain
chai
n k●
●
●
●
●
●
125102040
![Page 55: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/55.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Version 1 Deployment (Naive)• Naive version: miners simply announce block headers as they find them.
• Each new block on the chain is a collection of k full headers. • Instead of an 80-byte header, headers would be k*80 bytes.
• That’s 800B for k=10, and 3KB for k=40
• A lot of traffic as values are found. • But values greater than k*target will never be part of the block.
• Since headers can be stolen, no incentive for miners to share.
![Page 56: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/56.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Version 2 Deployment (no stealing)• Reward all miners who helped find the k values
• Miners collect transactions and create standard header, h.
• let v= Hash( Hash(h), prior, Address)• If v<kt, then miners announce the pre-image of 36 bytes• Recipients check if hash of pre-image is less than kt.
• Values cannot be stolen as Address is a part of the hash pre-image.
• Values cannot be reused since prior is part of the hash pre-image.
• Still: When a block is found, there are k-1 values that can be reused!
8Bytes of 8Bytes of
![Page 57: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/57.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Version 3 (no reuse of values)• To prevent this problem, we add another field to the
hash. • Miners keep track of the Least Order Stat they’ve seen to date • v= Hash( Hash(h), Address, Prior, LOS)• 8+20+8+8= 44 bytes per k• No values can be included in the LOS is lower than the
lowest OS. • Coinbase reward is via a ranking by LOS; ties are broken by v.
• Reduces the rewards for miners that attempt it. • This drastically reduces the opportunities for reuse. • This also thwarts hoarding among a collusion of miners.
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
Ethereum Bitcoin
5 6 7 8 9 10 5 6 7 8 9 100%
20%
40%
60%
80%
100%
120%
140%
160%
180%
Number of honest miners out of 10
Aver
age
perc
enta
ge o
f exp
ecte
d re
ward
(per
blo
ck) p
er m
iner
●
●
attacker
honest
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
Ethereum Bitcoin
5 6 7 8 9 10 5 6 7 8 9 100%
20%
40%
60%
80%
100%
120%
140%
160%
180%
Number of honest miners out of 10
Aver
age
perc
enta
ge o
f exp
ecte
d re
ward
(per
blo
ck) p
er m
iner
●
●
attacker
honest
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
Ethereum Bitcoin
5 6 7 8 9 10 5 6 7 8 9 100%
20%
40%
60%
80%
100%
120%
140%
160%
180%
Number of honest miners out of 10
Aver
age
perc
enta
ge o
f exp
ecte
d re
ward
(per
blo
ck) p
er m
iner
●
●
attacker
honest
![Page 58: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/58.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Rewardsk L.O.S. Proof Reward (BTC)
1 - 358325 11.9882020
2 358325 1217458 0.2827381
3 358325 1721868 0.1339286
4 358325 1777139 0.0632440
6 358325 1995396 0.0139509
8 358325 3621245 0.0030227
12 358325 4582015 0.0001308
14 358325 4781376 0.0000254
17 358325 7277279 0.0000018
k L.O.S. Proof Reward (BTC)9 1826037 3761724 0.0012788
11 1826037 4420661 0.000290615 1826037 6302668 0.000010918 1826037 7514262 0.000000719 1826037 7601030 0.00000025 3521660 1826037 0.0111607
13 3521660 4707122 0.00003637 3927808 3521660 0.0018601
20 3927808 7881560 0.000000110 6374495 3927808 0.000116316 9175814 6374495 0.0000009
![Page 59: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/59.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Proportional Rewards• Simulations show that
rewards are proportion to mining power
• Results are same as Bitcoin today.
●
●
●●
●
●
●
●●
●●
●●
●● ●
● ●●
● ● ●
●
●
●●
●
●
●
●●
●●
●
●
●●
●●
● ● ● ●●0%
2%4%6%8%10%12%14%16%18%
0 5 10 15 20miner
proportion
k●
●
140
![Page 60: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/60.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Frequently Asked Questions• Doesn’t this slow down the block announcements?
• Seen my Graphene presentation? • Each k value has an INV. • And can be stuffed into Bloom Filter and IBLT.
• Don’t the rich get richer? • No, that would be the case if we took the k-lowest values from each miner.
• What about existing ASICS? • Yes, I think maybe they can be used for this (possibly).
![Page 61: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/61.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Using existing ASICs• version (4)
• prior (32)
• merkle (32)
• time (4)
• nBits (4)
• nonce (4)
• version (4)
• address (20), and LOS (12)
• Hash(h)>> 24 (8), Prior>>24 (8), pad with 16 bytes of zeros
• nonce (4)
• kt bound
• nonce (4)
64 bits of nonce to play with
Header would be 56(k-1)+80 bytes
![Page 62: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/62.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Summary
k header (bytes)
coinbase(bytes)
equivalent to #TXNs
90% delay (minutes)
mining power needed for selfish
mining
mining power needed to
doublespend(2 blocks)
1 358325 -1 80 205 0 ½ – 40 0% 10%
5 256 345 1 3½ – 19 42% 20%
10 476 520 3 5 – 16½ 46% 25%
20 916 870 7 6½ – 14½ 49% 35%
40 1796 1570 14 7½ – 13 49.5% 40%
![Page 63: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/63.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Conclusion• Bobtail reduces inter-block time variance in PoW blockchains
• by generalizing target criterion to k values.
• Significantly increases difficulty of doublespend
• Effectively eliminates selfish mining
• Reward rate and orphan rate do not change.
• Secure against attacks
• Cost is very small in terms of bytes.
• Adjustable and incrementally deployable [email protected]
![Page 64: Low-Variance Mining with Bobtail - Scaling Bitcoin...• The variance of Bitcoin’s inter-block delay is more than an annoyance. • It’s at the root of doublespend, selfish mining,](https://reader034.fdocuments.us/reader034/viewer/2022042910/5f3fdcb5c732f476262f577c/html5/thumbnails/64.jpg)
U N I V E R S I T Y O F M A S S A C H U S E T T S A M H E R S T https://arxiv.org/abs/1709.08750
Conclusion• Bobtail reduces inter-block time variance in PoW blockchains
• by generalizing target criterion to k values.
• Significantly increases difficulty of doublespend
• Effectively eliminates selfish mining
• Reward rate and orphan rate do not change.
• Secure against attacks
• Cost is very small in terms of bytes.
• Adjustable and incrementally deployable
Bobtail