1. Proofs of Space Stefan Dziembowski Symposium on the Work of Ivan Damgård April 1, 2016, Aarhus, Denmark Sebastian Faust Vladimir Kolmogorov Krzysztof Pietrzak

2. General idea We introduce Proofs of Space – a type of a “proof of effort”, where the “effort” is measured in terms of “wasted memory” (an alternative to Proofs of Work). We introduce Proofs of Space – a type of a “proof of effort”, where the “effort” is measured in terms of “wasted memory” (an alternative to Proofs of Work).

3. Proofs of Work – a tool for dealing with the Sybil attacks Sybil attack example: 1 identity many identities

4. Proofs of work Introduced by Dwork and Naor [Crypto 1992] as a countermeasure against spam. Basic idea: Force users to do some computational work: solve a moderately difficult “puzzle” (checking correctness of the solution has to be fast)

5. How are the PoWs used? verifer prover fast slow

6. Applications of PoWs 1.Cloud computing services 2.Preventing denial of service attacks 3.Cryptocurrencies...

7. How to measure computational difficulty? Original method of Dwork and Naor: number of computing steps. Some later works [ABW03, DGN03, DNW05]: number of times the memory is accessed.

8. A drawback of PoW systems costs money bad for environment 1. high energy consumption 2.advantage for people with dedicated hardware

9. What to do? This problem seems unavoidable: The only way to prove that one “invested a lot of computing power” is to do a lot of computation. What is the other resource that we could use? Proofs of Space (PoS): instead of CPU use disk space!

10. Example of an application Goal: prevent malicious users from opening lots of fake accounts. Method: force each account owner to “waste” large part of his local space. Important: the space needs to be allocated as long as the user uses the service. cloud computing service (e.g. email system)

11. Main difference from PoWs To prove that one wasted n CPU cycles one needs to perform these cycles. while: To prove that one wasted n bytes one does not need touch all of them.

12. Advantages more energy-efficient no “hardware acceleration” cheaper (user can devote their unused disk space)

13. The security definition

14. How to measure time and space

15. verify prove R R... prove verify prover’s memory verifer prover

16. How to define security of a PoS Properties: completeness, soundness, and efficiency. If the prover is honest then the verifier will always accept the proof. less trivial to define

17. How to define the efficiency? Let us show a very simple (but not efficient) PoS. Note: we have not defined the security yet, so it’s just an “informal example”.

18. A “trivial PoS” R R random

19. Efficiency verifierprover We require that the computing time of the parties is as follows:

20. How to define soundness? Informally: we want to force a cheating prover to constantly waste a lot of memory.

21. What would be the goal of a cheating prover? verify prove... Init(Id) proof verify prove

22. Observation: a cheating prover has a simple (but inefficient) winning strategy. Init(Id) X X answer by simulating expand by simulating R R proof X X Moral: we need to restrict the power of a cheating prover. Moral: we need to restrict the power of a cheating prover.

23. Restrictions on cheating prover

24. In our paper:

25. Security definition P()

26. The constructions

27. Why is constructing the PoS schemes non- trivial? Time-memory tradeoffs  R R X X R R For example:

28. Our main technique 1 1 2 2 3 3 4 4 5 5

29. Very informally A graph that is bad if it can be “quickly” labeled if one stores a “small” number of labels. Example of a bad graph: 1 1 2 2 3 3 N N

30. Our tools

31. How to build a PoS from a good graph?

32. C C

34. Our results

35. Spacemint A natural question: how to construct a cryptocurrency based on PoS. Not trivial... A recent paper: Park, Pietrzak, Kwon, Alwen, Fuchsbauer, and Gazi: SpaceMint: A Cryptocurrency Based on Proofs of Space. Cryptology ePrint Archive: Report 2015/528

36. Previous/related/independent work Graph pebbling in context of the Proofs of Work: introduced by Dwork, Naor, and Wee: Pebbling and proofs of work, 2005. Proofs of Secure Erasure introduced by Perito and Tsudik, 2010 other constructions: Karvelas and Kiayias, 2014, and Ateniese, Bonacina, Faonio, and Galesi, 2014. Similar graph techniques (in a context of leakage-resilient crypto): Smith and Zhang, Eprint 2013. A recent paper: Ling Ren and Srinivas Devadas Proof of Space from Stacked Bipartite Graphs, Eprint 2016 weaker notion than the Proofs of Space. Main difference with: lack of two phases. Called “Proofs of Space” there.

37. Thank you!