1. Ari Juels RSA Laboratories Proofs of Work (POWs) and Bread Pudding Protocols with Markus Jakobsson Bell Laboratories

2. Cryptography: About proofs of mathematical relations w = g e c s = cx +e g s =y c w? ProverVerifier

3. Some proofs Proof of Identity = Cryptographic Authentication Protocol

4. Some proofs Proof of Authorization (Signed Document) = Digital signature

5. Proof of work? We can make precise in cryptographic world 1 ounce sweat = 1 hour of work

6. Proof of work (POW) ProverVerifier Query Response Prover did at least 10 6 cycles of work

7. Example of a POW (Hash inversion) ProverVerifier t = h(s) [k bits] Prover computed an expected 2 k-1 hashes random secret s s

8. What are POWs good for? u Spam deterrent (DN94), “Hash cash” u Defense against denial-of-service attacks (JB99) Service Request

9. What are POWs good for? u Benchmarking Server Query Response Client

10. Formal notion of POW

11. Breadpudding u Idea: Re-use the ``stale’’ computation in a POW to perform useful task u Achieve privacy in useful task u Example: Hash inversion POW for distributed MicroMint

13. MicroMint Want a scheme that mimics economics of physical mint u Verifying validity of a coin is easy u Base minting cost is high so... u Forgery is expensive

14. The minting process 1. Throw balls into bins using “random” function h 2. Any bin with two balls is a coin

15. Minting in MicroMint Bin 1 Bin 2 Bin 3 Bin 4 Bin 5 Bin 6 Bin 7 Bin 8 Bin 9 Collision = Coin h

16. Checking a coin Bin 2 h Valid coin?

17. Features u Many bins, so need to throw many balls to mint successfully u Minting requires very intensive computation

18. Minting requires special, e.g., $250,000 computer “Deep Crack”

19. Another characteristic: Most balls are invalid Bin 1 Bin 2 Bin 3 Bin 4 Bin 5 Bin 6 Bin 7 Bin 8 Bin 9 h In fact, >99% of work goes to missed balls!

20. Idea: Make three stage process 1. Create “valid” balls, i.e., balls that won’t miss (>99% of work) 2. Throw balls into bins using “random” function h (<1% of work) 3. Any bin with two balls is a coin

21. Have many other (untrusted) people do Step 1

22. Now... u 99%+ of work is done for minter u No participant will get enough balls to do minting himself/herself ( or else participants know “validity” h but not “throwing” h ) u Minting is cheap for minter!

23. Minter can use ordinary server

24. Questions? + ?