►
Description
We're back from the New York Blockchain Week where we interviewed over 5 new whiteboard sessions.
First up, we had Tal Moran from Spacemesh (https://twitter.com/teamspacemesh) speaking with Alex Skidanov (https://twitter.com/AlexSkidanov) on the 18th Episode of our Whiteboard Series.
More about Spacemesh: https://spacemesh.io/
Location: Distributed Global, New York, NY | Consensus Week 2019
Download the video here: https://near.ai/1ef3d
------- About Whiteboard Series ---------
The Whiteboard Series with NEAR is a set of video interviews with Founders who are building scalable solutions for Blockchain. We deep dive into their story, what they're developing and how it is helping the ecosystem.
Follow the latest from NEAR Protocol on,
Discord: https://near.ai/discord
Medium: https://near.ai/medium
Twitter: https://near.ai/twitter
GitHub: https://near.ai/github
#WhiteboardSeries #FutureIsNEAR #Consensus2019
A
B
B
Right
so
a
nakamoto's
blockchain
protocol
basic.
Has
this
inherent
scalability
limit?
You
can't
get
it's
not
what
it
is
right
now,
so
that
seven
transactions
per
second
is
below
the
sort
of
inherent
limit,
but
you
still,
you
cannot
scale
it
as
far
as
you'd
like
to
do
the
way
the
protocol
is
built
so
want
to
try
to
deal
with
that.
B
B
There's
a
problem
of
energy
costs
right
and
specifically,
when
we
talk
about
proof-of-work,
it's
horrible
right,
it's
it's
great
in
terms
of
like
it's
a
nice
idea,
you
can
verify
it.
It
has
lots
of
good
properties,
but
energy
cost
is
not
one
of
the
good
properties
and
that's
also
inherent
you
can't
make
it
more
efficient
to
get
lower
she
costs,
and
not
only
is
it
bad
for
the
environment,
which
is
already
quite
a
bad
thing.
It's
also
expensive
right.
B
The
system
has
to
support
itself,
which
means
the
higher
the
cost
of
mining
the
higher
the
transaction
fees
have
to
be
so.
These
are
all
three
things.
I
want
to
talk
about
then
there's
the
issue
of
fairness,
which
these
are
all
sort
of
interconnected
and
by
fairness.
There
are
several
things
here,
I
think
maybe
the
thing
that
is
the
most
annoying
right.
B
If
I
want
to
join
Bitcoin
now,
I
can't
actually
use
my
home
computer
to
mine,
it's
just
totally
impractical
and
unprofitable,
and
it
it
cost
so
much
and
I
have
to
wait
so
long
until
I
get
it.
It's
just
there's
no
way
for
me
to
join
unless
I'm
willing
to
actually
spend
a
lot
of
money
and
there's
this
giant
difference,
orders
of
magnitude
difference
in
terms
of
how
much
it
costs
me.
B
Mine,
is
sort
of
a
small
user
versus
how
much
it
cost
me
to
mind.
If
I
have
enough
capital
to
buy,
you
know
an
ASIC
if
I
can
locate
a
factory
in
a
country
with
low
electricity
costs
and
low
cooling
cost
things
like
that.
So
these
are
the
issues
that
were
trying
to
deal
with
by
redesigning
the
core
protocol.
So
what
are
the
things
that
space
mesh
does,
or
maybe
before
we
get
to
that?
Let
me
say
one
word
about
security
right,
the
whole
point
of
a
cryptocurrency.
B
B
So
even
you
forget
about
the
implementation
problems,
which
is
a
whole
issue
of
itself
right,
so
even
protocol,
though
the
math
is
good,
the
implementation
can
be
bad,
but
just
getting
you
know
this
assurance
that
we're
running
a
protocol
that
works-
that's
not
easy
and
I
think
any
modern
photographer
won't
really
trust
the
protocol.
Unless
it
has
a
security
proof
now,
security
proof
doesn't
say
no.
This
protocol
is
secure.
We
don't
know
how
to
do
that.
B
Unfortunately,
what
we
do
with
the
security
proof
is
reduce
this
protocol
that
the
security
of
the
protocol
from
something
like
trust
me.
This
is
a
good
protocol
or
you
know,
I've
tried
to
break
it
and
I
can't,
which
is
not
a
very
you,
know,
confident,
inspiring
assertion
to
a
small
set
of
assumptions
that
ideally
have
been
studied
for
a
long
time
by
very
many
people,
and-
and
we
can
be
much
more
confident
and
then
you
get
a
statement
of
the
form.
B
If
these
assumptions
are
true,
then
mathematically
we
can
prove
that
the
whole
protocol
is
secure
and
it
gets
us
these
nice
guarantees
and
again
we
have
to
say
formally
exactly
what
we
mean
and
I
think
in
in
crypto
currencies
at
least
personally
I
would
not
trust
any
protocol
that
doesn't
have
this
form
of
a
security
proof,
because
history
has
taught
us
that
you
know
when
you
design
a
system.
Even
if
you
do
have
a
proof,
it
might
not
be
secure,
but
if
you
don't
have
one,
it's
almost
invariably
broken
in
some
way.
B
B
So,
in
fact,
if
we
want
to
get
consensus
when
there
is
a
malicious
adversary,
there
is
this
mathematical
proof
from
the
70s,
basically
that
we
have
to
have
enormous
majority
and
the
what
they
said
in
the
70s
or
you
need
to
prove.
We
can
prove
that
it's
impossible
that
anonymous
majority,
and
this
is
why
it
seems
so
impossible
to
get
this
type
of
cryptocurrency
on
the
internet.
Where
you
know
anybody
can
come
up
with
as
many
identities
as
they
want
right
and
then
they
they
can't.
B
B
What
is
the
proof
of
space-time?
It's
a
proof
that
I
stored
some
data
on
my
disk.
Basically
I
used
part
of
my
disk
space
for
a
period
of
time,
slightly,
similarly
to
proof
of
work,
I'm
not
doing
anything
useful
with
my
disk
space
right,
I'm,
storing
junk
on
it,
but
I
can't
use
that
part
of
the
disk
for
anything
else,
and
why
that
space-time?
B
So
that's
one
one
change
that
space
measure
does
we
want
to
replace
proof
of
work
with
proof
of
space-time?
This
has
two
effects.
Well,
it
has
more
than
two,
but
you
know
two
important
ones
in
terms
of
of
this
one:
okay,
we
got
rid
of
the
energy
costs.
Why?
Because
storing
things
on
a
disk
doesn't
cost
energy,
we
can
just
keep
the
computer
even
turned
off
right
and
the
the
disk
just
doesn't
take
up
energy.
Okay.
This
is
everything
I'm
going
to
say.
Has
me
with
this
little
caveat.
B
B
B
I
just
used
work
and
the
whole
point
is
we
don't
want
people
to
use
work,
so
we
want
to
make
it
a
rational
choice
to
actually
keep
things
on
your
disk
and
in
order
to
do
that,
we
make
it
expensive
to
initialize,
so
basically
you're
doing
an
initial
proof
of
work
in
order
to
initialize
this
disk
space
and
after
that,
you
just
prove
that
you're
still
holding
it.
So
in
theory,
you
could
always
just
erase
it
and
then
redo
the
initialization,
but
that
costs
you
the
proof
of
work
money
right.
B
So
it's
expensive
to
do
that,
and
it's
going
to
be
much
cheaper
to
store
it
for
the
period
of
time.
We're
asking
you
to
store
it
for
so.
Basically,
there
is
some
initial
energy
costs,
but
if
you
amortize
it
over
the
time
you're
going
to
be
using
the
storage,
then
it's
sort
of
arbitrarily
close
to
zero.
Okay.
B
So
this
is
said,
one
thing
is:
gets
rid
of
energy
cause
a
second
thing:
for
how
long
do
you
usually
store
something
on
the
deal
so
again,
the
final
parameters
aren't
completely
fixed
or
like
a
lot
of
knobs
that
you
can
tune
and
part
of
what
we're
going
to
be
doing
in
test
net.
Is
you
know,
fixing
these
parameters?
The
current
parameter
is
set
to
something
like
two
weeks
yeah,
so
every
two
weeks,
you're
going
to
have
to
prove
that
you're
still
storing
this
data,
so
this
also
has
to
do
with
fairness.
Why?
B
Because,
first
of
all
there
aren't
these
orders
of
magnitude.
Differences
in
costs
between
you
know
discs
that
I
buy
as
a
consumer
and
discs
that
say
somebody
who
has
a
lot
of
capital
combined,
it's
not
to
say
there
aren't
differences.
Amazon
can
buy
discs
for
a
lot
cheaper
than
I
can
buy.
But
it's
not.
You
know
three
orders
of
magnitude
difference,
but
the
main
thing
here
is
that
if
I
already
bought
a
disk
and
a
lot
of
people,
you
know
have
reasonably,
you
know
powerful
computers.
They
come
with.
B
You
know
two
terabyte
four
terabyte
disks
and
they
use
very
little
of
it.
So
if
I
already
bought
the
disk
for
a
different
purpose
and
I
have
it
at
home
and
there's
you
know
two
terabytes
sitting
unused
the
marginal
cost
for
me
to
fill
up.
This
two
terabytes
is
actually
much
less
than
Amazon's
cost
to
buy
a
new
disc.
B
So
if
I'm
doing
something
trying
to
you
know
mine
at
scale,
then
my
cost
is
going
to
be
the
cost
of
discs
and
as
a
home
user,
it's
going
to
be
harder
for
me
to
compete
with
that.
But
if
I'm,
a
small
user
and
I
just
want
to
use
my
left
over
space,
then
Amazon
can't
compete
with
me,
because
my
marginal
cost
is
basically
zero
and
basically
what
we
are
hoping
this
has
is
the
effect
of
generating
a
very
long
tail
of
users.
B
So,
instead
of
having
this
problem,
where
you
know
once
big
parties,
big
players
come
in,
then
the
small
players
are
pushed
out
they're
priced
out
because
they
can't
compete
anymore.
We
can
have
big
players
and
small
players
coexisting.
So
it's
a
fair
distribution.
We
can
have
this
sort
of
long
tail
and
ideally
we'd
have
you
know
some
big
players,
but
many
many
many
small
players
so
that
the
some
of
the
space
contributed
by
small
players
is
actually
in
the
majority
right.
B
This
is
the
ideal
we're
not
completely
sure
that
this
will
work
out,
but
you
know
the
protocol
obviously
doesn't
care
about
how
the
distribution
looks
as
long
as
it's
sort
of
distributed
enough.
Now,
why
do
we
care
that
it's
distributed
enough?
Let's
go
to
the
honest
majority
assumption
right.
So
our
assumption,
instead
of
assuming
there's
an
honest
majority
of
CPU
space
of
CPU
power,
we're
assuming
that
the
majority
of
the
space,
the
disk
space
is
controlled
by
honest
parties
and
having
this
long
tail
makes
this
a
lot
more
reasonable
right.
B
If
you
have
only
five
parties
controlling
you
know,
60%
of
the
resources,
then
it's
a
bit
iffy
to
say:
yeah,
we
ABB's,
we
trust
our
trillion
dollar
economy
on
the
fact
that
there
aren't
three
of
them
that
are
colluding
to
do
something
bad.
But
if
you
have
no
800,000
people
controlling
this,
it
seems
a
lot
more
reasonable.
Yep.
A
A
So
I
feel
today,
for
example,
has
15,000
full
nodes,
not
just
mining
nodes,
but
it's
like
everybody
who
has
a
full,
fully
sink
state
right.
So
let's
say
spaceman
spaceman
has
the
same
order
of
magnitude.
That
means
that
the
malicious
actor
needs
to
have
on
the
order
of
15
petabytes
right
of
space,
so
we're
hoping.
B
Actually
for
like
in
order
to
have
magnitude
more
miners
than
this
and
I
think
part
of
this
is
it
so
a
full
node
is
something
that
sort
of
not
really
rewarded
right.
If
you're,
not
mining,
it's
it's
like
you're
contributing
things
to
the
network.
It's
already
amazing
that
you
have
that
many
full
nodes,
and
you
know
not
that
many
miners
right
the
people
actually
like
to
contribute
here,
but
in
our
case
it's
actually
going
to
be
a
lot
easier
to
get
in
as
a
miner
right
and
I.
B
The
the
other
thing
that
connects
fairness
to
security
is
something
we
call
incentive
compatibility
which
is.
Is
it
actually
rational
to
follow
the
protocol
instructions
right
when
the
protocol
says
do
this?
Is
it
you're
in
your
best
interest
to
actually
do
that,
and
why
is
this
very
important,
because
when
you
say
we
have
an
honest
majority,
that's
an
assumption,
but
what
we
were
saying
is
people
behave
honestly,
but
if
it's
actually
better
like
personally
for
me
to
behave
dishonestly
I
get
more
money
by
doing
something
bad.
B
Is
it
reasonable
to
assume
that
actually,
a
majority
of
the
people
will
behave
honestly
and
I?
Think
in
the
cryptocurrency
sit
it's
not
very
reasonable.
It's
much
more
reasonable
to
assume
that
people
behave
rationally,
though
everybody
will
do
something,
that's
in
their
best
interest,
and
so
what
you
want
to
prove
for
this
type
of
protocol
is
that
doing
whatever
is
in
your
best
interest.
Actually
is
the
honest
protocol,
you
don't
you
don't
lose
by
following
the
honest
protocol,
or
at
least
you
know
you
can't.
Maybe
you
lose
a
tiny
bit,
but
you
won't
be.
B
B
So,
first
of
all,
you
know,
even
though
there
is
this
attack
on
Bitcoin,
we
don't
see
people
doing
it
so
there
there
are
sort
of
you
know
other
orders
of
magnitude
to
play.
Maybe
people
think
that
you
know
if
they
attack
the
system
this
way
they
might
get
more.
You
know
in
the
near
term,
but
then
the
whole
Bitcoin
thing
will
crash
and
they
won't
get
sorry.
You
know
there
are
other
factors,
but
but.
B
Yes,
but
you
know
some
tools
have
the
Samara,
so
in
theory
there
are
entities
that
could
launch
these
attacks
and
right
now
they're.
Not,
but
you
know,
do
you
want
to
trust
your
system
to
sort
of
the
goodwill
of
the
people?
It's
it's
not
going
to
be
clear,
it's
much
much
better
if
you
can
actually
prove
that
it's
instead
of
compatible,
so
one
of
the
things
we
want
to
do
is
show
that
our
system
is
incentive
compatible.
B
This
is
one
of
that
so
Guiding
motivations
when
developing
space
mesh
okay,
so
now
maybe
we'll
dive
in
a
little
bit
into
the
the
core
of
the
protocol.
So
we
said
one
change
we
made
was
we
replaced
as
proof
of
work
with
proof
of
space-time.
The
other
big
change
we
made.
Is
we
replaced
chain
with
a
mesh?
B
B
B
B
What
we
want
is
for
these
blocks
to
be,
in
some
sense
symmetric,
so
there's
no
one
special
block,
that
is
the
leader
and
we
use
that
block,
but
there's
a
set
of
blocks
all
the
honest
blocks.
If
you're
supposed
to
generate
a
block
in
layer
11,
then
your
block
will
get
it.
It
will
definitely
get
in
if
you're
behaving
honestly
and
which
means
that
all
these
attacks
are
an
incentive
compatibility
where
I'm
trying
to
prevent
you
from
doing
things.
In
order
to
get
me
to
something
better,
they
stopped
working
because,
basically
improved.
A
B
So
so
that's
a
good
point
so
again
we're
assuming
an
honest
majority.
So
the
honest
majority
assumption
means
that
you
know
here
we
have
a
majority
of
blocks
that
are
going
to
agree
to
vote
for
this.
So
whenever
there's
an
honest
block,
the
majority
of
the
blocks
and
the
next
layer
will
still
vote
for
this.
What
will.
A
B
Fewer
blocks
right,
no,
they
don't
gain
anything
by
doing
it
right.
So,
okay,
so
what
we
get
in
terms
of
like
the
formal
guarantee
is
something
that
we
call
an
epsilon
Nash
equilibrium,
it's
a
little
bit
stronger
than
that,
because
in
a
regular
Nash
equilibrium
it
holds
that
if
everybody
else
is
honest,
the
best
thing
for
you
to
do
is
to
behave
honestly
and
by
epsilon
Nash.
We
mean
the
best
thing,
but
you
might
lose
like
some
tiny
Epsilon
okay.
So
what
we
get
is
something
stronger.
If
a
majority
is
honest,
we
don't
need
everybody.
B
To
be
honest,
even
if
there's
like
you
know
a
third
of
the
network,
that's
behaving
maliciously,
not
just
you
know
rationally,
but
you
know
completely
trying
to
do
bad
things.
It's
still
worthwhile
for
you
up
to
this
epsilon
to
do
the
right
thing
and
the
idea
is
this.
Epsilon
is
small
enough
that,
for
instance,
the
costs
of
writing
your
own
code
to
behave
maliciously,
it's
just
not
worth
it,
and
so
then
it
becomes
reasonable
to
actually
assume
that
there's
an
honest
majority
and
the
sort
of
yourself
perpetuates,
but
then
the.
A
Question
is:
let's
say
there
is
somebody
who
is
sufficiently
powerful
to
have
so
I
guess
as
an
honest
participant,
I'm,
not
creating
block
in
every
at
every
layer,
right
I'm,
going
okay,
ting
but
let's
say
I'm
sufficiently
powerful
to
have
multiple
layers
in
a
row
just
like
layer
of
10
11
12.
Would
it
not
be
ideal
for
me
after
generating
the
block
full
there
Tam
shut
down
my
network,
you
know
to
save
resources
and
just
create
block
in
eleven
and
twelve.
That
only
approves
my
block
in
the
previous
layers
does
make
sense
and
to.
A
B
I,
don't
know
if
it
matters
that
much
because
you
know
blocks
10,
11,
12
or
5
minutes
apart
its
current
parameters
so
like.
If
you
have
several
layers.
Okay,
you
keep
your
computer
on
for
another
five
minutes,
I'm,
not
sure
it's
it's
part
of
the
Epsilon
yeah.
Obviously
you
know
we're
not
going
to
be
covering
every
type
of
like
slight
denial
of
service
attack,
because
you
just
cannot.
There
are
some
things
that
again
they
go
into
this
epsilon.
You
can
make
a
tiny
bit
more.
B
If
you
do
things
that
you
know,
if
you
consider
the
fact
they're
full
nodes
that
don't
get
any
reward
right
now
and
still
contribute,
then
it
seems
reasonable
that
this
won't
happen
too
often,
and
as
long
as
it.
You
know
this.
This
bad
behavior
is
limited
to
say
one
third
of
the
of
the
space.
Then
our
proof
says
that
you
know
we'll
still
get
consensus
and
we'll
get
liveness,
and
you
know
everything
will
be
good
cool
so
for
sure
we're
diving
into
the
consensus,
say
dive
into
consensus.
B
So
when
we
have
this
kind
of
mesh,
what
we're
assuming
is
in
terms
of
what
the
adversary
can
do
are
trying
to
overestimate
the
adversary,
trying
to
say
we're
going
to
prove
that
even
with
some
super
powerful
adversary
and
by
super
powerful
I
don't
mean
in
terms
of
the
fraction
of
the
network,
but
in
terms
of
what
its
capabilities
are
like
controlling
the
timing
of
the
network
right.
This
is
one
of
the
most
difficult
things
to
overcome.
B
So
even
with
this
kind
of
a
very
powerful
adversary,
we
still
are
going
to
get
our
good
properties,
consensus
and
lightness
and
the
main
thing
that
the
adversary
does
to
attack
is.
It
can
basically
decide
on
the
order
and
timing
of
messages
that
the
honest
parties
see.
So
it's
not
completely
unrestricted,
otherwise,
nothing
would
work.
We
were
assuming
in
terms
of
our
network
communication,
assumption
that
honest
parties
will
always
where
they're
all
connected
to
the
same
gossip
network
and
say
within
30
seconds
anything
that
I
see
on
the
network.
B
Every
other
honest
party
will
see
or
if
I
send
something
on
the
network
and
if
any
other
party
or
every
other
honest
party
will
see
within
30
seconds.
But
if
you
said
something
and
I
sent
something
or
maybe
I
sent
two
different
messages,
then
the
adversary
can
make
sure
you
get
one
and
then
maybe
you'll
get
the
other
one.
Only
30
seconds
later,
and
maybe
some
other
honest
party
will
get
the
second
message
first
and
the
the
first
message
30
seconds
after
that.
B
If
somebody
gives
her
a
different
state
of
the
block
mesh,
he
can
decide
which
one
is
right
without
having
to
trust
them.
That
you
know
I
was
there.
I
saw
that
this
came
before
that
right,
that's
not
something
you
can
prove.
So
the
actual
consensus
state
depends
only
on
the
messages
I
receive
not
on
their
order.
So
what
do
I
need
to
decide?
You
need
to
decide
for
each
of
these
layers,
so
each
layer
has
a
number
right.
So
this
is
layer
10.
This
is
layer
11.
B
This
would
be
layer,
12
and
and
in
each
layer
there
are
many
blocks
on
average,
say
200
and
each
block
says
which
layer
it's
in.
So
this
block
says
it's
in
later
11.
This
block
says
it's
in
layer
10.
It
could
be
in
terms
of
time
that
you
know
honest
parties
will
always
transmit
blocks
on
time.
So
when
I
say
maybe
one
thing,
that's
a
bit
different
here.
Our
layers
are
five
minutes
apart,
exactly
it's
not
a
probabilistic
thing.
So
every
five
minutes
there's
a
layer
at
ten
o'clock.
B
There's
a
layer,
10:05
there's
a
layer,
so
the
the
layer
number
actually
corresponds
to
an
actual
real
time.
Okay,
so
I
say
this
block
is
at
what
happens
if
I
publish
a
block
over
here,
but
I
claim
it's
at
layer
ten.
So
this
should
not
be
something
that's
accepted
right,
because
if
this
actually
was
in
layer
ten,
then
I'm
changing
history,
because
I'm
already
at
layer.
Thirteen
at
this
point,
so
we
need
to
decide
which
blocks
are
actually
in
the
layer
they
claim
to
be
in
and
which
are
not.
B
So
we
call
this
the
validity
of
the
blocks
for
each
layer.
We
need
to
decide.
No,
you
know
these
are
the
valid
blocks
and
some
blocks
are
invalid.
So
these
are
invalid
blocks
and
we
always
want
to
maintain
the
property
that
the
honest
blocks
will
always
be
agreed
to
be
valid
for
the
malicious
blocks.
We
don't
actually
care,
so
they
could
be
valid.
They
could
be
involved.
Basically,
if
you're
doing
something
bad,
maybe
will
invalidate
you
if
you
behave
honestly
you'll
be
valid.
B
B
Okay,
so
how
do
we
agree,
and
maybe
one
more
thing
about
the
challenge
is
so
we
said
if
something
is
over
here,
it's
sort
of
easy
to
see.
Okay.
This
is
definitely
not
supposed
to
be,
and
everybody
agrees
that
it's
not
in,
and
this
is
sort
of
the
easy
case
and
if
something
it
goes
exactly
on
time.
Again,
it's
an
easy
case.
Everybody
will
agree
that
it's
it's
supposed
to
be
in
what
about,
if
it's
somewhere
in
the
middle
so
said
that
there's
like
this
five
minutes
right
every
five
minutes.
B
There's
a
layer:
what
happens
if
the
adversary
on
purpose
sends
a
block?
That's
here
for
12
yeah,
so
yeah
it
sends
a
block
for
12,
that's
here,
so
it's
between
12
and
13,
and
it
makes
sure
that
some
honest
parties
sort
of
put
it
before
the
threshold
and
some
honest
parties
put
it
after
the
threshold.
So
now
honest
parties
won't
agree
exactly
on
where
this
block
is-
and
this
is
the
difficult
case
that
we
have
to
we
have
to
resolve.
We
have
to
still
get
consensus
on
it,
but.
B
No,
it
just
required.
Okay
depends
what
you
mean
in
some
sense.
Yes,
we
require
that
all
parties
agree
on
the
current
time
within
some
reasonable
balance.
So
when
we
said
we
assume
that
you
know
honest
parties
see
each
other's
messages
within
30
seconds,
then
this
sort
of
includes
in
it
the
differences
in
clocks.
So
suppose
we
have
in
your
a
three
second
difference
in
our
clocks.
Still
by
your
time,
you've
transmitted
something
it's
ten
I
should
receive
it
before
No,
ten
and
thirty
seconds,
according
to
my
own
clock.
A
B
That's
not
so
easy
right,
you're
right
it,
the
the
the
interns
implementation.
The
protocol
has
to
sort
of
ensure
that
it's
keeping
time
accurately
and
so
the
implementation
can
see
that
time
is
jumped
by
five
hour
hours.
That
will
never
happen
right.
This
is
like
there's
no
time
zones
or
you
just
need
this
absolute.
How
long
has
it
been
since
Genesis?
B
So
I
think
this
is
not
an
insurmountable
problem
and
in
fact
this
problem
does
occur
in
other
systems
as
well
right,
you
do
need
real
time
to
be
vaguely
in
sync
in
almost
every
blockchain
protocol,
I
think
yeah.
So
there
is
this
sort
of
very
weak
trust.
Assumption
in
terms
of
my
clock,
is
more
or
less
okay,
you're
right,
okay.
So
so
how
do
we
get
consensus?
B
So
if
the
the
high-level,
what
we're
going
to
do
is
we're
going
to
vote
so
what
I'm
going
to
describe
now
is
sort
of
this
very,
very
inefficient
protocol
that
so
gets
the
security
right,
but
in
terms
of
practicality,
it's,
like
you,
know,
N
squared
complexity,
it's
horrible,
so
our
protocol
actually
does
the
same
thing,
but
we
optimized
it.
You
know
several
steps,
so
it
no,
it's
actually
much
much
better
in
terms
of
communication
in
terms
of
CPU
or
you
know,
so
it
actually
makes
this
practical.
B
B
The
votes
are
actually
weighted,
so
they're
weighted
by
sort
of
how
much
resource
I
expended
we'll
get
into
sort
of.
How
do
we
decide
when
we're
eligible
to
generate
blocks
exist?
I?
Think
one
of
the
interesting
things
that's
different
about
our
protocol,
but
basically
now
we're
counting
and
then
the
majority
decides.
B
So
this
is
great
for
all
of
those
things
that
we
all
agree
on.
The
majority
is
going
to
decide.
That
is
honest,
so
the
majority
will
decide
in
the
same
way.
So
if
there's
an
honest
block,
everybody
is
going
to
vote
for
it
and
if
it's
sort
of
far
enough
in
the
past,
then
I
vote
according
to
what
I
see.
So
if
I
see
the
majority
voted
for
it,
I'm
going
to
vote
for
it
as
well
after.
A
B
You
count
all
the
votes
up
till
you
know
the
current
time,
and
this
gives
you
sort
of
your
own
opinion
about
all
the
previous
blocks
and
then
your
block
will
say
what
is
your
opinion
about
at
the
current
time
about
every
previous
block?
And
so,
if
all
the
honest
parties
agree
that
this
is
valid,
then
in
the
next
layer
they
will
count
the
votes.
All
of
the
honest
parties
will
agree
that
this
has
the
majority
valid,
so
they'll
all
agree
that
this
is
valid
and
this
majority
will
just
grow
and
and
then,
as.
B
And
and
in
fact,
because
these
layers
are
very
big,
it's
again,
it
depends
on
exactly
how
much
probability
of
area
are
willing
to
tolerate,
but
for
like
2
to
the
minus
40
probability
of
error,
and
you
know
200
blocks
per
layer,
even
if
one-third
of
the
blocks
are
voting
completely
differently
within
four
layers,
you're
completely
converted
in
this
case.
So
this
is
wonderful
and
then
you
could
have
that
basically
the
same
argument
as
why
bitcoin
can't
be
reversed.
B
It
happens
here
right.
You
have
the
probability
that
you're
going
to
sort
of
change
the
majority.
It
depends
only
on
how
many
votes
the
margin
of
votes,
how
many
plus
versus
how
many
and
the
fraction
of
the
resources
that
the
adversary
controls,
and
so
this
is
actually
going
to
happen
much
faster
than
Bitcoin.
So
in
Bitcoin
right
we
have
this
one
block
every
10
minutes,
but
here
the
margin
grows
by
200
blocks
every
five
minutes.
So
so,
once
we
were
in
this
good
position,
then
you
get
really
really
fast
convergence,
but.
A
B
B
Okay,
now
in
the
next
layer,
the
adversary
will
put
another
block
here
that
votes
for
it
and
another
block
here
that
votes
against
it,
and
if
half
the
the
honest
parties
see
this
one
in
half
see
this
one
first
and
all
those
blocks
as
well,
and
they
all
see
these,
because
these
are
honest
block,
then
again
this
this
split
can
continue.
You
only
need
one
block
here
to
do
this
right,
so
you
can
continue
this
forever.
So
this
is
bad.
We
don't
want
this
case,
okay.
So
what
do
we
do
so
this?
B
This
is
what
we
call
The
Tortoise
protocol,
there's
another
part
of
it
that
I
hope
I'll
get
to
talk
about
later.
It's
an
important
part
of
it,
but
for
the
sake
of
the
overview,
let's
talk
about
the
hare
protocol
first,
so
the
hare
protocol.
Basically,
is
this
really
fast
bootstrapping
method
to
get
us
to
agree
on
these
blocks
and
it
really
happens
off
chain,
so
it
still
uses
the
gossip
network,
but
the
results
of
the
hare
protocol
are
only
recorded
as
votes
on
the
chain.
So
what
is
the
hare
protocol?
B
Maybe
yes,
sir,
why
do
we
call
this
the
tortoise
protocol?
Because
it's
it's
very
robust?
It's
a
bit
slow
and
we'll
talk
about.
What
do
we
mean
by
slow
until
now?
It
just
sounds
fast,
but
it's
you
know
sure.
That's
the
important
thing
right.
It
guarantees
irreversibility,
and
you
know
this
ticks
and
everything
once
we
have
agreed
on
something
it
will
stay
agreed.
What
does
the
hare
protocol
do?
What
it
does?
Is
we
select
a
different
committee,
so
here
we
have.
B
Basically,
these
these
blocks
are
subsets
of
all
of
the
users
right
that
are
selected
to
generate
blocks
for
the
hare
protocol.
We
use
just
completely
different
committees,
but
in
a
sort
of
similar
way
we
select
a
random
committee.
The
hare
committees
are
actually
a
lot
larger,
so
the
hare
committee
is
going
to
be
something
like
800
committee
members
and
then
well.
They
could
all
use
a
Byzantine
agreement
protocol
to
decide
about
all
these
blocks.
B
So,
basically,
at
every
layer
boundary
we
start
a
new
independent
Byzantine
agreement
protocol,
a
new
hair
protocol
that
decides
on
all
the
blocks
in
the
previous
layer
and
then
instead
of
voting,
according
so
in
the
hair
protocol,
I
vote
according
to
whether
it's
on
time
or
not
into
my
own
opinion,
but
because
it's
a
Byzantine
agreement
at
the
end,
all
the
honest
parties
are
guaranteed
to
agree
and
now
the
rest
of
the
honest
parties
who
didn't
participate
in
the
hair
protocol.
They
see
the
results
and
they
vote
according
to
the
results
of
the
hair
protocol.
B
So
now
all
honest
parties
are
going
to
agree
on
this.
It
might
be
an
it
might
be
out,
we're
not
sure
right,
but
the
hair
protocol
is
this
property
that,
if
all
honest
parties
agree
on
something,
that's
going
to
be
the
output.
If
they
don't
agree,
we
don't
know
what
output
is
going
to
be,
but
we
do
know
that
they
will
agree
on
it.
So
there's
a
little
wrinkle
here,
something
that
we
want
is
to
prevent
these
denial
of
service
attacks,
and
here
we
use
a
trick
from
Al,
Gore
and
or
similar
to
Al.
B
So
if
you
have
you
know
a
protocol
with
800
committee
members
and
they
need
to
talk
for
several
rounds
which
they
do
because
Byzantine
protocols
you
need
several
rounds
of
talking,
then
after
the
first
round
you
could
kill
all
the
honest
ones
and
now
you're
left
sort
of
you
don't
have
an
honest
majority
in
this
anymore.
So
so
we
use
the
the
al-quran
trick
of
player,
replace
ability.
B
Basically,
we
have
several
rounds,
but
at
every
round
there's
a
different
committee,
which
is
totally
independent
of
the
previous
committee,
and
this
is
really
really
fast,
so
we
can
do
it
on
average.
Again,
it
depends
if
we're
under
attack
or
not
if
we're
under
attack.
We
do
it
I
think
something
like
two
minutes
or
no,
maybe
five
minutes
average
I.
Think
so.
Is
it
like
a
bit
less
than
the
layer
time
if
we're
not
under
attack
it's
much
faster,
but.
B
It's
eight
layers.
No,
so
maybe
there's
two
minutes
yeah
we
did
the
calculation
so
that
it
so
in
the
optimistic
case,
it
actually
happens
early
enough
that
the
next
layer
can
use
it
in
the
pessimistic
case.
Then
it
might
not
be
finished
for
this
layer.
So
if
you
haven't
seen
the
hare
protocol
results
for
this
layer,
then,
instead
of
voting
sort
of
directly,
you
say:
look
I'm
still
waiting,
I,
don't
know
what
the
results
are
for
this
layer
and
I'll
vote
for
the
previous
layer
instead,
but
because
they're
an
average.
B
It
takes
very
few
rounds,
and
you
know
this
is
like
the
this
long
time
is.
If
you
have
one
third
of
the
out
of
the
network
being
actively
attacked
by
the
adversary.
This
is
when
it
can
take
this
8-round
average.
So
we
assume
most
of
the
time.
This
is
not
going
to
happen
because
it
doesn't
really
it's
not
a
rational
thing
to
do
right.
B
Okay
so
said,
there's
another
important
property
of
the
tortoise
protocol,
which
is
it
has
to
do
with
security.
I
think,
is
something
important
for
protocols
in
general
is
what
what
is
the
robustness
of
the
protocol
and
by
robustness
I
mean.
We
said
our
protocol
is
secure
as
long
as
their
assumptions
hold,
but
we
want
this
protocol
to
run
for
a
very
long
time
right.
So
what
are
our
assumptions?
We
have
this
connectivity
assumption.
We
have
the
honest
majority
assumption
and
we
have
some
mathematical
assumptions
like
you
know
the
same
things
that
other
protocols
use.
B
No
sha-256
is
collision
resistant
and
behaves
in.
You
know
certain
ways
and
yeah.
You
know
you
can't
break
a
lip
to
curve
signatures
and
things
like
that.
So
for
mathematical
assumptions,
then
you
know
they're
either
broken
forever
or
not,
and
we're
sort
of
summe
that
they're
going
to
keep
holding
on
for
a
long
time-
and
this
is
a
very
common
everybody
does
that,
but
for
the
other
assumptions
their
assumptions
on
behavior,
unlike
real
life,
things
right
and
an
honest
majority
means
what
people
are
actually
doing.
B
B
So
suddenly
we
don't
have
an
honest
majority,
okay
for
a
few
hours,
or
maybe
somebody
got
somehow
a
short
spike
and
managed
to
hack
into
AWS
and
use
all
their
disk
space,
and
you
know
also
into
Google
at
the
same
time
they're
using
all
their
disk
space
for
a
short
period
of
time
too
late,
they're
caught.
So
you
know
these
things
could
happen,
they're
very,
very
low
probability,
so
we
don't
usually
protect
against
them.
But
if
you
take
a
long
enough
period
of
time,
then
low
probability,
events
will
happen
right.
B
You
think
about
lightning
strikes
right.
The
probability
that
lightning
will
strike
you
know
at
this
moment
here
is
super
low.
It
could
happen,
but
it's
very,
very
low,
but
the
probability
the
lightning
strikes
somewhere
in
the
world
is
actually
not
that
low
at
all
right
lightning
does
strike
all
the
time
all
around
the
world.
So
we
have
to
have
our
system
be
robust
in
the
sense
that
if
these
bad
things
happen,
we
don't
want
to
say
okay
now
the
system
is
dead,
because
over
a
long
enough
time
they
will
happen.
So
we
want
okay.
B
B
We
don't
want
some
kind
of
manual
intervention
to
be
necessary
and
to
decides
it's
like,
then
there
are
three
somebody
who's
deciding.
What
is
the
new
consensus?
This
is
a
bad
thing
for
this
distributed
system
that
and
requires
that
we
want
to
require
very
little
trust,
so
we
have
something
that
we
call
self-healing
mode
and
basically,
what
self-healing
mode
is
is
the
tortoise
can
work
without
a
hare
protocol
at
all,
and
the
the
tortoise
protocol
works
only
based
on
the
messages
I
see.
B
So
after
we,
you
know
if
we
had
a
network
split
or
if
we
had.
You
know
some
bad
things
and
maybe
I
didn't
see
all
the
messages
you
didn't
see.
Some
of
them
after
we're
connected
again
there's
an
honest
majority
again,
we
all
you
know,
exchange
all
the
messages
all
the
history
saw.
So
now
we're
going
to
agree
again.
That's.
B
B
So
here
you
might
need
know,
maybe
it
at
most
I,
don't
remember
what
the
numbers
are
right
now,
but
like
one
six
or
something
like
that,
so
you
know
you.
What
do
we
mean
by
one
thing?
We
only
we
don't
need
the
adversary
to
corrupt
that
amount.
We
say
it
doesn't
attack
with
more
than
that
amount.
So,
even
if
it's
corrupted
one-third,
but
it
only
attacks
with
one
six,
then
self-healing
will
work
and
basically
the
way
self-healing
works
is
we.
We
modified
this
voting
protocol,
so
this
this
happens
all
the
time
right.
B
B
B
Right
so
here
what
we
said
before
was
basically
that,
like
the
name
thing
is,
this
I
think
is
a
plus,
and
this
I
think
is
a
minus
in
order
to
allow
self-healing
we're
going
to
use
a
kind
of
trick
from
sort
of
classical
Byzantine
Agreement
protocols,
we're
going
to
change
this
and
we're
going
to
add
something
around
the
zero,
so
that
now
this
is
a
plus.
This
is
a
minus,
and
here
we're
going
to
do
something
differently.
B
We're
going
to
have
a
coin
flip,
and
this
coin
flip
is
going
to
be
what
we
call
a
weak
coin.
Flip
where
everybody
agrees
on
the
coin.
All
the
honest
parties
agree
on
the
coin.
With
some
constant
probability
say,
you
know
one-third,
okay
and
sorry
2/3
everybody
is
agrees
on
the
coin,
with
probability
2/3
and
so
with
probability.
1/3.
Everybody
agrees
that
it's
zero
with
probably
one-third.
Everybody
agrees
that
it's
one
and
with
probably
one-third
that
can
decide,
they
don't
have
to
agree
the
adversary.
B
Just
says
what
each
honest
party
thinks
is:
the
coin
and
the
property
we
have
about
this
vote
margin.
This
property
that
we
maintain
is
that
honest
parties
can
disagree
right,
so
an
honest
party.
If
it's
here
it
means
it
sees.
You
know
a
lot
more
plus
than,
and
if
it's
here
it
sees
a
lot
more
than
Plus.
But
how?
Why
can
y
do
honest
parties
disagree?
They
can
only
disagree
if
they
receive
different
messages.
B
Basically
they're
counting
votes,
so
you
and
I
can
only
disagree
if
by
this
much
right,
if
we,
the
weight
of
the
met
of
the
votes
that
we
disagree
on
is
at
least
this
much,
but
this
is
bounded
the
weight
of
the
votes
that
we
disagree
on
right.
We
never
disagree
on
honest
blocks,
because
those
are
a
guarantee
that
we
see
them
together.
So
we
only
disagree
on
the
dishonest
blocks
that
are
published
in
the
past
short
period.
B
So
right,
so
what
we're
saying
is
we're
bounded
right?
You
can
disagree
by
less
than
this
right,
so
it
could
be
that
an
honest
party
is
here
and
one
is
here.
It
could
be
that
there's
an
honest
party
here
and
one
here,
but
but
it
can't
be
that
these
two
are
honest
buyers,
okay
and
now
the
the
coin
flip
basically
is
a
plus
or
a
minus.
So,
let's
suppose
we're
in
this
case
it's
symmetric
for
the
other
case.
B
If
we're
in
this
case,
then
this
one
will
always
say
Plus
this
one
we'll
use
the
coin
now,
with
probability
1/3
right,
all
the
honest
parties
will
see
the
coin
as
a
plus.
So
with
probability
1/3,
all
the
honest
parties
are
going
to
agree.
But
that
means
that
in
the
next
round
right
there
they're
going
to
see
a
majority
voting
in
the
same
direction
and
so
basically
one
in
the
next
round.
All
the
honest
parties
are
going
to
shift
so
they're
going
to
be
here
and
and
now
we
can
get
basically
to
full
agreement.
B
So,
okay,
but
probably
the
two
thirds
this
doesn't
happen,
but
in
every
round
sort
of
independent.
We
we
have
this
good
case.
So
if
we're
in
the
bad
case,
then
we're
just
back
to
where
we
started-
and
this
means
that
you
know
very
very
fast
you
you
will
have
by
very
fascinating.
You
know
one
third
to
the
to
the
N
when
n
is
the
number
of
layers
is
a
probability
that
you
managed
to
sort
of
miss
out.
It's
our
two
thirds
today,
yes
right!
So
this!
B
This
goes
down
exponentially
fast,
so
so
pretty
fast,
but
exponentially
fast.
It's
still
number
of
layers.
This
is
why
we
say
that
the
torte
is
sort
of
slow
but
sure
right
it
it's
much
slower
than
the
hare
protocol,
which
is
immediate,
but
if
this
doesn't
work
nicer,
if
the
hare
protocol
doesn't
work,
this
will
still
guarantee
consensus,
and
once
we
have
consensus,
then
the
hare
protocol
will
start
working
again
and
then
we'll
get
there
we'll
be
back
in
the
good
case.
So
we
have
this
sort
of
automated
mechanism
to
heal
from
from
bad
things.
B
B
B
When
you
start
out
right,
you're
doing
this
proof
of
space-time,
so
you
need
to
generate
space.
We
have
initialization,
but
once
you
do
that
every
time
you
only
need
to
prove
every
two
weeks
that
you've
stored
space,
and
this
proof
goes
into
something
that
we
call
an
ATX
an
activation
transaction
may
be
transaction
is
not
that
you
know
completely
good
name
for
it,
because
these
are
sort
of
like
they're
freestanding
they
don't
have
to
be
inside
blocks.
So
you
don't
need
to
convince
somebody
to
put
this
in
their
block
for
you
to
join
right.
B
You
just
publish
it
and
everybody
sees
it,
and
this
ATX
contains
a
post.
If
we
have
time,
I
will
talk
about
exactly
which
kind
of
there's
some
subtleties
here,
and
it
contains
these
sort
of
a
commitments
to
where
I'm
going
to
generate
blocks.
So
we
divided
the
layers
into
a
box
of
two
weeks,
so
every
4030
two
layers
or
whenever
and
in
order
to
generate
blocks.
You
have
to
publish
an
ATX
in
the
previous
set
book,
so.
B
We
have,
you
know
an
epoch.
Now
you
generated
an
ATX
here.
This
makes
you
eligible
so
now.
You're
active
means,
you're
eligible
to
generate
blocks
here
and
you're
actually
guaranteed
deterministic
a
so
everybody
is
going
to
publish
one
ATX
in
every
epoch.
Every
miner
and
this
guarantees
that
you
get
to
publish
a
block
here.
B
Where
is
this
block
publish?
So
this
is
randomized
basically
and
part
of
your
ID
is
a
vrf
key,
verifiable
random
function.
So
your
idea
is
this
public
key
and
the
next
thing
about
a
verifiable
random
function?
Is
it's
a
function
that
when
you
give
it
an
input,
it
gives
it
an
output
that
looks
random
to
everybody
else,
but
you
can
prove
it's
the
correct
output
and
you
cannot
control
it.
There's
only
one
correct
output,
so
this
Viera
is
basically
going
to
decide
which
layer
your
block
is
in.
B
B
The
epoch
number
M
and
an
index
I
where
I
is
so
here
you're
going
to
commit
to
the
number
of
blocks
the
number
of
blocks
you
can
decide
what
D
is
up
to
some
parameters.
You
can
get
into
that
in
a
bit
okay.
So,
basically,
if
you
know
the
epoch
in
advance,
you
do
because
epochs
just
epoch
number
is
one
two
three
and
the
index.
So
this
is
the
first
block
in
that
half
of
the
second
block
and
so
forth.
Then
you
know
we're
in
the
epoch
going
to
be
but
I
say.
A
B
B
So
so
we
need
consensus
for
the
honest
parties,
so
there
are
several
ways
to
do
it,
so
the
easiest
way
is
to
use
a
vdf.
So
we
just
say
you
know,
use
the
vdf
that
should
run
for
two
weeks
right
after
two
weeks.
This
is
the
output,
and
then
you
continue
iterating
this
for
them
two
weeks
you
get
an
output
and
everybody
can
verify
that
and
there's
there's
only
one
true
answer
and
you
can't
get
it
before
the
week.
So
this
gives
sort
of
perfect
parameters,
but
there's
a
big
cost
to
it.
B
So
you
know
everybody
is
using
be
DFS,
they're
they're,
you
know
amazing
mathematical
objects,
but
I'm
not
sure
we
might
end
up
using
them
just
because
the
parameters
in
some
sense
are
better,
but
but
we
can
actually
do
it
without
a
PDF,
because
the
problem
here
is
that
we're
sampling
right,
but
we
do
have
this
advantage,
that
over
an
epoch,
we're
not
sampling
right.
We
have
these.
B
B
B
Yeah,
so
so
I
think
one
of
the
nice
things
is
is
that
we
have
this
deterministic
guarantee
you're
you're,
definitely
going
to
get
a
block.
So
how
many
blocks
you
actually
get?
So
you
can
get
how
many
you
want.
You
can
get
lots
and
lots
of
blocks.
You
can
get
a
block
in
every
layer
if
you
want,
and
if
you
do
that
you
might
be
considered
invalid
in
the
sense
that
you're
not
going
to
get
a
reward.
B
So
the
right
number
of
blocks
is
basically
see
how
many
people
are
registered.
The
previous
set
booked
and
then
set
the
number
so
that
the
average
number
of
blocks
per
layer
is
200
right,
but
we
don't
verify
that
you
don't
use
too
many
blocks.
Actually,
the
only
thing
we're
worried
about
is
using
too
few
blocks.
Why?
Because
if
everybody
is
spread
out
across
the
layer,
but
you
have
all
your
power
in
one
block,
then
again
you
have
this
problem
where
your
voting
powers
can
be
concentrated
in
a
few
layers.
B
But
but
this
you
can
show
that
you
can't
have
too
few
blocks
by
basically
showing
how
many
people
are
registered,
that
you
see
right.
So,
if
you
see
very
few
people
registered,
you
need
many
blocks
because
it
means
you
need
many
blocks
per
layer
in
order
to
to
get
to
one
block,
you
need
to
see
that
there's
a
lot
of
weight
already
there
and
the
honest
parties
will
also
see
it
so
they'll
also
just
use
one
block
earlier.
A
B
If
work
on
their
attack
and
how
heavy
the
attack
is
right
in
in
ideal
conditions,
then
maybe
already
the
previous
layer
is
under
intense.
If
we're
under
one
third
of
the
chain
is
being
one
third
of
the
powers
attacking
us,
then
occasionally
we'll
get
a
hair
protocol
that
takes
longer
to
so
then
we
might
have
like
the
few
previous
layers
are
not
yet
in
consensus,
but.
B
Okay,
so
that's
actually
a
good
question,
so
what
we
decided
we're
doing
so
far
is
just
deciding
which
blocks
are
in
the
lair
and
how
do
you
get
from
that
to
like
a
total
order
on
transactions
right,
because
this
is
what
we
need
to
run
smart
contracts
or
to
do
things
like
that?
And
basically
what
we're
saying
if
we
agree
on
which
blocks
are
in
the
lair,
then
it's
easy.
We
can
decide
to
or
whatever
arbitrary
rule
we
want
say
we
order
them
by
their
hash
all
right,
and
this
is
the
order
and
transactions.
B
Another
thing
that
I
didn't
mention,
but
transactions.
Actually,
ideally,
you
know
they'll
have
different
transactions
each
block,
but
they
could
be
duplicated
because
this
block-
and
this
block
don't
talk
to
each
other
while
they're
generating.
So
the
idea
is
everybody
chooses
a
random
subset
of
the
transactions.
You
have
fairly
little
overlap,
so
you're
actually
going
to
get
a
high
throughput,
but
there
could
be
some
duplications.
So
again
we
have
this
some
kind
of
rule
to
say,
and
so
the
the
transaction
counts
as
the
first
place.
B
A
B
So
you
don't
get
the
way
that
the
reward
system
works.
Is
you
don't
get
rewarded
directly
for
the
transactions
you
put
it
there?
The
rewards
are
shared
first
of
all
among
the
layer
and
actually
also
among
neighboring
layers,
so
that
you
don't
have
bad
incentives
like
I
want
to.
You
know
not
include
this
in
this
layer
because
I
know
I
have
a
block
in
the
next
layer
and
there
are
fewer
various
things
like
that.
B
So
so
we
sort
of
spread
out
this
thing
so
yeah
you
do
want
to
include
that
if
there's
like
too
many
transactions
to
include-
which
I
think
is
you
know,
this
would
be
wonderful
here.
You
can
like
the
limit
and
the
number
of
transactions
is
very
large.
So
in
general
you
just
you
have
everything
inside
and
then
it
doesn't
matter
which
ones
you
chose.
B
But
if
you
do
get
to
the
case,
where
there's
you
know
too
many
transactions
to
fit
even
here,
then
you,
you
want
to
incentivize
sort
of
everyone
to
choose
a
slightly
higher
value
transactions
but
yeah.
This
is
it's
not
like
a
I
want
the
highest
one
and
everybody
will
choose
the
same.
One
because,
overall,
it's
actually
better
for
you
to
coordinate
so
that
everybody
you'll
get
as
many
transactions
as
possible
and
not
just
the
one
that
it's
heist.
B
Okay,
so
this
is
like
a
very
high-level
overview
and
yeah
and
your
other
specific
things
so
I
can
talk
a
little
bit
about
how
this
proof
of
space-time
works,
because
this
is
this.
Actually,
this
paper
is
already
out.
It
was
accepted
to
crypto,
so
it's
now
an
ePrint.
You
can
read
it
and
it
will
be
presented
in
the
conference
in
August.
B
And
so
what
is
incompressible
say:
random
data-
that's
incompressible
right,
but
I
can't
just
show
you
that
I
stored
random
data,
because
it
could
be
that
I
actually
didn't
store
a
random
data.
I
stored
pseudo
random
data,
which
has
a
very
small
C
that
lets
me
generate
it
at
all.
So
so
what
do
we
actually
store?
B
So
so
this
two
days
should
have
sort
of
a
nice
margin
and
in
fact
it
might
be
even
a
good
enough
margin
for
like
commercial
services
where,
if
you
want
to
pay
Amazon
to
store
for
it's
still
cheaper
to
do
that
than
to
to
generate
it,
regenerate
it
okay.
So
this
is
what
I'm,
storing
how
do
I
prove
to
you
that
I'm
storing
it
so
the
like
the
native
first
attempt
is
okay.
So
what
are
the?
What
are
the
challenges
that
it's
proved
so
they're
going
to
be
your
ID?
B
B
B
But
now
what
what
do
I
do?
I
two
weeks
have
passed:
I,
maybe
I.
Even
somehow
you
know
committed
to
this
is
like
the
first
neiva
temped
and
now
I
ask
you,
and
now
you
say:
oh
okay,
fine
show
me
your
story
show
me,
you
know
three
random
places
in
the
table.
Okay,
so
if
I've
committed
in
advance
a
with
a
Merkel
tree,
then
I
can
I'll
have
to
show
you
three
random
places
actually
have
to
have
these
random
places
at
the
table,
but
that's
actually
not
a
good
proof
of
space-time.
Why?
B
B
What
we're
going
to
do
is
we're
going
to
say.
Let's
say
this:
is
your
table?
Okay,
I'm,
going
to
give
you
a
challenge
after
two
weeks
and
you're
going
to
create
a
Merkle
tree
where
the
hash
function
uses
the
challenge
so
I'm
going
to
hash
instead
of
just
hashing,
the
two
leaves
I
hash
the
challenge,
and
then
the
two
leaves
okay,
so
the
regular
Merkle
tree
would
be.
You
know
a
and
B
and
here's
a
challenge
in
a
and
B
and
and
I
do
that
in
the
same
way,
right
until
I
get
the
root.
B
Okay,
now
I'm
going
to
describe
an
interactive
protocol,
so
I
send
you
the
root
of
this
tree,
and
then
you
give
me
these
random
leaves
and
I
have
to
show
you
a
path
in
the
Merkle
tree.
So
this
actually
does
prove
that
you
stored
the
data.
Why
are
they
at
least
that
you
had
most
of
the
table
all
right
so
to
get
an
idea?
Suppose
you
only
had
half
of
the
table,
you
decided
not
to
sort
happen.
B
You
don't
have
to
while
you're
building
this
tree,
you
have
to
commit
in
advance
to
which
parts
you
decided
to
regenerate
in
which
you
didn't.
So
if
you
only
regenerate
it
half
right,
then
with
probability
1/2,
every
time
I
ask
you
I'm
going
to
land
on.
One
of
these
leaves
that
you
didn't
regenerate
and
so
I'll
catch
you,
but
with
the.
A
B
B
It's
not
so
bad
for
one
terabyte
of
data,
the
hash
we
use
the
proof
of
double
the
proof
of
work
here
uses
a
much
heavier
hash
and
when
you
do
the
miracle
tree,
you
actually
don't
need
to
do.
Each
of
these,
the
output
of
the
proof
of
work
is
actually
quite
small,
so
you
don't
even
need
to
do
all
of
them.
You
can
batch
them
together,
so
it
turns
out
in
terms
of
actual
parameters.
It's
not
too
bad.
It
might
take
you
I,
don't
know
10
minutes
half
an
hour
depending
on
the
size.
B
A
B
So
so
there
actually
are
proofs
of
space
that
were
published
earlier.
That
use
something
a
bit
more
common.
You
don't
actually
need
the
proof
of
work
here
that
use
these
sort
of
interesting
graph
structures
that
have
these
properties
that
if
you
can
get
the
hash
of
the
end
of
the
graph,
then
you
have
to
have
a
lot
of
space
while
you're
doing
it.
So
you
can
prove
that
you're
actually
storing
space
with
a
lot
of
these
hashes
and
everything
depends
on
everything
else
in
this
sort
of
interesting
way.
B
The
reason
we're
doing
this
is
first
of
all,
to
a
lot
simpler,
but
also
one
of
the
the
properties
this
has
is
it.
You
can
change
the
difficulty.
So
we're
saying
the
difficulty
that
of
these
proofs
of
work
needs
to
be
enough,
that
it's
more
expensive
to
regenerate
than
to
store
for
two
weeks.
If
you
remember,
we
said
that
everybody
publishes
an
ATX.
This
seems
a
little
suspicious
right,
because
if
we
have
more
and
more
miners,
that
means
our
communication
grows
right.
B
The
reason
everybody
else
does
sampling
is
that
you
want
your
communication
to
be
constant,
independent
of
the
number
of
miners,
and
here
you
know
we
have
800,000
miners.
Then
you
have
800,000
a
TX's.
If
we
have
no
two
million
miners,
we
have.
You
know
more
than
twice
that,
so
the
communication
is
just
going
to
grow.
So
how
do
we
deal
with
that?
So
right
now,
we've
said:
there's
a
two-week
epoch,
then
this
will
be
sort
of
good
up
to
about
800,000
miners.
If
we
want
more
than
that,
we
can
increase
the
epoch
size.
B
So
you
can
say:
okay,
once
we
get
to
1
million
miners,
the
epoch
is
going
to
grow
to
be.
You
know,
four
weeks
instead
of
two
weeks
and
then
basically
you're
just
using
the
80
X's
less
frequently.
So
so
the
communication
can
still
stay
constant,
but
now
this
table
has
to
hold
on
it
has
to
be
more
expensive
than
a
full
month
of
storage.
So
it
could
be
that
we
need
more
work.
So
how
do
we
do
that?
B
Well,
we
could
just
say
right
run
everything
over,
but
this
is
not
super
reasonable
and
the
this
kind
of
protocol.
They
basically
require
that
to
run
things
over
and
they
also
require
like
the
harder
it
gets
or
the
more
space
it
it
needs
to
take.
So
these
are
a
bit
problematic
here.
We
have
this
sort
of
nice
mechanism
where
you
can
just
sort
of
make
each.
B
If
we
use
the
hash
based
proof
of
work
right,
then
you
can
just
say
each
of
these
is
going
to
get
a
little
bit
harder,
so
you
can
go
over
the
table.
Some
of
them
are
already
good,
so
basically
you're
only
paying
the
difference
in
the
difficulty,
so
you
can
serve
incremental
e
increase
the
difficulty-
and
this
has
this
nice
property.
A
A
B
That,
okay,
yes,
so
this
is
an
interactive
protocol
and
which
is
not
really
something
you
can
use
in
the
setting.
So,
first
of
all,
we
make
this
non
interactive
by
using.
This
know
very
well,
no
trick
called
Fiat
Samir,
which
basically
says
instead
of
me,
sending
you
the
route
and
then
you
giving
me
random
challenges.
I
just
take
this,
put
it
into
a
hash
and
pretend
that
you
sent
me
the
results
of
the
hash
as
the
challenges.
And
if
it's
difficult
enough
to
find
good
things,
then
this
is
secure.
B
B
You
know
if
you
check
this
result,
and
this
result
that
two
weeks
must
have
passed,
and
this
is
self-contained.
You
don't
need
anybody
to
trust
anybody.
I
mean
you,
don't
need
the
trusses,
but
you
need
to
run
this
point
so,
okay,
so
now
this
seems
like
ok,
we're
back
to
proof
of
work.
Why
is
this
not
just
a
regular
proof
of
work.
B
So
the
poet
can
be
one
server
that
actually
gives
everybody
so
the
the
answers
and
it
only
costs
once
so
again.
You
know
the
the
poet
server
does
need
to
be
trusted.
There
doesn't
need
to
be
only
one,
but
if
you're
saying
you're
paying
a
fee
to
use
a
poet
server,
so
anyone
can
run
their
poet
server.
The
more
users
a
poet
server
has
actually
the
lower
the
feet
can
can
charge
because
it's
costs
don't
depend
on
the
number
of
users.
B
So
you
have
this
sort
of
aggregation
where
you'd
expect
that
no
there
will
be
very
few
poet.
Servers
with
huge
number
of
users
can
always
verify
the
results,
but
you
don't
need
to
trust,
but
but
you
don't
need
to
pay
a
lot
for
them.
You
there's
actually
the
very
little
work
being
done
in
terms
of
the
whole
system.