Regulating Storage Overhead in Existing PoW-based Blockchains Frederik Armknecht Jens-Matthias Bohli* University of Mannheim Mannheim University of Applied Sciences Germany Germany [email protected] [email protected] Ghassan O. Karame Wenting Li NEC Laboratories Europe NEC Laboratories Europe Germany Germany [email protected] [email protected] ABSTRACT so far. This resulted in a sharp variance in the number of Proof of Work (PoW) blockchains regulate the frequency and blockchain replicas over time. Namely, during the early years security of extensions to the blockchain in a decentralized of PoW blockchains, every miner was also a \full-node" and manner by adjusting the difficulty in the network. However, stored a full copy of the blockchain. As a result, the blockchain analogous decentralized measures to regulate the replica- witnessed an unprecedented level of replication (>200,000 tion level of the associated transactions and blocks data are replica) until early 2014 [14, 15]. Nowadays, the current completely missing so far. We argue that such measures are difficulty level of PoW mining is prohibitively high enough required as well. On the one hand, the smaller the number that miners do not have incentives to operate solo. Instead, of replicas, the higher the vulnerability of the system against joining a mining pool emerges as an attractive option for compromises and DoS-attacks. On the other hand, the larger miners to receive a portion of the block reward on a consistent the number of replicas, the higher the storage overhead, and basis. Here, workers do not connect directly to the blockchain; the higher the operational blockchain cost are. instead, they only connect to the pool operator which defines In this paper, we propose a novel solution, EWoK (Entan- their search space parameters (e.g., workers are typically gled proofs of WOrk and Knowledge), that regulates in a required to solve a PoW with a reduced difficulty). In fact, decentralized manner the minimum number of replicas that most existing workers run dedicated mining protocols, such as should be stored by miners in the blockchain. EWoK achieves Stratum mining (STM) [25] or GetBlockTemplate (GBT) [17], this by tying replication to the only directly-incentivized pro- in which they solve specific outsourced PoW puzzles without cess in PoW-blockchains { which is PoW itself. EWoK only having to store any parts of the blockchain. This resulted in incurs small modifications to existing PoW protocols and a sharp decrease in the number of full nodes from hundreds is fully compliant with the specifications of existing mining of thousands to a few thousands of nodes [14, 15]. hardware. Our implementation results confirm that EWoK While, in theory, ensuring that the system has a few can be easily integrated within existing mining pool protocols, \trusted"replicas suffices for security, the essence of blockchain such as GetBlockTemplate and Stratum mining, and does is not to rely on such \trusted nodes". This makes it essential not impair the mining efficiency. that a sufficient number of replicas are stored within the system. However, this number depends on many aspects of 1 INTRODUCTION the system and could dynamically change in the future. On the one hand, the smaller the number of replicas, the higher Blockchains realize a conflict-free, \extend-only", distributed the vulnerability of the system against compromises and DoS- data structure without the need for a central root of trust. attacks. On the other hand, the larger the number of replicas, Proof of work (PoW) based blockchains such as Bitcoin and the higher the storage overhead, and the higher the opera- Ethereum account for more than 90% of the total market tional blockchain cost. In many ways, this is analogous to capitalization of existing digital cryptocurrencies [10]. These the need of regulating block generation times using PoW diffi- blockchains enable miners to \vote" with their computing culty: a large difficulty increases the block generation times power on the next set of transactions to be added by \mining" and lowers system throughput, while a low difficulty decreases blocks|which effectively limits the power of individual users the generation time and increases the throughput. and makes Sybil attacks difficult. The difficulty in PoW In this paper, we propose a solution, EWoK (Entangled mining is self-adjusted by the network to ensure that the proofs of WOrk and Knowledge), to regulate in a decentral- block generation time (and therefore the system throughput) ized manner the level of ledger replication amongst miners lies within reasonable bounds [16]. (and mining pools) in the network. EWoK ties the replication However, similar mechanisms that attempt to regulate to the only directly-incentivized process in PoW-blockchains| the storage of the associated blocks/transactions are missing which is mining itself. To this end, EWoK effectively divides *Work done while author was affiliated with NEC Laboratories Europe 1 Conference'17, July 2017, Washington, DC, USA Frederik Armknecht, Jens-Matthias Bohli, Ghassan O. Karame, and Wenting Li the blockchain into dynamically adapting partitions and re- compliant with the specifications of existing mining hardware, quires mining pool workers to use different partitions in order and only incurs minor changes to the existing PoW protocols. to correctly solve the standard hash-based PoW. EWoK al- Hence, EWoK emerges as the first workable attempt to reg- lows to freely scale the size of the partitions to fit them into ulate the dispersal of the blockchain data amongst various the memory of typical miner hardware. This encourages pool workers. workers, i.e., parties that aim to maximize their efficiency, to store the individual partitions locally for faster access instead Outline. In Section 2, we briefly recall basic information about of fetching the information from a remote external resource. blockchains based on Proofs of Work (PoW) and shed lights In doing so, EWoK ensures a minimum bound on the number on their shortcomings. In Section 3, we introduce our exten- of replicas in the system as mandated by a system-wide pa- sion of PoW-based blockchains, ?-covering blockchain, which rameter. We implemented and evaluated a prototype based ensures that the blockchain is stored among the workers with on EWoK using GPU mining and integrated it with STM and a specified level of redundancy. In Section 4, we detail EWoK GBT. Our results show that EWoK does not require changes and analyze its security. In Section 5, we evaluate a prototype in existing mining hardware, and achieves a 2% higher hash implementation based on the integration of EWoK with GPU rate than GBT and only deteriorates the hash rate of STM mining based on STM and GBT, and we conclude the paper by 1%. in Section 6. Related Work. The literature features a number of contribu- 2 PRELIMINARIES tions that propose a re-purposing of the PoW to e.g., prove 2.1 Notations. storage of archival data, but require either drastic changes _ denotes the security parameter and negl¹_º a function that or are not applicable in practice. Note that most PoW-based is negligible in _. We denote by 퐻 a cryptographically se- blockchains, such as Bitcoin, use a hash-based PoW to find cure hash function that accepts bitstrings of arbitrary length. an input that is hashed to a value with certain properties For the sake of readability, if the input G is the concatena- (see Example 2.2 in Section 2.2). That is, a PoW usually tion of several individual strings G ,G ,..., we simply write requires many hash executions over randomly chosen inputs. 1 2 퐻 ¹G ,G ,...º instead of 퐻 ¹G jjG jj ...º. For a probabilistic al- In Permacoin [18] and Retricoin [23], the PoW is replaced by 1 2 1 2 gorithm A, we denote by ~ A¹Gº the event that A on input a Proof of Retrievability (PoR) over a large archival data file. G outputs ~. In case that the random coins d need to be Here, the archival data file needs to be known a-priori in its specified explicitly, we write ~ A¹G, dº. Otherwise, we omit entirety to get extended by a maximum-distance-separable these to keep the formalism short and assume that all proba- code and to allow the miners to pick their own selection of bilities are also over the random coins. To capture the notion file shares to be stored in their local storage. That is, these of effort, we express by Steps ¹Gº the number of steps (i.e., systems do not support a dynamically increasing file|such A machine/operation cycles) executed by algorithm A on input as the blockchain ledger. G. This includes also idle steps, e.g., when an algorithm has Spacemint [21], Burstcoin [8], and Filecoin [13] aim to $ replace PoW by a Proof of Space. This means that a miner to wait for some data. G - means that an element G has has to prove that a certain amount of storage has been been sampled uniformly from a set -. When we consider a invested (instead of computation as in the case of a PoW). function 6 = id, we refer to the identity function. This would require likewise drastic changes in existing mining hardware. PieceWork [2, 11] leverages a 2-phase PoW protocol 2.2 PoW-Based Blockchains similar to EWoK; it is however not designed to incorporate A blockchain 퐵퐶 = »퐵퐶 »0¼, 퐵퐶 »1¼,...¼ is a list where new proofs of knowledge over blockchain data. BetterHash [9] is data, i.e., blocks, are appended within each time epoch. A a newly proposed mining protocol that allows the workers blockchain system is composed of a blockchain 퐵퐶 and a set to construct their own block template while benefiting from W of workers who maintain the blockchain1.