Conquering Generals: an NP-Hard Proof of Useful Work Angelique Faye Loe Elizabeth A. Quaglia Royal Holloway, University of London Royal Holloway, University of London Information Security Group Information Security Group [email protected] [email protected] ABSTRACT on a candidate block header, consisting of unconfirmed transactions Proof of Work systems are used in cryptocurrencies to obtain con- taken from a memory pool and concatenating a nonce until the de- 1 sensus in distributed peer-to-peer systems that share no trust. Min- sired output of several leading zero’s is obtained . ers of cryptocurrency compete by engaging in the Proof of Work to Mining is a competitive process in which miners race each other to solve a cryptographic challenge. The first to successfully provide be the first to find a solution to the computational challenge. The a solution to the challenge wins by minting new currency. The process of mining also simultaneously ensures consensus by gener- process of mining also simultaneously prevents double-spending ating the immutable distributed ledger data structure, commonly through the creation of an append-only distributed database known referred to as the blockchain. The blockchain is append-only and it as the blockchain. The most widely adopted Proof of Work is the contains the transaction history between the peers on the network. Hashcash scheme and the most widely deployed miners are ASIC- It provides cryptographic assurance that every entry is irrevocably based. Despite the popularity of Hashcash, two issues are com- scribed in its publicly viewable data structure. It is precisely because monly identified its use. Firstly, the high energy consumption of the blockchain provides a non-repudiatable, publicly distributed the scheme is perceived as wasteful because the solutions found pro- database of all historical transactions that fraudulent transactions vide no useful output, and secondly, the computational complexity known as double-spending are broadly mitigated. class of the scheme is not formally known. Based on these deficien- Since the Genesis Block of Bitcoin was mined, the aggregated hash cies, we propose a novel Proof of Work system which achieves the rate of the participating miners has grown exponentially [5]. As following goals: a result of this growth, cryptocurrency mining has been the fo- - to provide a fiscally incentivized platform for algorithm research cus of debate in relation to the energy consumption requirements that aims to optimize an NP-Hard computational problem. This to perform the underlying Proof of Work. The “Bitcoin Energy provides indirect insight into the P Versus NP Clay Institute Mil- Consumption Index” estimates the energy consumption of Bitcoin lennium problem, thus providing useful output. miners and compares this to various nation states and performs a - to construct a challenge within a known hard computational com- comparison on a per-transaction-basis to other payment systems, plexity class. such as VISA [14]. In Table1 we present a sample of cryptocurren- - to ensure the Proof of Work created is inclusive of ASIC hardware. cies and notable academic proposals based on the classification of Our proposal is a hybrid Proof of Work system that initially uses the their underlying Proof of Work schemes, and their current market Hashcash scheme and which subsequently constructs an instance capitalization in BTC. Rows 3 - 7 outline systems which address the of the NP-Hard Travelling Salesman Problem. We build on the am- energy waste issue by establishing Proofs of Useful Work, whilst bitions of others to develop Proofs of Useful Work. We differentiate rows 6 - 7 additionally address the issue of heuristic hardness as- our paper from related work as the first to consider the current sociated with the Hashcash Proof of Work [3]. Enumerating each capital investment into ASIC hardware, thus including them in our altcoin goes beyond the scope of this paper and [7] provides an proposal. exhaustive list of all currently traded cryptocurrencies, including those with Proofs of Useful Work. The largest difference our proposal incorporates when compared to 1 INTRODUCTION other Proof of Useful Work systems is the inclusion of ASIC mining The Hashcash-based [2] Proof of Work exists in Bitcoin, and sev- hardware. If we consider one of the top end ASIC miners on the eral other cryptocurrencies, to serve the two main purposes of market as of March 2018, it claims a hash rate of 14 TH/s and a minting new currency and providing consensus in a peer-to-peer hardware cost of 3000 USD [6]. Based on this data we develop the d TH/s network. Peers on the network mint new currency through a pro- following formula ¹ 14 TH/s º¹3000 USDº = λ USD, where λ is the es- cess known as mining. Mining can be described as expending elec- timated capital expenditure on ASIC hardware and d is the average tric energy by iteratively running the SHA256 hashing algorithm daily hash rate. Table2 and Figure1 summarize our findings 2. Clearly, the capital investment into ASIC hardware runs into the Permission to make digital or hard copies of all or part of this work for personal or billions of USD. If we consider the estimated 4.3 billion USD cur- classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation rently invested in ASIC hardware, this is equivalent to the Arkansas on the first page. Copyrights for components of this work owned by others than ACM 2018 state budget for education and transportation [8]. must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a 1For a detailed view of this process and clarification of definitions refer to[1]. History fee. Request permissions from [email protected]. of Proof of Work algorithm development prior to the landmark paper [23] can be found CRYBLOCK ’18, June 15, 2018, Munich, Germany most notably in [2, 15, 19]. History of digital cash and “pre-Nakamoto” cryptocurrency © 2018 Association for Computing Machinery. papers can be found in [9, 12, 16, 25]. ACM ISBN 978-1-4503-5838-5/18/06...$15.00 2We export the “Hash Rate” data from [5] for our calculations of average daily hash https://doi.org/10.1145/3211933.3211943 rate. Table 1: Current Proof of Work Variants Market Proof Proof of Work Sub- Cap Row of Work Use Case Perceived Benefits Perceived Limitations Variant (BTC) Variant [7] SHA256 output less Bitcoin original cryptocurrency Proof of computational complexity hardness 1 Hash Based 17,067,359 than target value [23] Work, widely used, matured heuristic, energy consumption Litecoin computational complexity hardness 2 Hash Based Scrypt key derivation widely used, matured 1,144,753 [27] heuristic only, energy consumption Number Cunningham Chain, Bi- Primecoin low market cap, alienates ASIC min- 3 academic application of solutions 1,367 Theoretic Twin Chain search [21] ers Number Gapcoin very low market cap, alienates ASIC 4 Prime gap search academic application of solutions 55 Theoretic [17] miners Resource trustworthy reporting currently only academic, possible academic fractional percentage Hash Based 5 Efficient on inherently useful implications of Spectre bug, alien- 0 only [28] energy waste Mining CPU workloads ates ASIC miners academic application, constructed Graph The- Cycle and structure academic currently only academic, alienates 6 problems have strongly conjectured 0 oretic search in large graphs only [26] ASIC miners computational complexity classes Linear academic application, verbose fine- Orthogonal Vector Prob- academic currently only academic, alienates 7 Algebra grained computational complexity 0 lem only [3] ASIC miners Based class conjecture provided We thus reason that Proof of Useful Work systems that do not 2 BACKGROUND, ASSUMPTIONS AND consider the use of ASIC hardware to be quixotic, and likely to PREREQUISITES face opposition in adoption. They additionally risk industrial scale waste of purpose-built physical hardware, that by design, cannot be 2.1 Background repurposed. It is specifically for this reason that we do not consider As we aim to construct instances of the Euclidean TSP, the subse- Proof of Stake or Proof of Space systems in our proposal as these quent claims attest to the computational hardness associated with schemes purposely exclude ASIC miners. seeking optimal solutions: We therefore propose a hybrid two-round Proof of Useful Work Claim 1: There is a polynomial time reduction from the Hamilton- scheme with a deterministic time interval which continues the use ian Cycle Problem to the TSP, Figure2[11, 20]. of ASIC hardware in the first round and subsequently constructs Claim 2: The Travelling Salesman Decision Problem is NP-Complete an instance of the NP-Hard Travelling Salesman Problem. Our hy- in the Strong Sense [18]. brid approach ensures the current use of ASIC miners that have Claim 3: It is possible to construct the NP-Hard Travelling Sales- already been purchased and deployed, thus avoiding the latter noted man Optimization Problem from the Travelling Salesman Decision waste scenario. Additionally, a hybrid approach addresses ASIC Problem [18] 3. mining energy usage by limiting the Hashcash-stage to a single round, bound by a deterministic time interval. Furthermore, by 2.2 Assumptions including an NP-Hard computational problem we build upon the Our construction of the TSP is on a Euclidean plane, therefore we ideas presented in [3] by offering a challenge within a well-known recall the following: computational complexity class whilst presenting an incentive to Definition 1 The TSP (Optimization) [18]. Input: Set Ω of n cities + enhance research into algorithm design, rather than the current sole ω1;:::; ωn , distance d¹ωi ; ωj º 2 R , where 1 ≤ i; j ≤ n and i , j, ambition of increasing brute force hashing power.