cuckoo

I read the FAQ and Pocket Manifesto. It provides zero information on the maximum hashrate of your device on various PoW systems. So the user has no idea whether, given current blockchain hashrates and coin prices, they can expect to make $0.01 per day or $0.00001 per day. Do you have any idea? What is the expected mining time to make 1 satoshi? Perhaps you could state that the user can only expect to make back a small fraction of the $169 cost in a lifetime of mining, and that its primary purpose is instead that of a functional piece of art, which I think it is. Unfortunately it cannot mine with the PoW I created [1], or I might be tempted to buy one. [1] https://github.com/tromp/cuckoo

The problem of finding cycles in (pseudo randomly generated) graphs is actually one of the first examples of an asymmetric Proof-of-Work puzzle [1]. Asymmetry means that while finding a cycle takes a lot of memory and effort, a solution can be verified instantly. Several of the suggested algorithms were in fact implemented in the various Cuckoo Cycle solvers [2]. But by maintaining directed paths, my union-find based algorithm did identify the entire cycle and not just the cycle completing edge [1] (implemented in [3]). This algorithm suffers from three problems though. One, it only finds one among a set of interconnected cycles. Second, it's rather slow, being latency bound by the random memory accesses. Third, it uses much more memory than needed. So repeatedly trimming edges with only one endpoint is a much faster approach. And for the

Asymmetric PoW algorithms, such as Cuckoo Cycle [1] or the poorly named Equihash [2] (which is not a hash function) do not lend themselves to password hashing, since a given problem instance can have 0 or 1 or many solutions. [1] https://github.com/tromp/cuckoo [2] https://en.wikipedia.org/wiki/Equihash

I found the full technical report describing the LOCKSS forerunner to bitcoin available for downloaded at [1]. Interestingly, LOCKSS used a memory bound Proof-of-Work, where both prover and verifier perform a random walk in a 1GB table. But the prover had to do this many times, to obtain some final hash with many leading zeroes. This was before the invention of asymmetric PoW systems like Cuckoo Cycle [2] where the PoW can be verified with no memory use. > Nakamoto's scheme motivated early adoption by rapidly inflating the currency with large block rewards, then exponentially decreasing them, so he could claim the currency was non-inflationary (eventually). The result was that early adopters accumulated large numbers of Bitcoin, and the Gini coefficients of cryptocurrencies became extreme. Technically, exponentially decreasing rewards is

In late 2013 I came up with the first memory hard Proof-of-Work puzzle, Cuckoo Cycle [1], based on finding fixed-length cycles in random graphs. Recently, custom chips were developed to solve it more efficiently than GPUs can. That probably had more impact than the Binary Lambda Calculus language I designed [2] or the logical rules of Go I co-formulated [3]. Computing the number of Go positions [4] or approximating the number of Chess positions [5] had little impact beyond satisfying my intellectual curiosity. [1] https://github.com/tromp/cuckoo [2] https://tromp.github.io/cl/cl.html [3] https://tromp.github.io/go.html [4] https://tromp.github.io/go/legal.html [5] https://github.com/tromp/ChessPositionRanking#readme

My work started in 2013 coming up with an instantly verifiable memory hard proof of work after realizing how another proposal failed to achieve that [1]. Much later I helped architect a blockchain that aims for maximum simplicity and a pure linear emission. The use case is decentralized currency without the unnecessary complexity, bloat, grifting and speculation. [1] https://github.com/tromp/cuckoo

Would you say that other proof of work puzzles such as Cuckoo Cycle [1], which asks for a fixed length cycle in a large random bipartite graph, is a brute force search as well? Because that one is certainly not solved by trying all possible cycles. [1] https://github.com/tromp/cuckoo

SRAM is the only type of memory offering true random access. DRAM can suffer so much on pure random access that completely rewriting your algorithm to have mostly sequential access to 20x more memory still ends up 4x faster (lean miner vs mean miner in [1]). [1] https://github.com/tromp/cuckoo

As author of the Cuckoo Cycle Proof-of-Work puzzle [1] and core developer of a blockchain that offers zero financial rewards for its creators and early adopters, I strongly take issue with your characterization. I agree that most projects are cash grabs, but that's no excuse for insulting all developers without exception. [1] https://github.com/tromp/cuckoo

Appearance of fixed length cycles in random graphs makes a nice Proof-of-Work puzzle, that takes lots of SRAM to solve efficiently [1], while remaining instantly verifiable. [1] https://github.com/tromp/cuckoo

This is exactly what the Cuckoo Cycle [1] family of graph-theory Proof-of-Work systems gets its name from. The puzzle instances are pseudo-random graphs in which edges are defined by the siphash24 hash function, and the solutions are cycles of length L, which have a chance of about 1/L of occurring. [1] https://github.com/tromp/cuckoo

For some problems, there is a choice of how to organize its data structures. One that requires random access, and another that is mostly sequential access. The latter might take an order of magnitude more space, while still being faster. An example of such a problem is the Cuckoo Cycle Proof-of-Work [1]. [1] https://github.com/tromp/cuckoo

> I’ve had extreme trouble to find workloads that would stress the GPU sufficiently to take advantage of the available bandwidth. Would love to see how well the GPU runs a memory-bound Proof-of-Work like Cuckatoo Cycle [1]. [1] https://github.com/tromp/cuckoo

This is using the hashcash PoW. The use of scrypt as underlying hash function is a rather poor choice though, as scrypt's memory hardness makes PoW verification unnecessarily expensive. To limit the damage, a rather small memory footprint is used for scrypt. It's perfectly possible to make a memory hard PoW that's instantly verifiable, by using something other than hashcash. Examples include Cuckoo Cycle [1], and Equihash [2]. These can easily be made to use hundreds of MB in solving, while verification is memory less. [1] https://github.com/tromp/cuckoo [2] https://en.wikipedia.org/wiki/Equihash

A good PoW should have very fast verification. That's why scrypt makes a poor choice of PoW (technically, the hashcash PoW with scrypt as hash function). It's quite possible to have an instantly verifiable memory hard PoW, where only finding solution takes lots of memory, while verification takes none. For example, Cuckoo Cycle and its variants [1]. [1] https://github.com/tromp/cuckoo