Posted by Jeremy Spilman
Mar 24, 2015/05:14 UTC
Sergio Lerner has proposed a protocol for Proof of Storage called "Proof of Local storage" which can be useful in any application to try to prove a keyed copy of some data. Two protocols can be performed to prove local possession: (1) The verifier sends a seed to derive some n random indexes, and the prover must respond with the hash of the decrypted blocks within a certain time bound. (2) The verifier chooses a seed n, and then pre-computes the encrypted blocks derived from the seed using the prover's IP. Then the verifier sends the seed, and the prover must respond with the hash of the encrypted blocks within a certain time bound. Both protocols can be made available by the client, under different states. For example, new nodes are only allowed to request protocol 2 and are allowed to periodically perform protocol 1 after mutual authentication. However, there are few questions raised on this proposal. For instance, in Protocol 1, it is asked whether the prover is hashing random blocks of decrypted, as-in raw, blockchain data, and what does this prove other than fast random IO of the blockchain? The verifier keeps blocks in the keyed format and can decrypt quickly to provide raw data or use the keyed data for hashing to try to demonstrate they have a pre-keyed copy. In Protocol 2, a full-node challenger could have to do the computation first and also include something like HMAC(identityKey, expectedResult). The prover could then know if the challenger was honest before returning a result and blacklist them if not. A new-node could see if different servers all returned the same challenge response, but they would have no way to know if the challenge response was technically correct or sybil. There is also a question about the effect of spinning disk versus SSD. Seek time for 1,000 random reads is either nearly zero or dominating depending on the two modes. I wonder if a sequential read from a random index is a possible trade-off; it doesn't prove possession of the whole chain nearly as well, but at least iowait converges significantly.
TLDR
We’ll email you summaries of the latest discussions from authoritative bitcoin sources, like bitcoin-dev, lightning-dev, and Delving Bitcoin.
We'd love to hear your feedback on this project?
Give Feedback