John Hardy [ARCHIVE] / is on Nostr

⚠️ This account is not associated with a real person. It's an archival account for mailing list messages.
🗓️ Active from 2016-10-11 to 2017-07-05
💬 Posted a total of 14 messages
📚 Participated in the following categories: bitcoin-dev
🔇 Please do not DM this user as it's used for archive purposes only.

Last Notes

2023-06-07 17:56:57

- reply

📅 Original date posted:2017-03-05
📝 Original message:> Nodes are by design not supposed to be identifiable in any way
I feel you're conflating social identifiability with technical identifiability. Sure, a node operator must always be able to remain anonymous, but nodes themselves require a certain level of identifiability otherwise there would be no means to communicate between them.
I agree that absolute node counts have their limitations, but that doesn't stop them being used as a measure and even propaganda tool. If something like this is a way to help highlight the latter when it is occurring I think it has value. I 'm not convinced that node identifiers or identity persistence would have any meaningful impact on privacy, though am open to being convinced otherwise.
________________________________
From: Btc Drak <btcdrak at gmail.com>
Sent: Sunday, March 5, 2017 1:27 PM
To: John Hardy; Bitcoin Protocol Discussion
Subject: Re: [bitcoin-dev] Unique node identifiers
Nodes are by design not supposed to be identifiable in any way, including persisting identities across IPs changes or when connecting over different networks (e.g. clearnet/tor). Anything that makes Bitcoin less private is a step backwards. Also absolute node count is pretty meaningless since only fully validating nodes that participate in economic activity really matter.
As a side note, this should probably have started out as a bitcoin-discuss post.
On Sat, Mar 4, 2017 at 4:04 PM, John Hardy via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org<mailto:bitcoin-dev at lists.linuxfoundation.org>> wrote:
The discussion of UASF got me thinking about whether such a method might lead to sybil attacks, with new nodes created purely to inflate the node count for a particular implementation in an attempt at social engineering.
I had an idea for an anonymous, opt-in, unique node identification mechanism to help counter this.
This would give every node the opportunity to create a node ‘address’/unique identifier. This could even come in the form of a Bitcoin address.
The node on first installation generates and backs up a private key. The corresponding public key becomes that node’s unique identifier. If the node switches to a new software version or a new IP, the identifier can remain constant if the node operator chooses.
Asking a node for its identifier can be done by sending a message the command ‘identify’ and a challenge. The node can then respond with its unique identifier and a signature for the challenge to prove it. The node can also include what software it is running and sign this information so it can be verified as legitimate by third parties.
Why would we do this?
Well, it adds a small but very useful piece of data when compiling lists of active nodes.
Any register of active nodes can have a record of when a node identifier was “first seen”, and how many IPs the same identifier has broadcast from. Also, crucially, we could see what software the node operator has been seen running historically.
This information would make it easy to identify patterns. For example if a huge new group of nodes appeared on the network with no history for their identifier they could likely be dismissed as sybil attacks. If a huge number of nodes that had been reporting as Bitcoin Core for an extended period of time started switching to a rival implementation, this would add credibility but not certainty (keys could be traded), that the shift was more organic.
This would be trivial to implement, is (to me?) non-controversial, and would give a way for a node to link itself to a pseudo-anonymous identity, but with the freedom to opt-out at any time.
Keen to hear any thoughts?
Thanks,
John Hardy
john at seebitcoin.com<mailto:john at seebitcoin.com>
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev at lists.linuxfoundation.org<mailto:bitcoin-dev at lists.linuxfoundation.org>
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20170305/3f0fadb5/attachment.html>

2023-06-07 17:56:56

- reply

📅 Original date posted:2017-03-05
📝 Original message:> Wouldn't this actually *need* to be a bitcoin address that is included in a block
I think it being a bitcoin address probably makes the most sense. The address could even be used for donations to incentivise identifier use.
I had not really envisaged this having any blockchain presence though. It was just an easy way to give third party node monitors like coin.dance and bitnodes.21.co a few more metrics.
That said, it would allow the creation of a 'nodepool', where each node could broadcast its latest status like a transaction, and every node has a register of active nodes. Like a mempool, but for nodes.
By leveraging the randomness of node identities, it could be that a deterministic subset of nodes randomly check that a new node status update is legitimate by querying the node directly (a small enough subset to not cause a DDOS). If a threshhold of those random checking nodes reports that the node either doesn't exist or is responding with conflicting information, this will become evident to the network and can be flagged.
This should paint a pretty accurate picture of the state of the network, and might also prove useful for developing lightning routing?
________________________________
From: Marcel Jamin <marcel at jamin.net>
Sent: Sunday, March 5, 2017 6:29 AM
To: John Hardy; Bitcoin Protocol Discussion
Subject: Re: [bitcoin-dev] Unique node identifiers
> This could even come in the form of a Bitcoin address.
Wouldn't this actually *need* to be a bitcoin address that is included in a block to get any real assurances about the age if this node id? Otherwise malicous nodes could lie and claim to have seen a brand new node id years ago already.
Even if included in a block, people could sell their aged IDs (if we were to rely on those for anything).
Also funding that ID address would might tie your economic activity (or even identity) to a node.
On 4 March 2017 at 17:04, John Hardy via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org<mailto:bitcoin-dev at lists.linuxfoundation.org>> wrote:
The discussion of UASF got me thinking about whether such a method might lead to sybil attacks, with new nodes created purely to inflate the node count for a particular implementation in an attempt at social engineering.
I had an idea for an anonymous, opt-in, unique node identification mechanism to help counter this.
This would give every node the opportunity to create a node ‘address’/unique identifier. This could even come in the form of a Bitcoin address.
The node on first installation generates and backs up a private key. The corresponding public key becomes that node’s unique identifier. If the node switches to a new software version or a new IP, the identifier can remain constant if the node operator chooses.
Asking a node for its identifier can be done by sending a message the command ‘identify’ and a challenge. The node can then respond with its unique identifier and a signature for the challenge to prove it. The node can also include what software it is running and sign this information so it can be verified as legitimate by third parties.
Why would we do this?
Well, it adds a small but very useful piece of data when compiling lists of active nodes.
Any register of active nodes can have a record of when a node identifier was “first seen”, and how many IPs the same identifier has broadcast from. Also, crucially, we could see what software the node operator has been seen running historically.
This information would make it easy to identify patterns. For example if a huge new group of nodes appeared on the network with no history for their identifier they could likely be dismissed as sybil attacks. If a huge number of nodes that had been reporting as Bitcoin Core for an extended period of time started switching to a rival implementation, this would add credibility but not certainty (keys could be traded), that the shift was more organic.
This would be trivial to implement, is (to me?) non-controversial, and would give a way for a node to link itself to a pseudo-anonymous identity, but with the freedom to opt-out at any time.
Keen to hear any thoughts?
Thanks,
John Hardy
john at seebitcoin.com<mailto:john at seebitcoin.com>
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev at lists.linuxfoundation.org<mailto:bitcoin-dev at lists.linuxfoundation.org>
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20170305/f716ff99/attachment-0001.html>

2023-06-07 17:56:15

- reply

📅 Original date posted:2017-02-13
📝 Original message:Hi Sergio,
Thanks for your response, interesting work, very excited for RSK.
I like the ephemeral payload, I suppose that aspect of my proposal could be described as ephemeral blockspace.
I'm curious about the challenge phase, what incentive do nodes to have to check other nodes' responses? Is any validation of responses mandatory, or does policing the system rely on altruism?
I also wondered how time-based responses are enforced? What prevents a miner censoring challenge responses so they do not get included in a block 'in time' - if inclusion within a block is the mechanism used?
I saw your tweet on Lumino - sounds very promising. Would be keen to take a look at the paper if you're looking for any additional review at this stage.
Regards,
John Hardy
________________________________
From: Sergio Demian Lerner <sergio.d.lerner at gmail.com>
Sent: Sunday, February 12, 2017 8:22 PM
To: John Hardy; Bitcoin Protocol Discussion
Subject: Re: [bitcoin-dev] Proof of Nodework (PoNW) - a method to trustlessly reward nodes for storing and verifying the blockchain
Hi John,
RSK platform (a Bitcoin sidechain) is already prepared to do something similar to this, although very efficiently. We set apart 1% of the block reward to automatically reward full nodes.
We have two systems being evaluated: the first is based on PoUBS (Proof of Unique Blockchain Storage) which uses asymmetric-time operations to encode the blockchain based on each user public key such that decoding is fast, but encoding is slow. The second is more traditional proof of retrievability, but it requires some ASIC-resistance assumptions.
In both cases, a special smart contract is being called at every block that creates periodic challenges. Every full node that wants to participate can submits a commitment to the Merkle hash root of a pseudo-random sequence of encoded blocks. Then the smart contract chooses random elements from the committed dataset, and each full node has a period to submit Merkle-proofs that such random elements belong to the commitment.
To prevent blockchain bloat we designed a very cool new type of transaction payload: Ephemeral Payload. Ephemeral payload is a payload in a transaction that gets discarded after N blocks if no smart contract does reference it. If is does, it's solidified forever in the blockchain.
Then there is a challenge phase where other full nodes can inform the smart contract if they find an error in the submitted responses. Then the smart contract ONLY evaluates the responses which have been questioned by users.
This way the smart contract does very little computation (only when a user misbehaves) and the blockchain normally does not store any proof forever (only the ones created by misbehaving users).
Because RSK/Rootstock has a very short block interval (10 seconds), all this happens very quickly and does not require much computation.
Best regards,
Sergio Lerner
Chief Scientist RSK (aka Roostock)
On Tue, Feb 7, 2017 at 8:27 AM, John Hardy via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org<mailto:bitcoin-dev at lists.linuxfoundation.org>> wrote:
Proof of Nodework (PoNW) is a way to reward individual nodes for keeping a full copy of and verifying the blockchain.
Hopefully they also do useful ‘traditional’ node activities too like relay transactions and blocks, but there isn’t really any way I can think of to trustlessly verify this also.
PoNW would require a new separate area of block space, a nodeblock, purely concerned with administering the system. A nodeblock is committed to a block as with SegWit. A recent history of nodeblocks needs to be stored by nodes, however the data eventually becomes obsolete and so does not need to be retained forever.
In order to prevent Sybil, a node must register an Bitcoin address by submitting an addNode transaction - along with a security deposit to prevent cheating.
This transaction will be stored in the nodeblock. Once a node can see that its addNode transaction has been added it can begin the PoNW process. The node’s registered address will be hashed with the block header of the block it wants to work on. This will determine exactly where within the blockchain to begin the PoNW.
The PoNW method could be as simple as creating a Merkle tree from the randomly generated point on the blockchain, though a method that is CPU/Memory heavy and less likely to be replaced by dedicated hardware like ASICs would be better. This process could not begin until the most recent block has been fully verified, and while being carried out should still enable normal relay activities to proceed as normal, since it shouldn’t tie up network at all. The data processed should also be mixed with data from the latest block so that it cannot be computed in advance.
A node can do as much PoNW for a block as it likes. Once finished it will then create a nodeWorkComplete transaction for that block with its final proof value, add how much ‘work’ it did - and create a couple of assertions about what it processed (such as there were x number of pieces of data matching a particular value during calculating). These assertions can be accurate or inaccurate.
The system will run in epochs. During each epoch of say 2016 blocks, there will be an extended window for PoNW transactions to be added to nodeblocks to limit minor censorship.
The random hash generated from a node’s address and blockhash will also be used to determine nodeWorkComplete transactions from a previous block that the node must also verify, and correctly calculate whether the assertions it made were true or false. The average PoNW that a node performed in its previous x nodeblocks will be used to determine the target PoNW for the node to verify - and this will randomly be a large number of smaller PoNW transactions, or a smaller number of large PoNW. This process will be deterministic based on that block and address hash. All the data will be put together in a transaction and then signed by the node addresses private key.
If a nodeWorkComplete transaction contains any incorrect information in an attempt to cheat the validation process a challenge transaction can be created. This begins a refereeing process where other nodes check the challenge and vote whether it is to be upheld or not. The losing node is punished by losing their accrued PoNW for that epoch and a percentage of their security deposit.
Nodes will also be punished if they broadcast more than one signed transaction per block.
In order to prevent nodes from having multiple keys registered - which would enable them choose to perform PoNW on a subset of the data that they hold - the share of reward that the node gets will be multiplied based on the number of blocks within an epoch that the node performs PoNW on. The share of reward is limited based on how much security deposit has been staked. The higher the PoNW the higher the deposit needed in order to claim their full allocation of any reward.
At the end of an epoch, with a wait period for any delayed or censored transactions or challenges to be included and settled up, the process of calculating the reward each node is due can begin. This will then be then paid in a regular block, and means for all the data involved in PoNW, the only permanent mark it makes on the main blockchain is for a transaction that pays all addresses their share of the reward at the end of epoch. Any miner who creates a block without correctly calculating and paying the due reward will have mined an invalid block and be orphaned.
The question of where and how much the reward comes from is a different one. It could come from the existing miner reward, or a special new tx donation fee for nodes. If there was some way for users to ‘donate’ to the reward pool for nodes this would increase the incentive for additional nodes to participate on the network in the event of centralisation.
This is a relatively effective way to create a reward for all nodes participating on a network. I’d be keen to field any questions or critiques.
Thanks,
John Hardy
john at seebitcoin.com<mailto:john at seebitcoin.com>
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev at lists.linuxfoundation.org<mailto:bitcoin-dev at lists.linuxfoundation.org>
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20170213/1173c865/attachment.html>

2023-06-07 17:56:14

- reply

📅 Original date posted:2017-02-07
📝 Original message:Proof of Nodework (PoNW) is a way to reward individual nodes for keeping a full copy of and verifying the blockchain.
Hopefully they also do useful ‘traditional’ node activities too like relay transactions and blocks, but there isn’t really any way I can think of to trustlessly verify this also.
PoNW would require a new separate area of block space, a nodeblock, purely concerned with administering the system. A nodeblock is committed to a block as with SegWit. A recent history of nodeblocks needs to be stored by nodes, however the data eventually becomes obsolete and so does not need to be retained forever.
In order to prevent Sybil, a node must register an Bitcoin address by submitting an addNode transaction - along with a security deposit to prevent cheating.
This transaction will be stored in the nodeblock. Once a node can see that its addNode transaction has been added it can begin the PoNW process. The node’s registered address will be hashed with the block header of the block it wants to work on. This will determine exactly where within the blockchain to begin the PoNW.
The PoNW method could be as simple as creating a Merkle tree from the randomly generated point on the blockchain, though a method that is CPU/Memory heavy and less likely to be replaced by dedicated hardware like ASICs would be better. This process could not begin until the most recent block has been fully verified, and while being carried out should still enable normal relay activities to proceed as normal, since it shouldn’t tie up network at all. The data processed should also be mixed with data from the latest block so that it cannot be computed in advance.
A node can do as much PoNW for a block as it likes. Once finished it will then create a nodeWorkComplete transaction for that block with its final proof value, add how much ‘work’ it did - and create a couple of assertions about what it processed (such as there were x number of pieces of data matching a particular value during calculating). These assertions can be accurate or inaccurate.
The system will run in epochs. During each epoch of say 2016 blocks, there will be an extended window for PoNW transactions to be added to nodeblocks to limit minor censorship.
The random hash generated from a node’s address and blockhash will also be used to determine nodeWorkComplete transactions from a previous block that the node must also verify, and correctly calculate whether the assertions it made were true or false. The average PoNW that a node performed in its previous x nodeblocks will be used to determine the target PoNW for the node to verify - and this will randomly be a large number of smaller PoNW transactions, or a smaller number of large PoNW. This process will be deterministic based on that block and address hash. All the data will be put together in a transaction and then signed by the node addresses private key.
If a nodeWorkComplete transaction contains any incorrect information in an attempt to cheat the validation process a challenge transaction can be created. This begins a refereeing process where other nodes check the challenge and vote whether it is to be upheld or not. The losing node is punished by losing their accrued PoNW for that epoch and a percentage of their security deposit.
Nodes will also be punished if they broadcast more than one signed transaction per block.
In order to prevent nodes from having multiple keys registered - which would enable them choose to perform PoNW on a subset of the data that they hold - the share of reward that the node gets will be multiplied based on the number of blocks within an epoch that the node performs PoNW on. The share of reward is limited based on how much security deposit has been staked. The higher the PoNW the higher the deposit needed in order to claim their full allocation of any reward.
At the end of an epoch, with a wait period for any delayed or censored transactions or challenges to be included and settled up, the process of calculating the reward each node is due can begin. This will then be then paid in a regular block, and means for all the data involved in PoNW, the only permanent mark it makes on the main blockchain is for a transaction that pays all addresses their share of the reward at the end of epoch. Any miner who creates a block without correctly calculating and paying the due reward will have mined an invalid block and be orphaned.
The question of where and how much the reward comes from is a different one. It could come from the existing miner reward, or a special new tx donation fee for nodes. If there was some way for users to ‘donate’ to the reward pool for nodes this would increase the incentive for additional nodes to participate on the network in the event of centralisation.
This is a relatively effective way to create a reward for all nodes participating on a network. I’d be keen to field any questions or critiques.
Thanks,
John Hardy
john at seebitcoin.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20170207/ff6c8c31/attachment-0001.html>

2023-06-07 17:55:59

- reply

📅 Original date posted:2017-02-02
📝 Original message:Currently in order to signal support for changes to Bitcoin, only miners are able to do so on the blockchain through BIP9.
One criticism is that the rest of the community is not able to participate in consensus, and other methods of assessing community support are fuzzy and easily manipulated through Sybil.
I was trying to think if there was a way community support could be signaled through transactions without requiring a hard fork, and without increasing the size of transactions at all.
My solution is basically inspired by hashcash and vanity addresses.
The output address of a transaction could basically have the last 4 characters used to signal support for a particular proposal.
To generate an address with 4 consecutive case-insensitive characters should be roughly 34^4 which is just over a million attempts. On typical hardware this should take less than a second.
An example bitcoin address that wanted to support the core roadmap might be:
1CLNgjuu8s51umTA76Zi8v6EdvDp8qCorE
or to signal support for a big block proposal might be:
1N62SRhBioRFrigS5eJ8kR1WYcfcYr16mB
Popularity could be measured weighted by fee paid per voting kb.
Issues are that this could lead to transactions been censored by particular miners for political reasons. Also miners might attempt to manipulate the results by stuffing their block with 'fake' transactions. Such attempts could be identified if a large number of voting transactions were not in the mempool.
Despite the limitations, I believe this offers a very accessible way to immediately allow the entire economic community to signal their support within transactions. The only cost is that of a tiny hashing PoW that should tie up a CPU for a barely noticeable amount of time, and could be implemented relatively easily into wallet software.
For its weaknesses, surely it is better than the existing methods we use to assess support from the wider economic community?
While it could just be used for signaling support and giving users a 'voice' on chain, if considered effective it could also be used to activate changes in the future.
Any thoughts welcome.
Thanks,
John Hardy
john at seebitcoin.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20170203/1916d1f2/attachment-0001.html>