22

It is generally thought of that Proof of Work is more secure than competing consensus algorithms.

What security guarantees does using a Bitcoin PoW provide, and how does Ouroboros Praos compare? Will future versions of Ouroboros improve the security of the network?

4
  • 1
    There are several implementations of Ouroboros. Are you referring to any particular one? cardano docs. May 4 at 5:03
  • I suppose I'm referring to the one in place today (Ouroboros Praos), but I'm interested in what future versions may contribute to this question. Question updated.
    – soccer193
    May 4 at 5:07
  • 3
    This IOHK blog post addresses security in the various versions of Ouroboros at a high level, but doesn't really answer the question asked
    – Ben NOBLE
    May 4 at 5:52
  • 1
    I think that's one of the subtle things that Ergo's PoW will be able to help since both share the same EUTxO model. May 4 at 19:43
10

Initially, consensus protocols using Proof of Stake for sybil resistance faced several technical problems that needed to be addressed in order to provide sufficient security properties in a trustless environment. Among the most important we have:

  1. The nothing at stake problem
  2. Long range attacks
  3. The need for a decentralised and robust source of randomness

The fact that "stake" is not tightly coupled with a physical resource (like energy in PoW) means that when a fork of the chain occurs, there is no direct incentive for a node to pick only one chain. With PoW, validating an additional chain has a significant energy cost for a node. In PoS, it's just some marginal disk, computation and bandwidth usage. Similarly, a malicious node can create an alternative chain from genesis and present it to the network as the legitimate chain, since there is no much cost involved in doing so. These two problems I just described correspond to the nothing at stake and the long range problems, respectively, and for a time were considered unsolvable.

Problem 3. was relatively easy to solve. Ouroboros classic introduced publicly verifiable secret sharing (PVSS), but it was not robust to adaptive attacks (see more details in the linked paper). Then Ouroboros Praos introduced a much more robust mechanism based on Verifiable Random Functions (VRF). In short, with VRFs the pieces of data required to compute the random beacon are computed locally by each node, and are not broadcasted to the network. This way, an attacker cannot know who the next block proposer will be.

The long range problem, also known as the bootstrapping problem, was perhaps one of the most difficult. In simple terms, it is about how to guarantee that a new node joining the network can actually reconstruct the whole blockchain history of the legitimate chain. PoW chains solve this issue with the simple and elegant longest chain rule, and that's probably one of the main reasons why they were considered superior in terms of security. As far as I know, Ouroboros Genesis was the first PoS-based protocol that solved this analytically.

Finally, every blockchain design needs to meet properties such as guaranteed finality and liveness. All the Ouroboros family of protocols provide analytically proven finality and liveness properties under certain theoretical conditions. It is important to make this distinction because the theoretical models might not always take into account all the possible attacks and disruptions that may happen in real world conditions. Also, research results from different blockchains are typically presented over a different set of theoretical assumptions, so it's important to understand them before comparing them.

That being said, recent versions of Ouroboros have been studied under a rather relaxed set of conditions, and according to the results presented in the papers, their security properties are comparable to those of Bitcoin.

2
  • I take it that problem 1 is no longer considered unsolvable, but has it actually been solved? Does any of the Ouroboros variants you cited solve it?
    – kjo
    May 9 at 14:07
  • 2
    @kjo yes, essentially solving 1. is equivalent to guaranteeing persistence/finality. All ouroboros protocols provide a solution for this, but under different system models.
    – vaz
    May 10 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.