Pre-and-post-meeting notes May 4th 2023 PoS/NSE

Creator

Matteo Campanelli

Created

May 8, 2023 1:21 PM

• NSE Tradeoffs today: to which extent things have changed since the last analysis?
• [NSEtW] states “[NSE] will give a ~2x cheaper sealing, more expensive windowpost and (not too) fast but expensive retrieval.”
• how much is that “more expensive” changed these days?
• Core issues: related to question above: if one wanted to solve NSE today, what are the core issues one should solve? (What would be sufficient to solve for NSE to be a good replacement)
• What would make NSE an appealing candidate?
• A type of response is through the pushback at the time
• code was not ready at the time; there was time pressure
• not construction relevant
• We know how to use NSE only with cost model (window post). Cost model only is risky. Therefore, this boils down: to can we remove winning post?
• we are a little bit more open nowadays with that
• Q: what is a backup plan if one switched to NSE?
• Auditing stage hash higher costs (windowpost) for the prover.
• there are more challenges
• today 10 challenges per 32 gb
• instead in NSE you’d have roughly 16 per 32 gb
• 30% increase in challenges
• Q: what is an acceptable increase? (if 30% is not, what would be?)
• Comparison to SDR (some output for today) What is a way in which we can summarize the difference in which the graph of SDR and the one of NSE work in a few sentences?
• Tunability:
• To which extent can we say that NSE is “more easily tunable” (if at all) than SDR?
• Q: if you magically switched to NSE and you had no loss what happens i nthe long term with security? is it more easily tunable as a constr?
• unclear, but open, there is the possibility that increasing the number of layers may offer an avenues in terms of tunability compared to SDR
check the above
• Retrievability (NSE)
• NSE seems to have way faster retrievability (unsealing). This is not causing issues with sealstacking and such? What do we know about the implications of this fast unsealing in which model?
• Retrievability (general)
• this is more of a general question but can we summarize again what we know about when asymmetric sealing/unsealing is possible/impossible in which model?

Links

[NSEtW] NSE The World

Notes during the meeting

• part of motivation: easier to analize
• butterfly nodes
• also used in PIE paper https://dl.acm.org/doi/pdf/10.1145/3319535.3354231
• some explanation for these nodes:
• imagine we represent every node index in some base, e.g. base d_B=16 (this name and number is from the NSE paper) with L_B=7 digits (this name and number are also from the NSE paper).
• Each node in the first layer is connected to those nodes in the layer above that have the same exact digits except the last one (in base 2 it’s two connections, in base 10 it’s 10 connections; here it’s d_B connections)
• Each node in the second layer is connected to those nodes in the layer above that have the same digits except the second to last one
• So on, with each layer i being responsible for changing digits in position i and retaining all other digits
• Thus, you can route from any node on layer 1 to any node in the last year by changing one digit at a time. This means every node in the last layer is an ancestor of every node on layer 1.
• Sort of routing on a hypercube of size N, but exploded into log_{d_B} N layers, one for each dimension
• Some other random notes on the construction:
• total deg is 384 but then divided in batches of 8
• there is not one single graph but it’s like separate columns […]
• motivation for this design: faster sealing/unsealing through windows
• when decoding, e.g., you do not make the graph for the whole sector but just for the single window you are interested in
• @Matteo Campanelli follow up question I have: is this only faster decoding for local access to the sector? i.e. do I gain only if I am decoding a certain part of the sector? (it is possible I can just parallelize this local speedup and then achieve global speedup)
• is there room for improvement in NSE proof in the doc?
• it seems like it is quite tight as in it’s the result of many iterations.
• impact of degree
• what does it do for us to have a lower deg?
• higher deg gives better expansion, e.g. true for SDR
• in SDR e.g higher expansion gives fewer layers but the gain is not much in the SDR-specific case
• for NSE, proof uses the property that beta = 1-alpha and then you need a high degree for this as well.
• so is having a high degree a problem?
• sealing becomes more expensive because you need to prove knowledge of all the predecessors in a (SNARK) proof
• Some next actions:
• Leo has some follow up questions about proof
• Q: (for example ) achieving smoothness through a less threshold-y approach
• Other question: if you tune the parameters to match SDR’s width, would you win?
• but then what happens to the gains for retrieval?
• but can’t you do the same with SDR and make it narrower?
• it seems like you might, but that would give you a worse pos