When and where: 15th/16th May 23 in Madrid

Participants: Carla Rafols, Luca Nizzardo, Leo Reyzin, Matteo Campanelli

Flavor of discussion items in general:

• technical aspects of current PoS and Filecoin protocol
• exploration for:
• new cost assumptions
• new analysis for SDR and NSE
• we have sketches of improved analysis for
• other theoretical results that could be formalized (sealstacking and lower bounds for asymmetric retrievability)

Main decision of the discussion: paper on PoS

We think it would be of the highest impact to write an article in order to achieve all goals we have.

1. obtain and describe improved constructions for PoS that can be high short-term impact
1. we know how to modify NSE to improve its efficiency (e.g. see here )
2. we strongly believe the SDR analysis can be improved and made tighter
2. create excitement and momentum on PoS problems so that other researchers (many of which with an academic background) will work on it
3. have a SPOT (Single Point of Truth) paper for PoS problems for academics.
1. Ben Fisch’s paper (PoRep) was a candidate to be (3). It has both a model (PoRep) and a construction for that model.  Where it falls short as a SPOT for PoS in Filecoin, though, is: that the model is not the one Filecoin currently uses (researchers cannot pick the model used there to build new PoS directly); the construction is not quite the one we use. We would like to write a paper without this shortcomings and that can be the point of reference for Filecoin.
4. Good accessible communication of technical results (current writeups are too technical and they require guidance by internal experts in cryptonet; this does not scale and keeps even academic readers at a distance)

We want to progress on all these goals at the same time through one self contained paper. We believe that framing some of our efforts for the next two-three months as a paper is going to give the highest impact. Other efforts (discussed below) could be followed in parallel and with lower attention.

More on the article, its content and why it would achieve the above.

• it would be submitted (and written at a level at which it could be accepted) at very good conferences to gain visibility
• it would have the simplest model(s) of PoS and a discussion of why that definition can be lifted to the context of Filecoin
• it would have clear technical overviews explaining constructions and proofs accessibly
• it would discuss important efficiency metrics that are desiderata in systems such as Filecoin
• it would have a new clear framework (”tightness in multiple dimensions”) as a way to frame the problem of new PoS that could be of use

Other discussion item: Results it would be good to have

(NB: we decided not to pursue them as main effort for now given their lower impact)

• Formal treatment of Sealstack
• Lower bounds for asymmetric retrieval
• cost model
• latency model
• Understanding window width (narrower windows→faster local retrieval):
• With latency, you need wide windows, because multiple windows can be parallelized
• With cost, it’s not clear that wide windows are important. How narrow can you make them?
• Sealing can be done in bulk, while both unsealing and cheating are usually individually.
• Can we take advantage of bulk sealing in some formal analysis? Current analysis is typically limited to a single window. But if we have a window size for sealing and a different one for testing and unsealing, do we get anything better?
• Are there ways to outsource sealing? If we do, who puts up the collateral? Can this be solved by making PoRep noninetractive?
• One way to noninteractive PoRep is via Fiat-Shamir, in which case collateral may not be needed? But Fiat-Shamir means higher soundness is needed. Can partial interactivity help: first Fiat-Shamir to select a large set of possible challenges and then interactivity to subselect?

Other discussion item: Expansion in replica

When the provider generates R, R is going to be potentially larger than D. Currently it is as much as D (although in practice, as far as I understand, it is only roughly so). What are acceptable ratios |R|/|D|?

Other discussion item: alternative cost assumptions

Other notes

On notion of tightness (in progress)

See:

Three different “flavours” of defs of tightness in literature:

• (probably) Krzysztof’s
• Ben’s
• the one proposed in Madrid (which is more like a family of definitions)