2-hop Blockchain: Combining Proof-of-Work and Proof-of-Stake Securely

Abstract

Bitcoin-like blockchains use a proof-of-work (PoW) mechanism, where security holds if the majority of the computing power is under the control of honest players. However, this assumption has been seriously challenged recently, and Bitcoin-like systems fail if this assumption is violated. In this work we propose a novel 2-hop blockchain protocol that combines PoW and proof-of-stake (PoS) mechanisms. Our analysis shows that the protocol is secure as long as the honest players control a majority of the collective resources (which consist of both computing power and stake). In particular, even if the adversary controls more than 50% of the computing power, security still holds if the honest parties hold sufficiently high stake in the system. As an added contribution, our protocol also remains secure against adaptive adversaries.

T. Duong—Work supported in part by a research gift from IOHK.

J. Katz—Portions of this work were done while at the University of Maryland, and were performed under financial assistance award 70NANB19H126 from U.S. Department of Commerce, National Institute of Standards and Technology.

P. Thai and H.-S. Zhou—Work supported in part by NSF award #1801470, and a research gift from Ergo Platform.

A Unique Signature Schemes

Unique signature schemes were introduced in [26], which consists of four algorithms, a randomized key generation algorithm $\mathsf {KeyGen}$, a deterministic key verification algorithm $\mathsf {KeyVer}$, a deterministic signing algorithm $\mathsf {Sign}$, and a deterministic verification algorithm $\mathsf {Verify}$. We expect for each verification key there exists only one signing key. We also expect for each pair of message and verification key, there exists only one signature. We have the following definition.

Definition 4

We say $(\mathsf {KeyGen}, \mathsf {KeyVer}, \mathsf {Sign}, \mathsf {Verify})$ is a unique signature scheme, if it satisfies:

• Correctness of key generation: Honestly generated key pair can always be verified. More formally, it holds that

  $$\Pr \left[ \begin{array}{l} (\textsc {pk},\textsc {sk})\leftarrow \mathsf {KeyGen} (1^\kappa ) \ : \ \mathsf {KeyVer} (\textsc {pk}, \textsc {sk})=1 \end{array} \right] \ge 1-\mathsf {negl} (\kappa )$$

• Uniqueness of signing key: There does not exist two different valid signing keys for a verification key. More formally, for all $\textsc {ppt}$ adversary $\mathcal {A}$, it holds that

  $$\Pr \left[ \begin{array}{l} (\textsc {pk},\textsc {sk} _1, \textsc {sk} _2)\leftarrow \mathcal {A} (1^\kappa ) \\ \ : \ \mathsf {KeyVer} (\textsc {pk},\textsc {sk} _1)=1 \wedge \mathsf {KeyVer} (\textsc {pk},\textsc {sk} _1)=1 \wedge \textsc {sk} _1 \ne \textsc {sk} _2 \end{array} \right] \le \mathsf {negl} (\kappa )$$

• Correctness of signature generation: For any message x, it holds that

  $$\Pr \left[ \begin{array}{l} (\textsc {pk},\textsc {sk})\leftarrow \mathsf {KeyGen} (1^\kappa ); \sigma := \mathsf {Sign} (\textsc {sk},x)\\ \ : \ \mathsf {Verify} (\textsc {pk},x,\sigma )=1 \end{array} \right] \ge 1-\mathsf {negl} (\kappa )$$

• Uniqueness of signature generation: For all $\textsc {ppt}$ adversary $\mathcal {A}$,

  $$\Pr \left[ \begin{array}{l} (\textsc {pk},x, \sigma _1, \sigma _2)\leftarrow \mathcal {A} (1^\kappa ) \\ \ : \ \mathsf {Verify} (\textsc {pk},x,\sigma _1)=1 \wedge \mathsf {Verify} (\textsc {pk},x,\sigma _2)=1 \wedge \sigma _1 \ne \sigma _2 \end{array} \right] \le \mathsf {negl} (\kappa )$$

• Unforgeability of signature generation: For all $\textsc {ppt}$ adversary $\mathcal {A}$,

  $$\Pr \left[ \begin{array}{l} (\textsc {pk},\textsc {sk})\leftarrow \mathsf {KeyGen} (1^\kappa );(x,\sigma )\leftarrow \mathcal {A} ^{\mathsf {Sign} (\textsc {sk},\cdot )} (1^\kappa ) \\ \ : \ \mathsf {Verify} (\textsc {pk},x,\sigma )=1 \wedge (x,\sigma ) \not \in Q \end{array} \right] \le \mathsf {negl} (\kappa )$$

  where Q is the history of queries that the adversary $\mathcal {A}$ made to signing oracle $\mathsf {Sign} (\textsc {sk},\cdot )$.