Lecture 8: Alternative Mining Puzzles

What this lecture covers

Bitcoin's mining puzzle shapes who can profitably mine and how power concentrates in the network, so this lecture asks what would happen if the puzzle were designed differently. It works through several alternative puzzle families: ones that resist specialized ASIC hardware, ones that turn wasted computation into something useful, ones that discourage centralized mining pools, and ones that remove computational work altogether.

The lecture sits between the core mining mechanics covered earlier in the course and the next lecture on Bitcoin as a platform for applications beyond currency. After watching, you should be able to explain why a puzzle needs to be "progress-free," describe how a memory-hard hash function like scrypt resists ASICs, and compare proof-of-work against proof-of-stake and related virtual mining schemes.

Key ideas

• Progress-free puzzle: a well-designed mining puzzle gives every miner a chance of finding the next solution proportional to their hash power, rather than always rewarding the fastest miner, which a purely sequential puzzle would do.
• ASIC resistance: designing puzzles to narrow the performance gap between specialized mining chips and ordinary CPUs or GPUs, aimed at lowering the barrier to entry and limiting the power of large ASIC manufacturers.
• Memory-hard puzzle: a puzzle whose cost is dominated by memory rather than raw processing, since memory performance improves much more slowly than processors, which limits the advantage custom hardware can gain over time.
• scrypt: a memory-hard hash function used by altcoins like Litecoin; it fills a large block of memory with sequential hash values, then reads it back in a pseudo-random order determined by an accumulator value.
• Cuckoo Cycle: an alternative memory-hard puzzle based on finding a cycle of a fixed size in a pseudo-random graph; it is attractive because verifying a solution requires no random-access memory, only a handful of hash computations.
• Proof of useful work: puzzles whose computation has value outside Bitcoin, such as Primecoin's search for Cunningham chains of prime numbers or Permacoin's proposal to repurpose mining hardware as distributed file storage.
• Non-outsourceable puzzle: a puzzle design requiring the private key tied to the reward address to compute a solution, so that any pool member who finds a solution can claim it directly, discouraging large centralized mining pools.
• Virtual mining (proof of stake and variants): puzzle designs where winning depends on coins committed to the system rather than computational hardware, removing the energy cost of proof of work.

Walkthrough

Essential puzzle requirements and the progress-free property (2:54)

The lecture opens by restating why the mining puzzle matters: it sets the incentive system that steers participant behavior. Before covering alternatives, it establishes baseline requirements any puzzle must meet, including cheap verification and adjustable difficulty. It then focuses on the progress-free property: a puzzle where every miner's chance of winning is proportional to their hash power. A sequential puzzle that always takes exactly n steps is used as a counterexample, since it always rewards whichever miner computes fastest, leaving no incentive for smaller miners to participate.

ASIC resistance and memory-hard puzzles (5:59)

The lecture explains the shift from CPUs and GPUs to FPGAs and now ASICs in Bitcoin mining, and the concerns this raises: high barriers to entry, consolidation among a few chip manufacturers, and the risk that a manufacturer could hoard a superior design. Memory-hard puzzles are introduced as the main countermeasure, exploiting the fact that memory performance improves far more slowly than processor performance under Moore's law, so a puzzle bottlenecked on memory narrows the advantage of custom hardware.

scrypt and Cuckoo Cycle in detail (9:48)

The lecture walks through scrypt's two-step construction: writing a table of n sequentially hashed values, then reading them back in an order driven by an accumulator, which forces a memory-time trade-off if less memory is used. It notes scrypt's use in altcoins such as Litecoin and in password hashing, and flags that scrypt ASICs already exist, casting doubt on how ASIC-resistant it really is. It then introduces Cuckoo Cycle, which builds a pseudo-random graph from hash values and looks for a fixed-size cycle; its main advantage over scrypt is that checking a solution needs no random-access memory, only recomputing edge endpoints.

The counterargument and proof of useful work (18:16)

A counterargument is presented: SHA-256 is well understood, ASIC designs for it are already close to optimal, and there may be little to gain from chasing ASIC resistance. The lecture then turns to proof-of-useful-work schemes, aiming to redirect the energy spent on mining toward something beneficial. It covers Primecoin, which requires finding chains of prime numbers (Cunningham chains), and Permacoin, a proposal to repurpose mining investment into distributed storage of a shared file, including a variant that could reward miners for storing Bitcoin's UTXO set.

Non-outsourceable puzzles and the vigilante attack (32:25)

This section addresses the risk of centralized mining pools, illustrated with the "vigilante attack," where a disgruntled pool member discards any solution they find rather than reporting it to the pool operator, at some cost to themselves but with no direct gain. Non-outsourceable puzzles are proposed to give that vigilante a direct incentive: solving the puzzle requires signing with the private key that also claims the reward, so any pool participant who finds a solution can take it. The lecture also notes the tradeoff that this would suppress harmless decentralized pools like P2Pool and could push miners toward even riskier hosted mining services.

Virtual mining and proof of stake (37:04)

The final section covers "virtual mining," where the step of spending money on hardware and electricity is removed entirely and mining power is instead based on coins committed to the system. It walks through proof of stake, proof of burn, proof of deposit, and proof of activity as variations, and discusses the argument that virtual mining raises the cost of a 51% attack because an outside attacker would have to buy up a large share of the coin supply rather than simply acquiring hardware. It closes by noting the open question of whether real computational and energy expenditure provides security that virtual schemes cannot replicate.

Before you watch

• Be familiar with Bitcoin's basic mining puzzle (SHA-256-based proof of work) and the idea of mining difficulty from earlier lectures in this course.
• Recall how mining pools and the pool operator's role work, since the discussion of the vigilante attack and non-outsourceable puzzles builds directly on it.
• A general sense of hash functions and Merkle trees will help with the scrypt and Permacoin explanations.

Check your understanding

1. Why does a strictly sequential proof-of-work puzzle fail to be progress-free, and why does that matter for smaller miners?
2. How does scrypt use memory to resist ASIC optimization, and what limits how memory-hard it can practically be made?
3. What makes Cuckoo Cycle's verification step different from scrypt's?
4. Explain the vigilante attack and how a non-outsourceable puzzle changes the incentive behind it.
5. Why might virtual mining schemes like proof of stake raise the cost of a 51% attack compared to proof-of-work mining?