Why isn't 'classic' Multi-Paxos Byzantine Consensus used for public Blockchains?

Any solution to the Byzantine General's Problem can be used as a consensus method to base a distributed ledger on.

Why then, did Satoshi Nakamoto choose for the super-expensive (in electricity and CPU cycles) Proof-Of-Work?

I can think of these reasons:

Proof of Work takes time, which means that blocks take time. (But nowadays this is actually a drawback?)
Miners are paid out by the PoW. (But couldn't this work in a Multi-Paxos environment as well, where basically all miners would like to become leader for the next round?)
A Proof-of-Work chain will still work if the network netsplits into two pieces. This will create separate blocks in each half of the network, actually being a problem when the two halves are joined again (because then one of the two chains is discarded, which, if the netsplit took multiple minutes before healing, means that people and external systems might have acted based on their now-invalid balances.)

Clearly these reasons are not good enough. So what real reasons are there to use Proof-of-Work over e.g. Multi-Paxos or another 'classical' solution to the Byzantine Generals Problem?

consensus

Qqwy

Posted 2017-11-13T12:16:32.183

Reputation: 131

1Bitcoin isn't even eventually consistent, only probabilistically consistent (the chance that a particular state is final approaches 1 exponentially, but never reaches it). – Pieter Wuille – 2019-07-06T02:20:46.127

Isn't Byzantine generals problem unsolvable? https://en.wikipedia.org/wiki/Two_Generals%27_Problem

– croraf – 2017-11-13T12:51:04.863

1@croraf This is why all BFT systems, including Bitcoin, claim to be eventually consistent. That is: As long as some proper message in the very far future does arrive between nodes, it will be consistent. They are thus only solutions to this restricted version of the problem. The general version is indeed proven to be unsolvable. – Qqwy – 2017-11-13T17:14:52.500

Answers

Consensus participants are not known ahead of time, so you don't know whom to listen to and whom to ignore. Also identities are extremely weak in Bitcoin (miners don't have identities at all, users usually just a cheap keypair), so sybil attacks (https://en.wikipedia.org/wiki/Sybil_attack) are cheap.

Sukrim

Posted 2017-11-13T12:16:32.183

Reputation: 51

Nakamoto Consensus has some properties that are superior to BFT algorithms. (It also has some properties that are inferior, but that's another story).

First, BFT algorithms assume a central authority picks who the participants are. NC, on the other hand, allows anyone to attempt to win the next round.

Second, BFT algorithms generally require 2/3 + 1 (e.g. 67%) of the participants are honest. NC sets a lower threshold of 1/2 + 1 (e.g. 51%). That's because NC's PoW prevents a node from broadcasting two messages at once.

Finally, NC has the interesting attribute that the moment a miner "wins", they also simultaneously choose the transactions they are going to include on the block. This means there is no window of opportunity for an attacker to attempt to influence the winning miner to break the rules.

Note that Paxos is not a BFT algorithm. Paxos solves for stop-fail failures. The worst a node can do is stop working. Paxos does not solve for "byzantine" failures, where a node can try to say two different things.

Yaoshiang

Posted 2017-11-13T12:16:32.183

Reputation: 46

Proof-of-work creates a relation between a miners ability to vote on what the next block should be, and a real-world expense (electricity costs). You cannot spoof proof-of-work results, so you cannot spoof the network by pretending to do work that you didn't actually do.

If there was no cost to running a 'mining node' in the network, then what would happen when an entire Amazon server warehouse worth of nodes join the network? You need a method to defend against sybil/ddos attacks.

To answer your points:

taking time is essential, it means miners are working to solve the next block. Their investment is very closely related to the network security. More investment = more hashpower = more difficult to change the history = more security.
I think the leader in a multi-paxos environment could be paid something like a block reward
This is true, it sometimes happens and leads to an 'orphaned block'. In relation to your first point, shorter blocktimes actually lead to higher orphan block rates, due to a higher chance of two miners finding their own valid blocks within a short timespan of eachother.

In relation to Paxos, what I am reading about multi-paxos says that a leader node needs to be trusted, so it seems a level of trust is required in these systems. Paxos systems also hold a state, while the bitcoin blockchain is stateless, so that is a difference in security/failure modes as well.

chytrik

Posted 2017-11-13T12:16:32.183

Reputation: 10 276

Please don't edit spam to remove the links, like you did on this post. Doing so makes it harder to appropriately deal with the spam post and results in the spam existing on the site longer, along with giving the spammer the opportunity to revert the edit in order to remove any spam flags cast on the edited version (which they are likely to do, just because you removed the spam content). Please see: Should spam posts be edited? [Please ping me (@Makyen) once you read this, so I can delete it, as it has nothing to do with your answer here.]

– Makyen – 2019-02-20T23:14:23.027