Quote from: jl2012 on August 17, 2012, 06:02:47 AM

Quote from: Gavin Andresen on August 17, 2012, 03:59:25 AM

I suppose you could require that a proof-of-stake have a small, limited number of signatures-- requiring that stakeholders maintain a small number of large-balance addresses. That's bad for privacy and security, though.

Privacy is not a issue here. Although you may use multiple addresses with smaller balance, the fact that they are signing the same block reveals their common ownership

Security is a problem, even people may use multiple addresses with smaller balance. This actually requires stakeholders to put those private keys in a hot wallet. A possible solution is to have separate keys for block-signing and transaction-signing. We may use the transaction-signing private key to validate the block-signing private key.

There even could be a "pooled proof-of-stake mining" model. A pool operator will publish a transaction-signing public key. Individual workers will sign this public key with their transaction-signing private keys (which link to BTC addresses with balance).

When a block is found, the pool operator will sign it with the block-signing private key, and the contribution from his workers will be counted as proof-of-stake. The operator will then pay his workers based on their contribution. Each block will allow only one signature and that would also solve your DoS problem.

Signatures for transaction-signing public key may be stored in the blockchain. The size would be similar to normal transactions and fee is required to prevent DoS. If the worker wants to withdraw from the pool, he may revoke his signature by sending another record to the blockchain, or simply draw all BTC from that address. For lost coins, however, such revocation is not possible. Therefore, all signatures should be expired in a pre-determined manner (e.g. valid for only 10000 blocks).

The security issue raised by large balance hot wallets could be dealt with as follows:

1) Create special account used for signing blocks
account restricted to two valid functions: 1) Sign blocks using coins in special account
2) Release coins in special account to user-specified normal account (specified address set permanently when special account is created)
2) Special account is held in hot wallet.
3) User-specified normal account is held offline.