I think I've come up with a way to make PoS - at least potentially - work as a good solution to the Byzantine Generals problem. It's still kind of shaky in terms of practical applicability because it's sensitive to when large transactions are made - but if transactions are reasonably 'steady' the math works against an attacker.
With Nakamoto's Proof-of-Work solution, we keep track of the difficulty solved at each block, and from that, when we evaluate two chains to see if one should displace the other we can work out how much hashing work went into each chain. That amounts to the irrevocable consumption of a resource in finite supply, with the result that we can be certain that the hashing was not expended on both of two chains.
The crucial point is that a resource in finite supply can be shown to have been irrevocably consumed. Well, the point at which a TxOut gets spent or transferred is also irrevocable.
The first 'serious' proposal for proof-of-stake essentially said, we can keep track of the amount spent in a version of the block chain, and treat that as the measure that a 'superior' chain has to beat, in the same way that a 'superior' chain in proof-of-work has to have generated more hashing.
The problem with that idea is 'nothing-at-stake.' A TxOut can be spent in both chains, and therefore the priority generated by its expenditure can be counted in favor of both chains. When you're talking about multiple chains each with its own 'consensus reality' you're no longer talking about the irrevocable expenditure of a finite resource.
But my opinion is that you can make it finite if you are careful about exactly what you compare.
The set of TxOuts at the last block that two chains have in common is identical. That is a finite resource whose expenditure can be measured when you're comparing two divergent chains. It may not be the only one, but it is one. So, when you compare two candidate chains, you should be counting the expenditure of that set of TxOuts, and counting it only once for both chains. You could count nothing for any coin spent in both chains and full-points for anything spent only in one, and compare the priority on that basis. Expenditures of the set of TxOuts created after the chain's divergence cannot be counted; they're already counted when you count (or refuse to count due to conflict) the expenditures that have gone to make them.
That rule is all about resolving which potential blockchain gets to displace the other; it says nothing about how blocks are formed in the first place. In fact you could go on forming blocks by proof-of-work, but instead of paying a large coinbase to the hasher, you could pay a very small coinbase to the hasher and distribute most of the coins as 'interest' on the txouts spent in that block.
The efficiency argument for proof-of-stake would work fine with that structure. With Bitcoin's blocks worth a little over $17K right now, and ALL of that awarded for proof-of-work, people are spending up to $17K per block on generating proof-of-work; custom ASICS are old news, now there are multimillion dollar 'hash farms' with their own power plants are getting built. But if, instead, the hasher were getting, say, $10 for forming a block, people would not be spending more than $10 for enough electricity to get a block regardless of how much bitcoin were being created/distributed per block in Proof-of-Stake or 'interest' payments.
Interesting post as usual, Cryddit.
I have no qualms with the energy spent on PoW, and I see rewarding new coins to those who do work as the ideal distribution mechanism. But I am interested in theoretical discussions about how the cost and difficulty of an attack can be increased, especially in the distant future when the mining subsidy is largely over.
How is your idea
that different from calculating the best chain using the equation:
chain goodness = C
1 x total_work + C
2 x total_bitcoin_days_destroyed
Are you increasing security in one area by decreasing it in another? Could SPV clients could work with either technique? Does some alt-coin already do something like this?