On Mon, May 06, 2013 at 04:43:07PM -0400, Peter Todd wrote:
> Now determining the value of D has a nice compact proof: B1, BP and M
> and B2. Taking the minimum of the difficulties of B1 and B2 (in case
> they cross a retarget boundry; don't want to create strange incentives)
> determine the expected return in Bitcoins from the block reward had the
> hasher solved valid blocks instead and you can determine exactly how
> much the proof-of-work was worth, kinda...

One last thought... suppose you want to make these proof-of-works
transferable on the blockchain, as is easily possible with
announce/commit fidelity bond sacrifices. The problem is of course
re-use - you don't want it to be possible to use the same proof-of-work
for a different asset.

So for D use the txid:vout pair of a txout that you can spend, then
spend it to some output to create the start of the smartcoin/contract
asset chain. The txout can only be spent once, so the PoW is inherently
non-reusable.

The final proof is a more compact than a fidelity bond proof, just the
PoW block and a single transaction and existence proof rather than two
or three. (announce, commit, and commit txin if sacrifice is via fees)


Unfortunately PoW schemes do mean you are actually taking away from the
overall security of the network, and if there was a lot of demand for
these things it will lead to the undesirable effect of making it easy to
rent hashing power. Botnet owners will be happy to have a task that
requires even less communication than Bitcoin itself. Finally the
varience inherent in them is annoying too. But it's an interesting idea.

-- 
'peter'[:-1]@petertodd.org
00000000000001358eaf811792b28798a04103b2e47aecf54268736514defd2f