Let’s talk about ASIC mining

This was a scheduling and technical risk decision: we don’t have time or sufficient headroom in the complexity+risk budget to change the PoW in Sapling.

For the record, I’m strongly in favour of changing the Equihash parameters to increase memory requirements (which incidentally makes verification more efficient), possibly in the next upgrade after Sapling. The current parameters were chosen before the development of optimised Equihash implementations that happened just before launch, so they’re definitely not ideal. I’m also in favour of researching other ASIC-resistant PoW algorithms as potential replacements in case just changing the Equihash parameters turns out not to be sufficient.

I find the centralization of mining in Bitcoin to be alarming and a serious security vulnerability. I’ve never been convinced by the argument that investment in mining equipment provides adequate incentives not to exploit the network. Consider for instance that a government could take over any majority miner in an instant, and many governments have demonstrated animosity to the whole idea of decentralized currency. If we thought this argument was a basis for an acceptable security model, why would we be using PoW (with the attendant gross environmental cost), rather than a centralized sale of mining rights by the developers of a coin to the highest bidder?

We haven’t done as well in avoiding mining pool centralization in Zcash as I’d hoped. That is a security problem, but it’s a potentially solvable one, and I believe the situation would be very much worse with ASICs.

The fact that Zcash was originally presented strongly as having an ASIC-resistant PoW, and has built its mining community on that basis, needs to be taken into account.

PoS might be part of the solution in the long term, but it isn’t ready, and Zcash’s policy has always been “wait to see how that works out in Ethereum”.

I also think that individual opinions (such as @zooko’s or mine) should not override community consensus if the latter is in favour of hedging against ASICs, as it seems is the case. Technical and engineering feasibility, and security requirements, are always an issue in deciding how the protocol evolves, but in this case, there’s no severe technical/security obstacle to changing the Equihash parameters. That would at least buy some time against ASICs, and also has the (minor) advantage of better PoW verification performance.

[Edit] As noted by @tromp, this would also be consistent with the recommendations of Solar Designer’s Equihash analysis.

22 Likes