Is "Two-phase Proof of Work" suitable for Monero?

Question

The "Two-phase Proof of Work" is an evolution of Bitcoin proposed by Emin Gün Sirer to mitigate the risk of very large pools getting too much control on Monero.

A two-phase PoW consists of a block that has two separate cryptopuzzles in it. Under a two-phase PoW:

The double hash of the header (SHA256(SHA256(header))) is smaller than a difficulty parameter X, and The header is signed with the coinbase transaction's private key, and the hash (SHA256(SIG(header, privkey))) of that signature is smaller than a second difficulty parameter Y.

The first phase (i.e. point 1 above) is identical to the existing Bitcoin cryptopuzzle. Our solution retains that mechanism in its entirety. The existing mining rigs are all geared to solve the first puzzle, which they can do very efficiently. X is the value of the current variable known as "difficulty" in the Bitcoin software. So we change absolutely nothing that already exists.

The twist here is that we introduce a second cryptopuzzle. In effect, phase 1 requires our miners to do the work that miners have always been doing. But then, when they think they have a viable solution, we now ask them to sign the block with the private key that controls the payment address, and see if the result, when hashed, is below a second difficulty parameter Y.

This mechanism allows miners to use existing rigs, albeit with a lower difficulty value (X) than the difficulty value currently in effect. This would enable miners to produce a lot more potential solutions; that is, headers that pass phase 1, which we call half-solutions. For each such half-solution, miners use a second device, perhaps a CPU or a specialized card, to perform the second check until a full solution is found.

Is there any technical issue preventing the implementation of a similar mechanism while keeping privacy properties of Monero?

Answer 1

The question to ask isn't 'Can this be done?' but rather 'Is this something we can benefit from?'.

Since you did ask explicitly if it was possible, I'll address that first:

Yes, it's absolutely possible for Monero to adopt this proposed PoW algorithm. The PoW algorithm is orthogonal to the issue of privacy, as long as the PoW algorithm chosen isn't one which encourages extreme centralization.

Now, as to the second part. Is this something we would benefit from?

Absolutely not. The PoW suggested here aims to solve the problem of miner centralization in the bitcoin ecosystem, by reducing the gap between ASICs and other devices. It tries to do this without screwing those who have invested in ASICs over completely, and represents a compromise which might be more palatable than just switching PoW in a manner that makes all ASICs obsolete.

By switching to this 'compromise algorithm', which benefits 50% from ASICs, we'd require anyone wanting to mine Monero profitably to invest in ASICs. That would greatly hurt our network security (because everyone has a general purpose computer to mine with, but almost nobody is going to buy an ASIC just for the purpose of mining).

We're already seeing a ton of unprofitable mining, by botnets and enthusiasts, and we'd lose that 'free' security by switching to an algorithm requiring special hardware. This point will be even more important when smart mining (background mining when computer is idle) is implemented into the daemon and GUI.