Comment
Author: Admin | 2025-04-28
That uses two separate PoW subprocedures involving two distinct and independent oracles \(H_0(\cdot), H_1(\cdot)\) into a protocol that utilizes a single oracle \(H(\cdot)\) for a total number of q queries per round. Our transformation is general and works for any pair of protocols that utilize \(H_0(\cdot), H_1(\cdot)\), provided that certain conditions are met (which are satisfied by protocol \({\mathrm{\Pi }}_{\mathsf {BA}}^{1/2}\) above). In more detail, we consider two protocols \({\mathrm{\Pi }}_0,{\mathrm{\Pi }}_1\) that utilize a PoW step as shown in Algorithm 6 in Figure 8.Fig. 8.Fig. 8. The 2-for-1 PoW transformation.Fig. 9.Fig. 9. Protocol \({\mathrm{\Pi }}_{\mathsf {BA}}^{1/2}\) over the Bitcoin backbone via the specification of \(V(\cdot), R(\cdot), I(\cdot)\).In order to achieve composition of the two protocols \({\mathrm{\Pi }}_0, {\mathrm{\Pi }}_1\) in the q-bounded setting with access to a single oracle \(H(\cdot)\), we will substitute steps 2-11 in both protocols with a call to a new function, double-pow, defined below. First, observe that in \({\mathrm{\Pi }}_b\), \(b\in \lbrace 0,1\rbrace\), the PoW steps 2–12 operate with input \(w_b\) and produce output in \(B_b\) if the PoW succeeds. The probability of obtaining a solution is \(T\cdot 2^{-\kappa }\).The modification consists in changing the structure of the PoWs from pairs of the form \((w,ctr)\) to triples of the form \((w, ctr, label)\), where label is a \(\kappa\)-bit string that is neutral from the point of view of the proof. This will further require the modification of the verification step for PoWs in both protocols \({\mathrm{\Pi }}_0, {\mathrm{\Pi }}_1\) in the following manner.—Any verification step in \({\mathrm{\Pi }_0}\) of a PoW \(\langle w_0,ctr\rangle\) which is of the form \(H(ctr,G(w_0)) \lt T\), will now operate with a PoW of the form \(\langle w_0, ctr, label \rangle\) and will verify the relation \begin{equation*} H(ctr, \langle G(w_0), label\rangle) \lt T. \end{equation*} —Any verification step in \({\mathrm{\Pi }_1}\) of a PoW \(\langle w_1, ctr \rangle\) which is of the form \(H(ctr, G(w_1)) \lt T\), will now operate with a PoW of the form \(\langle w_1, ctr, label\rangle\) and will verify the relation \begin{equation*} [ H(ctr, \langle label, G(w_1)\rangle)]^\mathsf {R} \lt T, \end{equation*} where \([a]^\mathsf {R}\) denotes the reverse of the bitstring a.This parallel composition strategy in the form of the pseudocode segment is shown in Algorithm 7. Either or both the solutions it returns, \(B_0, B_1\), may be empty if no solution is found.Protocol \({\mathrm{\Pi }}_{\mathsf {BA}}^{1/2}\) will employ 2-for-1 PoW, which will substitute the individual PoW operation of
Add Comment