What happened at the Zcon0 mining workshop (and more...)

For the benefit of those who could not attend Zcon0, I will try my to best to describe the mining workshop as well as provide tidbits from hallway conversations and informal meetings. Errors and omissions are my own.

Mining Workshop

The workshop took place on the first day of Zcon0, 26th June 2018 and lasted for two hours, facilitated by @daira and myself. I prepared a handout which was provided to attendees. An attendee was also conscripted into being a note taker. You can find the handout [PDF] and notes here [Github].

Throughout the two hours, many talking points already discussed in the ASIC mining thread came up, so for brevity and sanity, I will not rehash them here, but instead focus on pertinent information.

Halfway through the workshop we were advised that all the workshops were being conducted under Chatham house rules. That is, we should try to not attribute quotes to individuals.

We kicked off by discussing why Zcash was ASIC resistant at launch. The point was brought up that ASIC resistance is not a value of Zcash itself, but instead a tool to help achieve mining decentralization. Equihash was chosen to help prevent 51% attacks at launch.

Looking at the mining pool slide on the handout, it was noted that Flypool’s share which has for a long period of time been around 50% or more, had gradually fallen to 20% over the past few weeks, whilst at the same time there had been a rise in unidentified mining addresses with significant hashpower.

Regarding the LiteCoin and SiaCoin hashrate charts, a hardware manufacturer declared that we would not see the same type of explosive growth in Zcash hashrate and that we would instead see a gradual increase. The rationale being that they had changed their distribution model for Zcash and were staggering sales of their ASIC miner.

We discussed an anonymous miner, who has been mining on F2Pool using ~1000 workers, capturing approximately 10% of the entire network hashpower. We could not identify the miner. A point was made that a similar event occurred with Decred, where around the launch of a new hardware miner, around 60% of the reward was being captured by a single miner.

With regards to miner privacy, a suggestion was made that perhaps miners with substantial hashpower should be publicly identified to help against miner collusion. Meanwhile, a hardware manufacturer confirmed that their customer database had indeed been hacked last year (2017).

We discussed potential options and where they might fit on the Zcashd release roadmap, taking into consideration ZcashCo engineering resources and safe delivery of Sapling. The higher the development effort required to update the PoW, the higher the opportunity cost in terms of delivering features on the Zcashd roadmap. The Sapling network upgrade is scheduled for October 2018, so the next available network upgrade for activating a PoW change would be April 2019.

We discussed if a PoW change could be made in a shorter time-frame such as 3 months. Although this might be possible for an option such as tweaking Equihash, some attendees felt that 6 months would give the ecosystem more time to prepare for any change. It was duly noted that the longer it took the Zcash project to make a decision, the more the political landscape would change as deployment of ASIC miners increased.

@zooko described his idea for a dual-PoW which would try to split the mining reward equally between ASICs and GPUs. In future, perhaps the split would also include proof-of-stake. Imgur: The magic of the Internet. The point was made that ASICs could be developed for the GPU friendly PoW. Another issue raised was that the ASIC PoW could not be fixed to a specific algorithm, in case of a bug or vulnerability. GPUs were more flexible in this regard. The dual-PoW was renamed and described as a multi-faction PoW during the conference workshop summary.

Regarding the option of status quo, doing nothing and retaining Equihash (200, 9), when asked if this meant forever, the response from attendees was no, since we did not want to exclude the possibility of one day moving to proof-of-stake.

The option of tweaking Equihash parameters to (144, 5) was discussed. It was noted that some other Equihash projects have already or are in the process of moving to this parameter set and thus we could learn from their experience. There was uncertainty as to whether or not any of the current Equihash (200, 9) ASIC miners could be updated to support the new parameters.

We discussed ProgPoW and how it had so far received positive feedback from engineers and researchers in the community, but since it was new to the engineering team, deploying ProgPoW would require more work than tweaking Equihash.

There was uncertainty around the deployment schedule for the multi-faction PoW. @daira and myself expressed concern over the time it might take to properly analyze the security properties since it was a new idea and there was no concrete design to reference, whereas there is an existing body of work related to Equihash and ProgPoW.

We discussed the impact of updating the PoW to be incompatible with existing ASIC miners. Would this increase the risk of forks and network attacks? An analogy was given during the discussion, “Imagine you hire some bodyguards to protect you. What do you think will happen if one day you tell these bodyguards that you’re going to fire them in three months time?”.

A hardware manufacturer said that their miner only used embedded memory on the ASIC itself. When asked if changing the Equihash parameters from (200, 9) to (144, 5) would be incompatible with their hardware, they said yes, and that they would subsequently need to create new hardware.

Another hardware manufacturer also said that changing the parameters would be incompatible with their hardware. However, when asked if a firmware update could handle new parameters, they said yes. When further quizzed to clarify if this was because the hardware had sufficient memory for a parameter change, they said no, but that it might be possible to add more memory.

It was pointed out that even if a PoW change were to deprecate all existing mining hardware, manufacturers would still be highly incentivized to develop new hardware because the dollar value of Zcash’s daily distribution is high. Manufacturers who pre-mine could possibly recover their capital expenditure and achieve their target ROI within just a month or two of mining.

A hardware manufacturer mentioned that they offered a plan, open to anyone, to white-label and license their Equihash ASICs for use in building miners.

We acknowledged that we had not discussed the possibility of hardware partnerships due to time constraints, but that this was something the Zcash Foundation would be looking into, given the ballot proprosal to switch to an open hardware ASIC friendly PoW.

ZcashCo agreed that it should clarify its position to the community before Sapling activated, so that there would be at least 6 months before the next network upgrade when a PoW change could be activated.

Tidbits

On the first day of Zcon0, I noticed a trade banner had been set up by an ASIC manufacturer. Advertising and props were not allowed, so this was eventually removed by conference organizers. Imgur: The magic of the Internet

A day or two after the workshop, I noticed there was a “Buy 1 Get 1 Free” offer for the Innosilicon Zmaster. I don’t remember seeing this at the time I put together the handout. Taking into considertaion this promotion, the Zmaster $/sol/s falls to $0.10, closing the gap with the Antminer Z9 mini at $0.085.

I spoke with a chip designer to discuss the feasibility of an open-source ASIC design as proposed to the Zcash Foundation. General thoughts were that due to economies of scale, we can already see the emergence of an oligopoly of ASIC mining manufacturers, mirroring the rest of the semiconductor industry. Thus, they would be happy to design and sell an open-source ASIC design to the community, but would not want to get involved with the manufacturing of a miner itself. They told me there are only a few foundries in the world, TSMC, GlobalFoundries, UMC/Samsung, who can mass manufacture chips at competitive prices. The ASIC mining manufacturers already have existing relationships with these foundries, so new entrants will be at a disadvantage.

I also discussed PoW algorithms with the chip designer. They told me that optimizing for Equihash had been quite challenging. They acknowledged that changing the Equihash parameters to increase the memory requirements could be an issue. However, they also mentioned that they were developing a novel way to handle all memory-hard algorithms, so that the amount of memory in future would no longer be a roadblock. Memory bandwidth and performance was not disclosed. When asked about ProgPoW, they mentioned that they had looked at it and were currently unsure how they would go about implementing it.

A GPU miner I spoke with emphasized that whatever decision the Zcash project moves forward with, they hope Zcash will stay as one and not fork into multiple chains.

Bitmain are seeking an IPO in Hong Kong, with a valuation around USD $40 billion, a number higher than the $10-$12 billion which has been reported by some news outlets. The IPO was described by one person I spoke with as “Bitmain taking some cash off the table”.

I spoke with a member of the Zcash Foundation who confirmed that the final review of the ProgPoW grant proposal would be independent of the results of the ASIC-related ballot votes.

How the community can move forward (personal opinion)

Zcash launched with Equihash, an ASIC resistance PoW, as a means to achieve mining decentralization in order to improve the security of the blockchain. Diversifying network hashpower helps reduce the risk of miner collusion and 51% attacks. A beneficial side-effect is that it also helps to better distribute coins across a broad base of miners.

Fair mining is a safeguard against any one group with access to a certain technology, from holding such a significant advantage over other groups, as to prevent them from participating. Fair mining combined with a low entry barrier to mining, such as the use of a home computer, can help promote global participation and adoption of a cryptocurrency.

With Zcash, the two groups are general-purpose commodity hardware e.g. a PC with a graphics card, and single-purpose specialized hardware e.g. ASIC miner. In order to achieve fair mining, the PoW algorithm should be ASIC resistant, to reduce the advantage which specialized hardware might hold over general-purpose hardware.

Let’s compare the performance of specialized hardware against a popular graphics card, the Nvidia 1080 Ti:

sha256 (Bitcoin)

  • Antminer S9, 14 Th/s @ 1350 Watts = 10182 Mh/W/s
  • Nvidia 1080 Ti, 980 Mh/s @ 250 Watts = 3.92 Mh/W/s
  • ASIC advantage ~ 2600x

Equihash (200,9) (Zcash)

  • Innosilicon Zmaster, 50000 Sol/s @ 620 Watts, 80.65 Sol/W/s
  • Nvidia 1080 Ti, 720 Sol/s @ 250 Watts = 2.88 Sol/W/s
  • ASIC advantage ~ 28x

Ethash (Ethereum)

  • Antminer E3, 180 MH/s @ 800 Watts, 0.225 Mh/W/s
  • Nvidia 1080 Ti, 31 Mh/s @ 250 Watts, 0.124 Mh/W/s
  • ASIC advantage ~ 1.8x
  • Design goals are fair mining and ASIC resistance [LeastAuthority analysis]

ProgPoW

Equihash (144, 5)

  • Requires at least 5x the memory of Equihash (200,9) for initial list size [SolarDiz]
  • Peak memory usage > 2 GiB [BTG]
  • Considered expensive and impractical to build a single-chip solver with GiB of memory

By reducing the ASIC advantage to a minimum, GPUs and ASICs can co-exist. Indeed, a single PoW highly tuned to fair mining, can achieve the end goal of the multi-faction PoW idea, without the uncertainty and complexity of deploying multiple independent PoWs to achieve equilibrium, but instead by letting a competitive market determine the share of the block reward.

I conclude that switching to Equihash (144,5) whilst researching ProgPoW, or switching straight to ProgPow (or even Ethash) are options which will best align stakeholders in maintaining a single Zcash chain, as well as demonstrating a good faith effort by the Zcash project to support fair mining.

  • GPU miners who have supported the project since inception can still participate
  • Manufacturers can continue to innovate and build competitive hardware for those who prefer ASIC mining
  • Professional mining operations can deploy a portfolio of GPUs (flexible) and ASICs (brittle) to suit their business requirements

Some might consider updating the PoW as a distraction on the path towards Proof-of-Stake, but fair mining is necessary for fair distribution of coins before a time when mining becomes staking.

17 Likes

Thanks for the info Bitcartel.

I agree with your conclusions. A 1080ti on Ethash with the ETHlargement pill is 50 MH/s and raises the ratio to .200 Mh/W/s. The power can be lowered as well to raise it pretty closely to the Antminer E3. The E3 would still be a little cheaper and more power efficient, but the advantage would not be very large at all. The next generation of GPU’s have a good chance of besting the E3 and leveling the playing field. It needs to be studied if (144,5) would have the same result.

It appears one of these ideas won’t be implemented until late 2020. Hopefully the network can grow without being controlled too much by one entity. If not, I hope a hard fork would be reconsidered even earlier.

Thank you for this post. You more or less stated what I’ve been arguing the last few days here on the forums. I don’t think the answer is resisting or preventing ASICS but rather developing a POW that reduces the superior advantage ASICS have over GPUs. ASICS will alway perform better and more efficiently than GPUs, but as you stated a lot can be done to make the mining process more fair so that it includes as many people as possible. I think raising the memory requirement to 144,5 is a great way to start but we must keep in mind it will not be a perfect solution.

1 Like

Thanks for this @bitcartel. Much of this information was new and enlightening.

I do disagree with your final conclusion:

I conclude that switching to Equihash (144,5) whilst researching ProgPoW, or switching straight to ProgPow (or even Ethash) are options which will best align stakeholders in maintaining a single Zcash chain, as well as demonstrating a good faith effort by the Zcash project to support fair mining.

There are several new miners on here that have said that GPU mining was too complex for them and that they had only gotten involved with mining because of the simplicity of an ASIC. This points to ASICs actually increasing accessibility to mining. They are also available for almost anyone to purchase (there are a few countries where they are filtered in customs).

Further, I don’t believe that most GPU miners are using home computers, they are using mining-specific rigs with mutli-GPUs. This is a belief and not a fact because I can only go off of the users that post here most often. This detracts from the idea that GPU mining distributes coins more fairly. I think that statement is over-weighted. There are massive GPU farms mining and switching based on profitability. Further, as you said, Flypool had > 60% of the network at one point and when ASICs entered the market they fixed that security threat (or the appearance of a threat).

If >30-50% of the network are ASICs right now, do you not believe it would be a large risk to remove that security from the network? I believe it would be dangerous and could lead to a 51% attack similar to BTG during that transition.

You also mentioned that:

It was pointed out that even if a PoW change were to deprecate all existing mining hardware, manufacturers would still be highly incentivized to develop new hardware because the dollar value of Zcash’s daily distribution is high. Manufacturers who pre-mine could possibly recover their capital expenditure and achieve their target ROI within just a month or two of mining.

However, when asked if a firmware update could handle new parameters, they said yes.

Some points here:

  • This would invalidate the benefits of switching the parameters if in just a few months there would be new ASICs in the market. In the meantime, we would be needlessly making the network less secure by removing the current ASIC hashpower. It’s risky.
  • This might make it less likely that Innosilicon or Bitmain would make the ASICs for sale publicly. They might just mine on their own privately without anyone being the wiser. That would undermine the attempt for fair coin distribution.
  • ASIC manufacturers are working to reduce the memory-hard protections that some PoW’s have.
  • GPU mining software takes anywhere from 1-10% in fees and I’m sure there is private mining software that is much more efficient than what is publicly available. GPU mining is not as egalitarian as it seems. After pool fees, OS fees, and other fees, GPU miners can end up losing 10-15% of what they thought they would earn.

Here is my take-away:

I think the evidence points that ProgPOW should be researched. If it’s safe, secure and truly ASIC resistant (The Zcash foundation should work with manufacturers to prove this) then it should be planned in advance so that GPU miners could take up the lack in security of ASICs no longer protecting the network.

The other option is to switch to Ethash, but then you will still have the huge swings in difficulty as non-comital GPU miners switch based on profitability. Keep in mind that when miners switch away from Zcash, it could be influencing the price to stay lower, which hurts adoption and Zcash’s differentiation.

Not allowing for ASICs continues a large risk that ASICs will be unknowingly developed. I think it is a good idea to embrace ASICs and transition away from GPU mining altogether. In a few years, if Bitmain and other manufacturers continue to grow, their brand names will be as common as Nvidia and AMD. Also, in a few years we will probably be headed towards PoS, which has its own issues like the potential to double the founders reward.

2 Likes

If I understand correctly, a central design goal for both Equihash and Ethash was to level the playing field between general purpose hardware and specialized hardware.

Seeing an ASIC advantage of 28x for Equihash(200,9) (with potentially greater ASIC gains on the way?) is the reason we’re having this discussion.

Meanwhile Ethash has an ASIC advantage of only 1.8x?! After presumably very significant attempts by manufacturers to widen this gap given the growth of Ethereum, this strikes me as quite an impressive success in the original design of Ethash. Do we understand why this worked so well?

6 Likes

Just a general thought.

While we have so far only information about 1x Asic, the E3 from Bitmain, for Ethash i would like to bring in some thoughts on this:

  • the current statement is only based on this E3, but can anybody say this is the only Asic on the Ethash network or are some others on their way or eventually allready privately mining it?

  • the Ethhash Ethereum network has a huge hashrate, it would be way more difficult, if not impossible to locate and identify Asics in their first months.

  • it could be possible that this E3 is only a test or eventually only for the public while Bitmain itself mines with better modified or even new models that are more efficient and have a better advantage of just 1.8x

  • Asic history has shown that Bitmain is not the non plus ultra when it comes to best Asic maschines, while they are the most distributed, best known and most controversiest there are other asic producers that way outperform Bitmain when it comes to hashrate and efficiency. Examples:
    a.) Equihash: Bitmain Z9mini max. 15k Sol hashrate with about 400W vs. Innosilicon Zmaster 50k Sol with 650W
    b.) Blake2b: Bitmain A3 815GH/s at 1275W vs. Innosilicon S11 4.3TH/s at 1350W

The idea of this comparison is that eventually/maybe there are way better performing Ethash asic miners developed, active, researched or planned. I personally could imagine that future Asics are designed with better memory, no matter if these makes them more expensive. Having in mind that the Innosilicon miner at a cost of USD 10.000 per unit (later for 2 units) is sold out allready shows that a price increase mostly doesn’t affect the asic buying people.

  • After the many cryptonite forks and some equihash forks i’am pretty confident that some smaller asic producers will not announce their products anymore and eventually, like Innosilicon admitted allready, sale big batches to single mining corporations which of course, again are used secretly and privatly. Means like in the case of cryptonite there have been 3 producers on the algo for months which came to light only because 1 of them (Baikal first if i remember correct) announced a public sale.

  • The next thought is the attempt of Obelisk or some other Asic producers to get directly involved with some Crypto project for designing an Asic mashine exclusivly. What if such asic is created for example together with Ethereum or Ethereum Classic which are both on the ethash algo and could be used again for every other coin/project on ethash.

Just some thoughts i want to through in as we talk currently only about 1.8x efficiency, but indeed we do not know if it’s only this and if this is the best an asic can take out. I personally have some doubts that it will stay with 1.8x, and therefor i think everybody should take into account that these 1.8x are just a current not fixed number that can change pretty fast to a much higher number, no matter that more memory is needed.

1 Like

I completely agree that Ethash or a slight variant would be good for Zcash. The only problem is that it doesn’t make miners commit to Zcash only and we will get a large chunk of miners going back and forth between the two based on profitability.

Be nice. Effort-posts are encouraged here.

2 Likes

Millions of Change.org users can now easily donate to charity, thanks to Fair Mining (and Monero) opening up participation.

https://theminingscreensaver.com/en

2 Likes

Sep 28, 2018:

In an developer meeting Friday, Martin Holst Swende, security lead at the Ethereum Foundation, said he supports swift action to remove ASIC mining hardware from the ethereum platform. Joining the non-profit in 2016, Swende now works to ensure code changes do not disrupt or harm operations on the world’s second-largest blockchain.

Sep 19, 2018 (see thread)

Ethereum core developer:

3 Likes

Great post, Simon! Thank you for writing it.