Could a cryptocurracy be made, to increase participation?
 

* Some people, (myself included), contribute to GIMPS as we have an interest in maths.

* Some people mine cryptocurrencies, as they want to make money
* Some people (myself included), deal in cryptocurrency as an investment.


I can't help but feel that the number of contributors to GIMPS, (or a new similar project), would increase [B]dramatically[/B] if there was a reward in the form of coins that people could collect. If a distributed system could be built, that mines Mersenne Primes, it has the potential to get users do it. Since one is not computing a useless hash like Bitcoin, the ASICs used for mining Bitcoin and similar would be no use. (Perhaps people would build ASICs to do FFTs, but would that be such a bad thing?) Don't just offer a reward for actually finding a Mersenne Prime, as its unlikely any individual would find one. But for some part in eliminating possible exponents, such as trial division etc.


Dave

[QUOTE=drkirkby;571473]Don't just offer a reward for actually finding a Mersenne Prime, as its unlikely any individual would find one. But for some part in eliminating possible exponents, such as trial division etc.[/QUOTE]

Sigh... Really? This discussion, again?

Just because Musk invested 1.5B in Bitcoin by way of his Tesla vehicle doesn't mean every equation works.

Sigh again...

[QUOTE=drkirkby;571473]If a distributed system could be built, that mines Mersenne Primes, it has the potential to get users do it. [/QUOTE]
Wow! If only it could be built.
:confus:

Wait a minute! It actually [B]has been built! [/B]
It finds only one coin (previously) per year, and now maybe one every several years.
An every coin owner is known!

The obvious problem in making a cryptocurrency from MPs is the lack of [b]crypto[/b].

How would you stop someone stealing "your" coveted primes? How would someone buying "your" prime know that you no longer have it? How would you stop someone else simply duplicating your work to find "your" prime again? etc. etc. etc. ...

PRP theoretically could be used with some alteration of PRP proofs as proof of work, it would be extremely wasteful to do so in the traditional adversarial PoW sense. TF could not easily be used as PoW. No chance in hell a crypto would succeed even if someone was mad enough to create it. Frankly the world has enough trash coins and no one except us would give a toss that the work had some utility, and as it's less efficient than the status quo not even we would give a toss. Even if the crypto could be made to be nearly as efficient as direct contribution, half the people on this board would reject it on principle. Nice in theory, dead in the water in practice.


All crypto is good for on this board is to get people yelling at clouds. It would be a mercy to just yell Hitler now and end the discussion by Godwin, but far be it from me to ruin a good rant opportunity.

[QUOTE=M344587487;571481]...but far be it from me to ruin a good rant opportunity.[/QUOTE]

Oh, come on...

We haven't yet even gotten into discussing searching spaces exhaustively (sometimes cooperatively; sometimes competitively). :wink:

Ignoring the "crypto" part (that can be implemented, with a little effort), how do you avoid people searching in advance? I could test a range of exponents, and wait patiently one year or so, until the wave reach them, then jump into it and adjudicate the respective blocks when the time comes. The key of the blockchain is not the "crypto" part, that provides the safety, but the key is the randomness, I don't know in advance what activity I will have to do, so I can not "prepare", I can not "preprint" my money and lurk in the dark around the corner to launch them into circulation when the opportunity arises. When the task is given (i.e. "verify this block, NOW!"), all miners jump in and the one which is faster will get the cream. As the blocks are hundreds of bits, you can not prepare the nonces in advance for them. Which is not the case for prime hunting, unless some more clever guy here comes with the math... I could make a "secret database" of LL tests and TF/P-1/ECM factors in advance, and if the opportunity appears, pump them into the chain, no-one will stop me. Also, to verify the blocks, one would need to invest ticks, so then the ticks for finding primes and factors would be shared with the ticks of mining (i.e. certifying the blocks). You wouldn't want to share them, regardless if your goal is to find primes or collect coins.

[QUOTE=Batalov;571478]Wow! If only it could be built.
:confus:

Wait a minute! It actually [B]has been built! [/B]
It finds only one coin (previously) per year, and now maybe one every several years.
An every coin owner is known![/QUOTE]

I specifically said that the reward needed to be given for less work than finding a new Mersenne Prime.

Dave

[QUOTE=LaurV;571495]Ignoring the "crypto" part (that can be implemented, with a little effort), how do you avoid people searching in advance? I could test a range of exponents, and wait patiently one year or so, until the wave reach them, then jump into it and adjudicate the respective blocks when the time comes. The key of the blockchain is not the "crypto" part, that provides the safety, but the key is the randomness, I don't know in advance what activity I will have to do, so I can not "prepare", I can not "preprint" my money and lurk in the dark around the corner to launch them into circulation when the opportunity arises. When the task is given (i.e. "verify this block, NOW!"), all miners jump in and the one which is faster will get the cream..[/QUOTE]

How about if the randomness could be arranged by the exponent range being some function of a national lottery numbers, some time in the future? For example, the UK national lottery has 7 numbers each month, all in the range 1-49. The last main lottery (10th February), had the numbers 7, 23, 30, 32, 36, 8 and 12. The exponent range could be set by some algorithm based on those numbers. The exponents had to be in the range of +/- 500,000 from some sensible function of the lottery numbers.

Probably something the public would find more attractive to mine would be if the computational work aided medical research, but I have no idea how that could be implemented.

Dave.

[QUOTE=chalsall;571483]Oh, come on...[/QUOTE]Okay fine, I'll flex my crank muscle just this once to get the party going ;)

[QUOTE=LaurV;571495]Ignoring the "crypto" part (that can be implemented, with a little effort), how do you avoid people searching in advance? I could test a range of exponents, and wait patiently one year or so, until the wave reach them, then jump into it and adjudicate the respective blocks when the time comes.
...[/QUOTE]Integrate the hash of the previous block into the proof, such that doing the work from scratch is the most efficient way to do the work. Assuming the PoW is a chunk of PRP it could probably be achieved by bitshifting (or some other lossless transformation) based on the previous block + header of your block, possibly requiring a modification to the proof generation to eliminate the ability to convert from a pre-computed proof quickly.

The final piece of the puzzle is having multiple in-progress tests exist simultaneously by incentivising the inclusion of someone else's result in the header your result. Enough in-progress tests would eliminate most of the wasted cycles from an adversarial model, work that lost the race to be the next head of the chain would not be wasted (except when someone beats you to completing the specific work you were working on). You could even incorporate DC's of a sort by allowing a second verification result for any given chunk of work, reducing wasted cycles further. Multiple in-progress tests also allows differing strength hardware to participate, so I think it is the magic bullet that would allow a blockchain to do what it would need to do for our purposes.

[QUOTE=M344587487;571517]Okay fine, I'll flex my crank muscle just this once to get the party going ;)[/QUOTE]

And, then suddenly, everything got quiet.

Nature abhors a vacuum...

[QUOTE=LaurV;571495]I could test a range of exponents, and wait patiently one year or so, until the wave reach them, then jump into it and adjudicate the respective blocks when the time comes. The key of the blockchain is not the "crypto" part, that provides the safety, but the key is the randomness,
...
As the blocks are hundreds of bits, you can not prepare the nonces in advance for them. Which is not the case for prime hunting, unless some more clever guy here comes with the math... I could make a "secret database" of LL tests and TF/P-1/ECM factors in advance, and if the opportunity appears, pump them into the chain, no-one will stop me. [/QUOTE]

Interesting topic. Still don't see a way, my failed approach in the prp(!) setup:

The key idea is to change the base after a successful mining to a random base with say 64 bits.
And then the new task would be to compute res=base^(2^p) mod mp, the score of this task would be the number of trailing zeroes.
Notice that all ongoing computation is still using their "old" base and they get their score for that base, so there is no point to halt their calculation in the middle if someone else mined out [and there is absolutely no point to start a new calc using the new base, because the expected score would be the same].
We can easily verify the computation so their score with the proof scheme, so there would be no cheating.
And you can stack up your computers with precalculated base^(2^p) mod mp trash res values, as it is quite hopeless calculating the res from different bases [we could use prime values as base, but this is not needed]. Unless...

The "only" problem with the factored Mersenne numbers:
if mp is Mersenne prime then we can still handle this, because res=base^2, so just use only odd bases, and their score will be zero.
The bigger problem would be the (fully) factored non-Mersenne primes: with CRT you
can get "easily" res for any base. And that is the problem, a cheater could keep the secret that
he factorized mp, cracking the system. Don't see how the cheater could send a proof without doing all p iterations, but even (re)doing it with any base is still fine for the cheater.
Right? To sum up, ok there is not a lot of factored Mersenne numbers (even in future) but this is a real hole in my method.

[QUOTE=R. Gerbicz;571610]Interesting topic. Still don't see a way, my failed approach in the prp(!) setup:[/QUOTE]

Thanks for that. Sincerely... :smile:

Someone somewhere brought up an interesting point recently... "How does Musk square the circle wrt the carbon cost of Bitcoin?

The answer, of course, is this isn't really meant for transactions (by definition, it doesn't scale), but rather for holding.

Much like Gold.

[QUOTE=R. Gerbicz;571610]
The key idea is to change the base after a successful mining to a random base with say 64 bits.
And then the new task would be to compute res=base^(2^p) mod mp, the score of this task would be the number of trailing zeroes.
Notice that all ongoing computation is still using their "old" base and they get their score for that base, so there is no point to halt their calculation in the middle if someone else mined out [and there is absolutely no point to start a new calc using the new base, because the expected score would be the same].
We can easily verify the computation so their score with the proof scheme, so there would be no cheating.
[/QUOTE]
That is actually an interesting idea, in the sense that it will render all the poaching futile (don't know if this is good or bad, probably is good, if the server will enforce harder the expiration times, otherwise we end up in locked expos). You may get the base when you get the assignment, and get the coins when this is certified. Poachers still may report or verify results, but they won't be able to match the base so they won't get the coins. Also, the cert may be part of mining incentives (you get a little bit of mertoshi - that is satoshi for mersennes haha - when you vertify work). But some more detail of the math is needed, for understanding how exactly works. :blush:

To be a currency it needs to have the ability to be traded; bought and sold. Otherwise it is just ordinary credit which we already have in place.

So no double spending. No forging. No duplicating. etc. If you can do any of those things then it is not so good as a currency.

Well, two of the three are taken care by the blockchain. Duplicating is easy to avoid, as you don't get credit for work which was done before (by yourself of someone else). Maybe you referred to "double spending", which is different, and I assume you did so. We are talking here about what you call "forging". Or, getting the currency without doing the (Gimps-related) work. We could very easy do a blockchain with all the actual credit we have, add some hash to it, and start spending it**. Any [STRIKE]shit[/STRIKE] information can be added to the blockchain and call it "money", and use it for trade. Bitcoins are nothing special, they are some numbers, added to your wallet, which you can spend. Please give them all to me. :razz: Everybody can see how much "numbers" you have and how you "spend" them. It's the mining process what certifies the transactions, and add money to the pool, avoid double spending. Mining takes a lot of time and computing resources doing "futile" calculations (hashes). It is the costly hash procedure what avoids forging. The question is how to change these calculations to be useful (gimps-related) and yet not easy to "forge", i.e. I should not be able to compute one whole year and collect the results (i.e. hoarding them in secret), then "forge" them into circulation as coins when the opportunity appears. Because you either spend the ticks to hash, or you spend the ticks to PRP, you can't do both, unless use two machines.

Before, with the LL, I could not see this possible. But now, with the PRP and certification, it may be possible. You can introduce there a "randomness" (the base) for example. Before, with LL, you had the random shift, but that was nothing like a hash, because it was easy to "reverse", you can compute the LL residue in advance, and once you get the shift from the server, compute the final shift (just a rotation of 1 on p bits and one multiplication) and compute the final residue, without any time wasted. That could not constitute a proof-of-work.

------
** I don't advocate that we have to do that, it would be silly. It was just an example.

It would also need to avoid the 50%+1 problem.

Could Ben/Facebook/Some_government/DDoS (or someone that hacks their setup) take over the currency with a 50%+1 attack?

How much wasted work would need to be done to validate, manage and verify all the work to make sure it complies? Will users start competing against each other (like bitcoin does) and do lots of wasted work to get the next coin?

[QUOTE=chalsall;571602]And, then suddenly, everything got quiet.

Nature abhors a vacuum...[/QUOTE]And when you point out the silence there's discussion. Sod's law :P

[QUOTE=R. Gerbicz;571610]Interesting topic. Still don't see a way, my failed approach in the prp(!) setup:

The key idea is to change the base after a successful mining to a random base with say 64 bits.
And then the new task would be to compute res=base^(2^p) mod mp, the score of this task would be the number of trailing zeroes.
Notice that all ongoing computation is still using their "old" base and they get their score for that base, so there is no point to halt their calculation in the middle if someone else mined out [and there is absolutely no point to start a new calc using the new base, because the expected score would be the same].
We can easily verify the computation so their score with the proof scheme, so there would be no cheating.
And you can stack up your computers with precalculated base^(2^p) mod mp trash res values, as it is quite hopeless calculating the res from different bases [we could use prime values as base, but this is not needed]. Unless...

The "only" problem with the factored Mersenne numbers:
if mp is Mersenne prime then we can still handle this, because res=base^2, so just use only odd bases, and their score will be zero.
The bigger problem would be the (fully) factored non-Mersenne primes: with CRT you
can get "easily" res for any base. And that is the problem, a cheater could keep the secret that
he factorized mp, cracking the system. Don't see how the cheater could send a proof without doing all p iterations, but even (re)doing it with any base is still fine for the cheater.
Right? To sum up, ok there is not a lot of factored Mersenne numbers (even in future) but this is a real hole in my method.[/QUOTE]

I'm not following what you mean by score, when you say trailing zeroes it makes me think of how bitcoin varies difficulty by requiring a certain number of zero bits at the end of a hash. For us difficulty can easily be altered by varying iteration count for a chunk of work, the goal as with bitcoin to emit blocks at a somewhat consistent rate.

Each node on the network validates blocks before adding them to the chain. I don't see how a cheater can utilise trash res values without a 51% attack which is a weakness of any crypto.

Are we in agreement as to the basic structure of a workable solution? ie a chunk of PRP as PoW for a block, and a lossless transformation at the start of a chunk designed to eliminate pre-computation by making proof files inconvertible, using the hash of the previous block and the next block's header as a random seed.

[QUOTE=chalsall;571612]Thanks for that. Sincerely...

Someone somewhere brought up an interesting point recently... "How does Musk square the circle wrt the carbon cost of Bitcoin?

The answer, of course, is this isn't really meant for transactions (by definition, it doesn't scale), but rather for holding.

Much like Gold.[/QUOTE]
All you need is the vague goal of scalability at some future date and you're golden. Much like Ethereum has had the vague goal of switching from PoW to PoS yet here we are 4 years later in a third mining boom.

[QUOTE=retina;571632]To be a currency it needs to have the ability to be traded; bought and sold. Otherwise it is just ordinary credit which we already have in place.

So no double spending. No forging. No duplicating. etc. If you can do any of those things then it is not so good as a currency.[/QUOTE]
Building a crypto following from grassroots is hard, getting on a reputable exchange is next to impossible and getting on the dodgy exchanges is not ideal. Creating an ERC20 token is the easiest path to adoption as there is a decentralised exchange for Ethereum tokens, but that's not possible when the whole point is doing useful work. Adoption is the real killer, better get the megaphone out and start evangelising ;)

[QUOTE=retina;571640]It would also need to avoid the 50%+1 problem.

Could Ben/Facebook/Some_government/DDoS (or someone that hacks their setup) take over the currency with a 50%+1 attack?

How much wasted work would need to be done to validate, manage and verify all the work to make sure it complies? Will users start competing against each other (like bitcoin does) and do lots of wasted work to get the next coin?[/QUOTE]
As each node on the network validates blocks they all need to validate every proof file, so choosing an efficient proof file setting helps. A miner isn't (usually) a node, typically a miner joins a pool and the pool is the node. Users competing on the same work can be mitigated by having multiple exponents in-progress as I outlined earlier.

Building slightly on my idea:
[LIST][*]TF/P-1 cannot be used as PoW but it could be encoded into the blockchain. There has to be a mechanism that adds off-chain data to the chain, otherwise at some point the chain will start doing PRP on exponents that have been ruled out elsewhere. It could be built into the code of the nodes to query GIMPS for new off-chain results to onboard it[*]At genesis the state of all exponents within a range is known, to avoid redoing work known to be completed at time of creation[*]The chain can start at a range no where near wavefront so that the chain and GIMPS don't trip over each other when GIMPS is not yet aware of the chain[*]The chain can be parsed easily by GIMPS to add on-chain data to GIMPS. Exponents in the near future of the chain can be avoided by GIMPS to avoid in-progress overlap[/LIST]

[QUOTE=M344587487;571643] For us difficulty can easily be altered by varying iteration count for a chunk of work, the goal as with bitcoin to emit blocks at a somewhat consistent rate.[/QUOTE]
Nope. Then slow computers will have no chance, and the coins will always be collected by the guys with the big guns. Not fair.

Still reading your post, didn't finish all.

[QUOTE=LaurV;571631]You may get the base when you get the assignment, and get the coins when this is certified. [/QUOTE]

Oh, yes that is even better what I've written, and maybe: forcing that the server wouldn't give out the same prime exponent twice per day. In this way even if you have a fully factorized mp you would need to wait a long time to see a high score [because in each day you reserve and then unreserve the exponent if you see a low score for this p]. And ofcourse on each day you get a different base for the same exponent.

[QUOTE=M344587487;571643]
I'm not following what you mean by score, when you say trailing zeroes it makes me think of how bitcoin varies difficulty by requiring a certain number of zero bits at the end of a hash. [/QUOTE]

The score is the number of trailing zero bits in res=base^(2^p) mod mp [this can't be infinite as res!=0 for base<mp].

[QUOTE=LaurV;571660]Nope. Then slow computers will have no chance, and the coins will always be collected by the guys with the big guns. Not fair.

Still reading your post, didn't finish all.[/QUOTE]

That's covered by having multiple in-progress exponents and incentivising including other's results in your block. Here's a breakdown that might be as clear as mud:
[LIST][*]Only blocks that reference the current head of the chain have the potential to be the next head of the chain, otherwise it isn't a chain. You're correct that this means that only fast computers can mint blocks[*]Miners that don't win the race do not discard the work they've done, they continue until the work is complete and offer up the result for a minter to include in their next block[*]When your work is included in someone else's block, you get the reward for the work. This is why you reference the header of your block as well as a previous block to seed your work, the address to send your reward is encoded in the work you've done so someone else can't come along and try to pass your work off as their own[*]There has to be a small incentive for a minter to include your result in their block, as well as the normal incentive a minter has to include transactions[*]There has to be a difficulty variable if the goal is to adapt to mining power to emit blocks consistently. This isn't strictly necessary for a coin that isn't meant as a realtime currency, but wild swings in block output based on mining power is probably not a good thing to let happen unchecked[/LIST]

Anything I've theorised to date has been purely PoW. Another option is a hybrid PoS + PoW coin, where:
[LIST][*]PoS is used by nodes to verify blocks. People holding coins can verify blocks to be added to the chain and get a cut of the transaction fees and a reward for verifying proofs[*]Known factors are also added to blocks by nodes to keep the chain and nodes synchronised, limited to a sliding window beyond the pending exponents to avoid a flood of unnecessary factors being encoded[*]Blocks can be output consistently or as efficiency demands (wait until there's enough transactions and results to far outweigh the overhead of creating a new block)[*]PoW is used by miners doing PRP testing, as described above to verifiably link work done to the one doing it. There is no longer an incentive to be the fastest computer to get the minting rewards as a miner does not mint, but the usual benefits of having better hardware apply[*]Basically a re-implementation of GIMPS credit as a cryptocurrency, where PoS holders verify and mint new coins to arbitrary addresses instead of a centralised server doling out feel-good numbers to registered members[/LIST]

PoS like PoW has been figured out at this point, with positives and negatives that apply to any coin that uses it. One of the main negatives for a PoS coin is that early adopters tend to hoard coins for PoS. For a coin that actually does something other than just be a speculative greed machine that's a positive for the health of the coin, the early adopters are in it for the primes with the benefits of using crypto being a secondary concern.

The million bitcoins question: How to call our currency?

If we (that's you all, because I don't have such talents) come with a nice name that we like, then we may try to put some math together, or some tentative implementation for testing :lol:

Up to now I only have in mind stupid names. Mersenne coin is a mouth-full and it sounds ugly... :yucky: We won't waste the time for some coin with no catchy name. Something like wooze, or geez haha, marketing style...
C'mon, I know there are so many clever people here! :chappy:

[QUOTE=LaurV;571723]How to call our currency? [/QUOTE]If you call it for what it is then: uselesscoin. :razz:

But if you want to pretend it is something of value then: primecoin.

[QUOTE=retina;571725]use_less_coin[/QUOTE]
I try to, but never succeed, I always use all my coin. :razz:
Related to primecoin, yeah, but that's ugly too, and kinda too trivial. Maybe "prim", or "primm"? For "prime mersenne". Easy to say, more resonance? dunno..

Once upon a time, number theory conferences, seminars, etc. were meetings for people with a passion for pure mathematics.
Then its applications to cryptology meant all sorts of people started coming who were merely interested in the security industry.
Now, with the cryptocurrency craze, it starts to attract people who are merely interested in the finance industry.

I shall be glad when the craze is over.

[QUOTE=retina;571725]If you call it for what it is then: uselesscoin. :razz:

But if you want to pretend it is something of value then: primecoin.[/QUOTE]
[URL="https://en.wikipedia.org/wiki/Primecoin"]Primecoin already exists.[/URL]

My suggestion is Marin. That is my sole contribution to this thread, as I have nothing to do with cryptocurrency.

[QUOTE=Nick;571732]Now, with the cryptocurrency craze, it starts to attract people who are merely [strike]interested in the finance industry[/strike] [b]greedy[/b].[/QUOTE]FTFY.

If, very unlikely, that a cryptocurrency were made, I will just quit GIMPS. Mersenne numbers are mathematically beautiful, but making crypto coins from it sounds too greedy.

Why? It will bring into the fry a lot of "losers" who waste their cycles elsewhere, which will help with the progress towards the goal of finding more mersenne primes, and making some money on the way too, for GIMPS and the coin-founders (like initial stake, at least, not talking about the EFF award), as well as for the people who [U]anyhow[/U] like spending their electricity here. I am such a "loser" myself, like 60-70% of my computing power is currently mining ETH, and there was a time no longer than one or two months ago, when the coin was higher, when I had 90-95% of the resources there.

The fact we don't make a coin of it yet has nothing to do with the morals, but with our inability of making a coin of it. Read stupidity, if you want. Math behind of it is not easy, if many bright people here could not come to a common conclusion (beside of "it can't really be done", haha).

[QUOTE=LaurV;581531]...


The fact we don't make a coin of it yet has nothing to do with the morals, but with our inability of making a coin of it. Read stupidity, if you want. Math behind of it is not easy, if many bright people here could not come to a common conclusion (beside of "it can't really be done", haha).[/QUOTE]

I believe it's doable relatively easily technically (blockchain, embedded PRP proofs, a transformation based on the previous block to deter hoarding of results, and incentivising other's results to be included in your block so that results that lost the race to mint are not lost), the actual blocker is that no one would use it besides us, and as it'd be less efficient than directly doing PRP not even that.

There is a tangible thing that could give such a coin value, namely PRP proofs have value to us, but we are several orders of magnitude off that actually meaning anything. Without that you're left with relying on speculation, aka just another trash coin in the wind. Nice in theory, dead in practice IMO.