Computational Work Proof

💜 Support the DIG Network

Help build the future of decentralized storage! The DIG Network is an open-source project that needs community support to continue development.

💜 Support the Project → - Donate crypto, buy NFTs, or sponsor development

Overview

The Computational Work Proof demonstrates that storage providers performed proof-of-work specifically for each capsule within a plot. This per-capsule architecture prevents work theft by cryptographically binding computational effort to both the plot identifier and capsule hash.

Technical Specification

Proof Structure

interface ComputationalWorkProof {
  nonce: bytes;            // Found nonce (4-32 bytes)
  plotId: bytes32;         // Plot identifier binding
      capsuleHash: bytes32;    // Capsule identifier binding
  tableDataHash: bytes32;  // Table data commitment
  previousHash: bytes32;   // Chain verification
  difficulty: uint32;      // Achieved difficulty
  plotSeedCommitment?: bytes32; // Pre-PlotId binding
}

Work Hash Construction

The proof-of-work hash creates dual binding:

WorkHash = SHA-256(
  tableDataHash ||    // Table being worked on
  previousHash ||     // Previous table hash
  nonce ||           // Proof-of-work solution
  plotSeedCommitment || // Plot identity binding
      capsuleHash        // Capsule-specific binding
)

Plot Seed Commitment

Resolves circular dependency during plot creation:

PlotSeedCommitment = SHA-256(
  publicKey ||     // Owner's public key
  merkleRoot ||    // Plot data commitment
  blockHeight ||   // Chia block height
  blockHash        // Chia block hash
)

Timeline:

1. Compute merkle root from plot data
2. Generate plot seed commitment
3. Perform computational work bound to seed
4. Determine difficulty from completed work
5. Compute final PlotId including difficulty

Proof Generation

Algorithm

def generate_work_proof(table_data, plot_seed, capsule_hash, min_difficulty):
    table_hash = sha256(table_data)
    previous_hash = get_previous_table_hash()
    nonce = 0
    
    while True:
        work_input = table_hash + previous_hash + nonce.to_bytes() + plot_seed + capsule_hash
        work_hash = sha256(work_input)
        difficulty = count_leading_zeros(work_hash)
        
        if difficulty >= min_difficulty:
            return ComputationalWorkProof(
                nonce=nonce,
                difficulty=difficulty,
                tableDataHash=table_hash,
                previousHash=previous_hash,
                plotSeedCommitment=plot_seed
            )
        nonce += 1

Difficulty Metrics

Difficulty	Leading Zeros	Expected Attempts	Time @ 3GH/s
10	10 bits	2^10	0.3 ms
15	15 bits	2^15	11 ms
20	20 bits	2^20	0.35 sec
25	25 bits	2^25	11 sec
30	30 bits	2^30	6 min

Verification Process

Fast Verification

def verify_work_proof(proof, expected_plot_id, expected_capsule_hash, min_difficulty):
    # Verify bindings
    if proof.plotId != expected_plot_id:
        return False, "Plot binding mismatch"
    if proof.capsuleHash != expected_capsule_hash:
        return False, "Capsule binding mismatch"
    
    # Reconstruct work hash (single computation)
    work_input = (proof.tableDataHash + proof.previousHash + 
                  proof.nonce + proof.plotSeedCommitment + proof.capsuleHash)
    work_hash = sha256(work_input)
    
    # Verify difficulty
    achieved_difficulty = count_leading_zeros(work_hash)
    if achieved_difficulty < min_difficulty:
        return False, f"Insufficient difficulty: {achieved_difficulty} < {min_difficulty}"
    
    return True, None

Verification time: ~1ms regardless of difficulty

Security Properties

Attack Prevention

Work Theft

Attacker's plot: 0x1111...
Victim's work: nonce for plot 0x2222...

SHA-256(data + nonce + 0x1111... + capsule) ≠ SHA-256(data + nonce + 0x2222... + capsule)
→ Different hashes, work unusable

Capsule Substitution

Original: work for capsule 0xAAAA...
Attack: use for capsule 0xBBBB...

SHA-256(data + nonce + plot + 0xAAAA...) ≠ SHA-256(data + nonce + plot + 0xBBBB...)
→ Work bound to specific capsule

Difficulty Forgery

Actual: 0x00012345... (11 leading zeros)
Claimed: 20 leading zeros

count_leading_zeros(0x00012345...) = 11 < 20
→ Forgery detected

Cryptographic Guarantees

1. Work Performance: Computational effort provably expended
2. Dual Binding: Work inseparable from plot AND capsule
3. Non-transferability: Work cannot be reused
4. Verifiability: O(1) verification complexity

Integration

Proof Chain Position

1. Plot Ownership → Establishes plot X with difficulty D
2. Data Inclusion → Proves capsule C exists in plot X
3. Computational Work → Proves work of difficulty D for capsule C in plot X

Complete Package

interface ProofPackage {
  plotId: bytes32;
  capsuleHash: bytes32;
  
  plotOwnership: {
    difficulty: uint32;  // Required difficulty
    // ... other fields
  };
  
  dataInclusion: {
    // Merkle proof for capsule
  };
  
  computationalWork: {
    nonce: bytes;
    difficulty: uint32;  // Must be ≥ plotOwnership.difficulty
    // ... bindings
  };
}

Performance Characteristics

Generation

• Time: Exponential in difficulty (2^d expected attempts)
• Memory: O(1) - constant space
• Parallelizable: Yes (multiple nonce ranges)

Verification

• Time: O(1) - single hash computation
• Memory: O(1) - constant space
• Network: Zero - all data in proof

Implementation Notes

Nonce Size

• Minimum: 4 bytes (2^32 attempts)
• Maximum: 32 bytes (2^256 attempts)
• Typical: 4-8 bytes sufficient for most difficulties

Chain Verification

Each table's work includes previous table hash, creating verifiable chain through all 7 plot tables.

Summary

The Computational Work Proof provides per-capsule proof-of-work with dual cryptographic binding to prevent work theft. Through plot seed commitments and fast verification, the system ensures computational effort cannot be separated from its storage context while maintaining efficient validation.