[Ethereum] Why does Ethereum plan to move to Proof of Stake

The PoW algorithm used in Frontier and Homestead is called Ethash, and it was created specifically for Ethereum.

The primary reason for constructing a new proof of work function instead of using an existing one was to attack the problem of mining centralisation, where a small group of hardware companies or mining operations acquire a disproportionately large amount of power to impact or manipulate the network (should they so choose). The economic forces within existing networks (such as Bitcoin and Litecoin) make centralisation of mining efforts highly profitable, in part due to the possibility for producing ASICs, specialised chips specifically designed to outperform standardised computer hardware by many orders of magnitude in hashing performance. Other factors that promote mining centralisation, such as handling of orphaned blocks, are tackled separately within the Ethereum protocol. By specifically designing an "ASIC-resistant" PoW algorithm, the Ethereum team hopes to reduce economic incentives for mining centralisation in Ethereum, at least until a secure PoS algorithm can be designed and deployed.

The way that Ethash aims to provide a PoW algorithm for which commodity hardware is already highly optimised (and hence creation of an ASIC, which is expensive, will yield very little advantage over simply using the latest commodity hardware) is by emphasising a property called memory hardness. Memory hardness essentially means that your performance is limited by how fast your computer can move data around in memory rather than by how fast it can perform calculating operations. Consumer graphics cards compete very strongly in this area, which means that a potential ASIC designer can't easily do better: if they had a new idea for improving memory bandwidth it would be more profitable to sell that idea to a graphics card company than to design a mining ASIC for it. And in any case the mainstream computer industry has large teams devoted to this problem already.

The friendly Ghost

Casper is a security-deposit based economic consensus protocol. This means that nodes, so called bonded validators, have to place a security deposit, an action called bonding, in order to serve the consensus by producing blocks.

In Casper style proof of stake anyone can participate in block production by posting a bond. After posting a bond you have an opportunity to bet on which block will be included next. The incentives are such that you make money by betting with the eventual consensus and lose money by betting against the consensus. Any crypto-graphically provable misbehavior results in the forfeit of the bond.

An analogy can be made to proof of work where each miner is betting with their hash power on which block will be accepted. If they bet wrong then any block they produce will be orphaned causing them to lose money.

This protocol has several nice properties:

• Anyone can participate
• Consensus can be reached in a timely manner
• It quickly converges on an irreversible consensus
• It is free of politics

Casper in non-economic terms

Casper is an eventually-consistent blockchain-based consensus protocol. It favours availability over consistency, see the CAP theorem. It is always available, and consistent whenever possible. It is robust to unpredictable message delivery times because nodes come to consensus via re-organization of transactions, after delayed messages are eventually received. It has an eventual fault tolerance of 50%, in the sense that a fork created by >50% correct nodes scores higher than any fork created by the remaining potentially-faulty validators. Notably, though, clients cannot be certain that any given fork created with 51% participation won’t be reverted because they cannot know whether some of these nodes are Byzantine. Clients therefore only consider a block as finalized if it has the participation of a supermajority of validators or bonded stake.