Upcoming Changes for Chia’s New Proof of Space Format
Exciting updates are on the horizon for Chia farmers with the latest iteration of Chia’s new proof of space format. Earlier this year, we shared our progress on new technologies that we believe addressed two pressing issues:
- Higher Energy Consumption from Compressed Plots: Tools like DrPlotter allowed for smaller plots but required significantly higher ongoing energy, counteracting the Chia blockchain’s energy-efficient goals.
- Rental Attack Risks: Advances in GPU technology raised concern that a future attacker could potentially rent enough powerful GPUs to spoof a majority of the netspace.
The initial redesign made significant strides, improving security by making the network up to 1000x more resistant to rental attacks and greatly enhancing compression resistance with only a small upfront cost during harvesting.
Now, we’re excited to announce further advancements that build on this foundation. The latest updates should provide even greater efficiency, reduced energy consumption, enhanced security, improved compression resistance, and expanded accessibility.
Key Improvements
- Lower Minimum Specs for Harvesting: Farmers can harvest petabytes of space using lightweight compute devices like a Raspberry Pi 5.
- Support for Smaller Plots: New plot sizes as small as 3 GiB and lower RAM requirements for plotting, make farming more accessible.
- More Efficient Plotting: Plotting is now faster per TiB, with reduced memory requirements for smaller plot sizes. All-RAM plotting is accessible to more systems.
- Reduced Network Energy Consumption: The new format significantly decreases the network’s overall energy usage without compromising compression resistance or security.
- Stronger Compression Resistance: “Compressible” plots are economically nonviable, ensuring that network security remains based on physical storage space, promoting fairness and sustainability.
- Near-instant proof verification: Ensures efficient network performance.
How These Changes Work
The key innovations in this iteration are the introduction of a “frozen” quality string and a “chain of proofs.” These advancements not only significantly enhance compression resistance by shifting all security to a single, infrequent point but also reduce the energy consumption of honest farming to a negligible level.
- The “Frozen” Quality String: This feature encrypts and removes a substantial portion of the plot data required for the proof while still allowing the plot to pass the quality string test during harvesting. Full proof recomputation is only required if the quality string passes the test and wins a block or pool partial.
- The “Chain of Proofs”: To prevent attackers from exploiting frozen quality strings and selective recomputation, this system chains 8 proofs derived from the same 5 tables in the plot. Each proof is chosen based on the preceding ones, significantly hindering compression attacks by creating an overwhelming number of combinatorial false positives when attempting to drop bits in the attack.
Additionally, the plot design ensures that an honest farmer can recompute the full proof for all its elements faster than the sum of recomputing individual elements. This enables recomputation on low-spec hardware within a reasonable time. In contrast, an attacker must perform multiple recomputations for individual elements with every challenge, making attacks prohibitively expensive—even for attempts to remove a single additional bit of data.
Complete technical details will be published in the upcoming CHIP (Chia Improvement Proposal). (See our timeline for more info.)
Impact on Farming
Under the new system:
- Farmers can use lightweight devices like a Raspberry Pi 5 to harvest large amounts of space (many petabytes).
- Recomputation is required only when a quality string is valid for a block win or pool partial. This occurs infrequently, at most once every few minutes for pool farming, and less often for solo farming.
- Minimum specs depend on the largest plot size (k-size) in use—not the total number of plots.
Smaller vs. Larger Plot Sizes
- Smaller plots require less memory for plotting and recomputation but increase mechanical HDD activity.
- Larger plots reduce HDD activity but demand higher resources for plotting and recomputation.
Plot Sizes and Performance
Supported Plot Sizes:
The new proof of space format supports plots as small as 3 GiB. Due to symmetric properties of the format, only even-sized k-sizes are supported. While we currently have no plans to support sizes smaller than k28, larger k-sizes may be enabled in the future. Each even-step k-size is a little over four times larger than the previous size.
- k34: ~260 GiB
- k32: ~61 GiB
- k30: ~14 GiB
- k28: ~3 GiB
Plotting Speed (with All-RAM Requirements)
CPU plotting will be possible but will be less efficient than GPU. All times shown are for all-RAM plotting, although farmers can trade cpu RAM for temporary SSD storage, which results in slightly slower performance.
| Plot Size | Raspberry Pi 5 | Ryzen 5600 (6-core) | Nvidia 3090 |
|---|---|---|---|
| k34 (512 GiB all RAM, min 8GiB) |
N/A | ~10 hours | ~6 minutes (min. 8GiB VRAM) |
| k32 (128 GiB all RAM, min 2GiB) |
N/A | ~3 hours | ~1-2 minutes (min. 2GiB VRAM) |
| k30 (32 GiB all RAM, min 512MiB) |
N/A | ~45 minutes | ~30 seconds (min. 512MiB VRAM) |
| k28 (8 GiB all RAM, min 128MiB) |
~40 minutes | ~12 minutes | ~5 seconds (min. 128MiB VRAM) |
| Plotted space/day | Up to 170 GiB | Up to 800 GiB | Up to 100 TiB |
Proof Solving Times
After a proof of sufficiently high quality is found it needs to be ‘solved’ which reconstructs the full proof so it can be verified by others. Proof-solving hardware requirements depend on the maximum k-size in the farm. Solve times should ideally stay under 8 seconds.
| Plot Size | Raspberry Pi 5 | Ryzen 5600 (6-core) | Threadripper | Nvidia 3060 |
|---|---|---|---|---|
| k28 | ~6.8 seconds | <2 seconds | <1 second | 60 ms |
| k30 | N/A | <8 seconds | <4 seconds | 240 ms |
| k32 | N/A | ~15 seconds | <8 seconds | 960 ms |
| k34 | N/A | N/A | N/A | <8 seconds |
HDD Disk Activity
Lower k-sizes increase disk activity but lower your minimum hardware requirements for proof solving (see previous section). For SSDs, k28 plots are recommended due to minimal impact on farming performance.
| Plot Size | Full 5TiB Disk Load | Full 20TiB Disk Load | Full 20TiB Disk Load Using Benes Compression |
|---|---|---|---|
| k28 | ~1.6% | ~6.4% | ~12.8% |
| k30 | ~0.4% | ~1.5% | ~3% |
| k32 | ~0.1% | ~0.4% | ~0.8% |
| k34 | ~0.025% | ~0.1% | ~0.2% |
Quality Strings Frequency
Quality strings are found when a plot passes several filters, including plot ID, scan, and chain filters. Once found, they are tested against a difficulty filter to determine if they qualify as a block or pool partial win.
Solo farming: The frequency of quality strings does not significantly impact farming activity.
Pool farming: Increased quality string frequency improves pool size estimation accuracy for smaller farmers, helping stabilize rewards. Farmers with few plots may experience fluctuating estimated space and rewards day-to-day, but over time, rewards will align with actual plotted space.
| Plot Size | Avg. Quality Strings per hr per TiB |
|---|---|
| k28 | ~9.1 |
| k30 | ~2.1 |
| k32 | ~0.5 |
| k34 | ~0.12 |
Trade-Offs Under Consideration
As we finalize the design of the new proof of space format, critical trade-offs are being carefully evaluated. These decisions affect key aspects like HDD activity, compression resistance, rental attack security, and quality string frequency. Below are the considerations and their implications:
- Lowering HDD Activity
- Pros: Reduces wear and tear on disks, which is especially valuable for larger farms and setups relying on HDDs.
- Cons: Reduces rental attack resistance, compression resistance, and quality string frequency, which could impact fairness and security.
- Increasing Quality String Frequency
- Pros: Improves pool size estimation accuracy for smaller farmers, leading to more consistent and predictable rewards.
- Cons: Increases HDD activity, raising disk wear and potentially shortening the lifespan of mechanical drives. Reduces rental attack resistance.
Current Tuning and Security Assurances
The current settings are optimized to balance these trade-offs:
Compression Resistance: Theoretical GPUs with 10x the performance per watt of a 4090 cannot economically compress even 1% of a plot’s size without exceeding the energy and cost requirements of honest plotting.
Rental Attack Resistance: The resistance is strong enough that an H100x8 GPU cluster could at most spoof 500 GiB of space, making rental-based attacks infeasible.
Looking Ahead
We’re pleased with the progress we’ve made as we prepare for this transition, but as we transition from prototypes and benchmarks to production-grade code, further tuning of parameters may be necessary to optimize the proof of space format for real-world conditions. Stay tuned for the official CHIP proposal, which will provide detailed specifications for the new format.