What is proof-of-stake?

Question

As we know one of the important mechanisms of Bitcoin is proof-of-work.

How does the concept of proof-of-stake work? How does it differ from proof-of-work?

Answer 1

Proof of stake is a proposed alternative to proof of work designed to increase network security. It's not currently implemented in the main chain (and would likely require a hard fork to implement), but alt currency PPCoin features a hybrid proof-of-stake/proof-of-work system of sorts.

With proof of work, the likelihood of mining a block is dependent on the work done by the miner, e.g. the number of hashes checked for validity by a CPU, GPU, FPGA, or ASIC. As such, over time, the blocks are split across miners proportionally to their relative hashrates. With proof of stake, blocks are split relative to current wealth, so someone possessing 1% of the bitcoins currently in existence could "mine" 1% of the proof of stake blocks.

This proposed system has a few (theoretical) benefits relative to proof of work:

Reduced long-term transaction fees

When transaction fees form the majority of block rewards, with the current proof of work system, miners would be forced to require a "minimum" transaction fee if they wish to remain profitable, as they must utilize physical and costly resources (hardware, electricity, internet, etcetera) in order to mine blocks. Proof of stake has no such limitation, as solving blocks would require no physical resources whatsoever (apart from a computer running the Bitcoin software, which is essentially negligible).

Decreased likelihood of a 51% attack

In the current proof of work system, an attacker need merely obtain over half the current network hashing capacity for a short amount of time to perform a so-called "51% attack". With proof of stake, an attacker would need to obtain over half of the bitcoins in existence, a far more expensive and difficult feat. Moreover, performing a 51% attack and likely devaluing Bitcoin significantly wouldn't be all that appealing if you are so heavily vested into it.

However, this is debatable. If a single entity could obtain, even temporarily, loans or other borrowed capital comprising over half the network, they could perform a 51% attack with very little input resources, and might well have good incentive to do so. Just as centralized or leasable hashpower dramatically increases the risk of a 51% attack on a proof of work system, centralized or borrowable wealth dramatically increases the risk of a 51% attack on a proof of stake system.

Proof of stake was first formally proposed by forum user QuantumMechanic here. Two at least somewhat complete implementation specifications have been released, one by Meni Rosenfeld and one by Cunicula; both are explained in detail on the proof of stake wiki page. Both are hybrid proof-of-stake/proof-of-work implementations, meaning that 51% of the total wealth and 51% of the network hashpower would be required to create and maintain a fork. You can find the (unofficial) forum discussion thread here.