How Do You Make Something Expensive on Purpose? Demand a Useless Calculation

Actions that cost nothing can be repeated without limit, which is the underlying difficulty behind unwanted email, automated account creation, denial of service attacks and vote manipulation. Requiring a payment would solve it and introduces the problems of collecting money from strangers. Requiring effort instead achieves something similar, since a calculation that takes a computer a measurable amount of time and electricity cannot be repeated millions of times cheaply. The essential property needed is that the work must be hard to perform and trivial to verify, so that the sender bears a real cost while the recipient checks it instantly, and finding functions with that asymmetry is the technical core.

The standard construction uses a hash function:

• •A hash function converts any input into a fixed-length value unpredictably
• •There is no way to work backwards from a wanted output to an input
• •So finding an input whose output has a required property means guessing
• •Guessing requires an enormous number of attempts on average
• •Checking a claimed answer requires exactly one calculation
• •Difficulty is adjusted by demanding a more restrictive property

The concept was proposed by Cynthia Dwork and Moni Naor in 1992 specifically as a way of deterring unwanted email, by requiring a sender's computer to perform a few seconds of work per message, which is negligible for ordinary correspondence and prohibitive for somebody sending millions. Adam Back published a practical implementation in 1997 under the name Hashcash aimed at the same problem. Neither was widely adopted for email, since the approach requires universal deployment to work and disadvantages people with slow computers. The idea was then taken up for an entirely different purpose in 2008, as the mechanism by which a distributed system without any central authority decides which record of transactions to accept.

Beyond the famous application, the same idea appears in several places where making something costly is the point. Rate limiting on websites requires a small calculation before a request is accepted, which is invisible to a person and expensive for an automated tool making thousands of requests. Some anti-spam systems have adopted it for exactly the original purpose. Preventing automated account creation uses it alongside other tests. Denial of service defences apply it selectively when a server is under load. In each case the work required is trivial for a legitimate user acting once and prohibitive for anybody acting at volume, which is the whole design and which remains sound whatever happens to the largest application.

Using the approach to secure a valuable system produces a consequence its designers understood and its critics emphasise. Because whoever performs the most work controls the outcome, and because controlling the outcome is worth money, participants compete by performing more work, and that competition has no natural limit short of the point where the electricity costs as much as the reward. The resulting consumption is measured in tens of terawatt hours annually for the largest such system, comparable to a medium-sized country. Alternatives that establish who has most at stake by other means, rather than by burning electricity, have been developed and adopted by several systems, including one major network that changed over in 2022 and reduced its consumption by over ninety nine per cent.

Requiring a calculation that is hard to perform and trivial to verify makes an action costly to repeat, which deters flooding. Hash functions supply the asymmetry, since finding an input with a required output property means guessing many times while checking takes one calculation. Dwork and Naor proposed it against unwanted email in 1992. Competing to perform the most work has no natural limit, which is the origin of the energy consumption.