Skip to content
Blockchain LabBlockchain LabTHE VENTURE STUDIO

LibraryConsensus2015Design paperCorpus record

Proofs of Space

Proofs of space. Stefan Dziembowski, Sebastian Faust, Vladimir Kolmogorov and Krzysztof Pietrzak.

A proof that a machine reserved storage, not that it burned energy on a puzzle. The verifier checks a small challenge. Chia is a later system that pairs this idea with a verifiable delay. The paper is not Chia.

A proof of space shows that a prover stored a large structure that cannot be recomputed quickly. The verifier checks a few random locations. Electricity is no longer the resource being measured. Computation that replaces storage defeats the proof.
Evidence
Primary paper
Re-measured
No
Assumptions
4
Records linked
3

Code

Source, repository, and what is actually hosted

  • ePrint 2013/796https://eprint.iacr.org/2013/796
  • The source URL is not a GitHub repository. No code remote is invented.
  • Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
  • Add to a reading list

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

  1. Claim 01 · Paper model

    Initialisation is the expensive part

    The prover fills disk with a table that has to be built, not with random bytes. If the table can be regenerated during the challenge faster than it can be read, the prover never needed the disk.

  2. Claim 02 · Paper model

    The challenge is a small read

    The verifier asks for a handful of positions. A prover who stored the table answers quickly. A prover who did not has to recompute.

  3. Claim 03 · Paper model

    The bound is the paper

    The theorem is a tradeoff between space and the time needed to answer. A loose bound means a clever encoding still wins with CPUs. The proof is only as good as that bound.

  4. Claim 04 · Paper model

    Chia added a clock

    A later network pairs space proofs with a verifiable delay so farmers cannot grind many challenges. That delay is not in this paper. Do not import it backwards.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

  1. 01 Initialisation is the expensive part

    Observation

    What the study says

    The prover fills disk with a table that has to be built, not with random bytes. If the table can be regenerated during the challenge faster than it can be read, the prover never needed the disk.

    Model

    What has to hold

    The verifier's challenge is unpredictable before the table is fixed. Otherwise the prover stores only the answers.

    Falsifier

    What would retire it

    What is stored, and can it be recomputed during the challenge?

  2. 02 The challenge is a small read

    Observation

    What the study says

    The verifier asks for a handful of positions. A prover who stored the table answers quickly. A prover who did not has to recompute.

    Model

    What has to hold

    The verifier's challenge is unpredictable before the table is fixed. Otherwise the prover stores only the answers.

    Falsifier

    What would retire it

    Is the challenge fixed before the prover can regenerate answers?

  3. 03 The bound is the paper

    Observation

    What the study says

    The theorem is a tradeoff between space and the time needed to answer. A loose bound means a clever encoding still wins with CPUs. The proof is only as good as that bound.

    Model

    What has to hold

    Recomputing the table is slower than storing it, by the margin the proof claims.

    Falsifier

    What would retire it

    Is the proof about reserved space or about a specific file?

  4. 04 Chia added a clock

    Observation

    What the study says

    A later network pairs space proofs with a verifiable delay so farmers cannot grind many challenges. That delay is not in this paper. Do not import it backwards.

    Model

    What has to hold

    The quality ranking, if used for a lottery, is the one the verifier recomputes.

    Falsifier

    What would retire it

    Is there a delay function, or can the prover grind?

03 Sequence

One action, as an operating tape

  1. 01The prover runs an initialisation on a nonce and fills storage.
  2. 02A challenge is derived, in a full protocol from the chain, in the paper from the verifier.
  3. 03The prover returns the table entries the challenge names, plus whatever proof shows they sit in the initialised structure.
  4. 04The verifier checks the entries with little work.
  5. 05A quality function can rank proofs so a lottery can pick one winner among many provers.

04 Load-bearing

The argument, and where a pitch drops it

  1. Space is not 'unused hard drives' by magic

    The cut

    The economic story people tell, that empty disks are greener than hash machines, is not the theorem. The theorem is a time-space tradeoff. If plotting is itself an energy-intensive industry, the deployment has left the slogan even when the proof still measures disk.

    Why it carries weight

    If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

    Where it is dropped

    A proof of space does not, by itself, stop a grinding attack on the challenge. Chia adds a delay function for that reason. This paper does not include that delay.

  2. Grinding is the next problem

    The cut

    If a prover can try many challenges cheaply, they do not need more space. They need more attempts. Delay functions were added later because this paper's proof, alone, does not stop that.

    Why it carries weight

    If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

    Where it is dropped

    A proof of space does not, by itself, stop a grinding attack on the challenge. Chia adds a delay function for that reason. This paper does not include that delay.

05 Register

What has to be true

  • Cryptography · Not re-measured

    Recomputing the table is slower than storing it, by the margin the proof claims.

  • Model · Not re-measured

    The verifier's challenge is unpredictable before the table is fixed. Otherwise the prover stores only the answers.

  • Adversary · Not re-measured

    Provers do not share a single table while pretending to be many. Sybil behaviour depends on the surrounding protocol.

  • Model · Not re-measured

    The quality ranking, if used for a lottery, is the one the verifier recomputes.

06 Divergence

What happened after the paper

Chia is the well-known deployment that combined proofs of space with proofs of time. Filecoin's proofs of replication are a different statement: that a specific file is stored, not that some structure of the right size exists. The 2015 paper is the space proof. It is not either network.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

  5. 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

The problem it names

Proof of work buys Sybil resistance with electricity. Proofs of space try to buy it with dedicated disk, so that the cost is a stock of storage rather than a continuous burn.

What the design proposes

  • An initialization that fills disk with a structure the prover cannot recompute quickly.
  • A challenge that asks for a few locations.
  • A bound on how much computation can replace storage. That bound is the whole game.

How the mechanism is specified

  • If the structure can be recomputed faster than reading the disk, the proof no longer measures space.
  • The quality of a proof can be graded, so a lottery can pick a winner among provers.
  • Nothing here orders transactions or pays a farmer. Those are protocol choices made later.

What this page does not treat as proven

  • A proof of space does not, by itself, stop a grinding attack on the challenge. Chia adds a delay function for that reason. This paper does not include that delay.
  • Storage that is not dedicated can be rented. The economic assumption is not in the theorem.
  • Plotting hardware and energy still exist in later systems. Do not repeat a claim that the paper does not make.

Why the desk still reads it

Ask what resource is actually scarce after a clever encoding. If the answer is still parallel computation, you do not have a proof of space.

09 Lexicon

Terms, opened into the record

Proof of space
A proof that the prover expended storage, checked by a small random read.
Time-space tradeoff
The claim that answering without the stored table costs more computation than the protocol allows.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

Protocols

This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.

Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.