Variable Block Size Proposal

Variable Block Size Proposal
2015-08-29 14:22 ` Jameson Lopp
  
From: Justin M. Wray @ 2015-08-29  5:41 UTC (permalink / raw)
  To: bitcoin-dev

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hey Bitcoiners!

While I am an avid Bitcoin supporter, long-term user, and have done
development work on tools and platforms surrounding Bitcoin, I have
been very busy these past few weeks and haven't had a chance to fully
(or closely) monitor the Block Size debate.

I'm familiar with the basics, and have read abstracts about the
front-running proposals (BIP 100, 101, and 102). Though I've honestly
not read those in depth either. With that said, I was driving
the other day and thought of a potential idea. I'll be clear, this is
just an idea, and I haven't fully fleshed it out. But I thought I'd
throw it out there and see what people thought.

My Goal:

Provide a variable block size that provides for sustainable, long-term
growth, and balances the block propagation, while also being mindful
of potential spam attacks.

The Proposal:

Every 2016 blocks (approximately every two weeks, at the same time the
difficulty is adjusted), the new block size parameters are calculated.

The calculation determines the average (mean) size of the past 2016
blocks. This "average" size is then doubled (200%) and used as the
maximum block size for the subsequent 2016 blocks. At any point, if
the new maximum size is calculated to be below 1MB, 1MB is used
instead (which prevents regression from our current state).

Introduce a block minimum, the minimum will be 25% of the current
maximum, calculated at the same time (that is, every 2016 blocks, at
the same time the maximum is calculated). All blocks must be at least
this size in order to be valid, for blocks that do not have enough
transactions to meet the 25%, padding will be used. This devalues the
incentive to mine empty blocks in either an attempt to deflate the
block size, or to obtain a propagation advantage. Miners will be
incentivized to include transactions, as the block must meet the
minimum. This should ensure that even miners wishing to always mine
the minimum are still confirming Bitcoin transactions.

At the block in which this is introduced the maximum would stay at 1MB
for the subsequent 2016 blocks. With the minimum being enforced of 256KB
.

Example:

    * Average Block Size for the last 2016 blocks: 724KB
    * New Maximum: 1448KB
    * New Minimum: 362KB

Example: (Regression Prevention)

    * Average Block Size for the last 2016 blocks: 250KB
    * New Maximum: 1MB
    * New Minimum: 256KB

The Future:

I believe that the 1MB regression prevention might need to be changed
in the future, to prevent a large mining population from continually
deflating the block size (and keeping us at the 1MB limit).

For this, the hard limit could be changed in the future manually,
through a process similar to the current one, though hopefully with
far less urgency and hysteria.

Another option is to add an additional calculation, preventing the new
maximum from being lower than 75% of the current maximum. This would
substantially slow down a block-size deflation attack.

 Example of Block-Size Deflation Attack Prevention:

 * Average Block Size for the last 2016 blocks:  4MB
 * New Maximum:  8MB
 * New Minimum:  2MB

 * Average Block Size for the last 2016 blocks:  2MB
 * New Maximum:  6MB  (2 * 200% = 4, 4< 75% of 8, So use 8 * .75 = 6)
 * New Minimum:  1.5MB

This would provide a maximum growth of 200% per recalculation, but a
maximum shrinkage of 75%.

Request For Comments:

I'd love to hear your thoughts. Why wouldn't this work? What portion
is flawed? Will the miners support such a proposal? Would this even
solve the block size issue?

I will note that I don't find the 100% and 25% to be hard and fast in
my idea. Those we're just the values that initially jumped out at me.
I could easily see the minimum being anything below 50% (above 50% and
the network can never adjust to smaller block sizes). I could also see
the maximum being anything over 100%.  Lastly, if a inflation attack
is a valid concern, a hard upper limit could be set (or the historical
32MB limit could remain).

I think the great part about this variable approach is that the
network can adjust to address spikes in volume and readjust once those
spikes dissipate.

- -- 
Thanks!

- -----
Justin M. Wray
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJV4UXvAAoJENo/Q5Xwcn83ZWEP/iXAlNk5p9OlOPNSoHkECcxe
AcartxMLrmOvAZVudU4+239TEvwPydmYX/ptmBYgrvRJfm/TWmi0ZbTioxbxTIWM
IlNta1Y8IOHOEgBCtSW01j1PFHIzkBHQGIuqrKHhjcNVGbegXlPm3Da0gjNuTBIe
IV58gf1OfYK2XjuCMQMvo3VyXUKhqbOvBNnZXr+Qo2sAtanmxHQ+TU/gjA02L9LO
bb8WqQDj/veGnMexGh/X58tfQ5KCfLO401F7KnConDaFdKVDikp32zaSXZ7JWf/K
OeseHW1OHHVdYpHvh5VG5GLtYYB5rnq8g7B0/kyx5n4ldB6GkLxzH9CPB0vxpMnZ
dVCS/+EUe/wkHrpRVNhMwP8XfG+8gv9upKg6H/u39XmpL2H2G4cKeot5xRiWRNqY
oJclAeIhDTL1bx/9e/VqvM91ESWpBLs+O8Mh9OzgfbN3gKR6BuoWHNwM9jSMDAT1
YzwdneSvAEFzgELMlae2QIzAUHno9qkHMkDVbdY3bBtSM9Xz4ditGgnq1D40ZZ+J
zx5WVY7HCebgbk7T35xgKzSKQSEG9zFNW5Dvq66Se3Zpc5vCPw7Q2xwjjPz3zdXQ
Lub0ohVWTzKr05tN1e/nu6keiY5cXRZ0w2MtHb19jtdWyoHEWWHanfOZjgbVSsuA
saFCydA7O4E4BFxgtNze
=JthX
-----END PGP SIGNATURE-----


 permalink raw reply	[|nested]
2015-08-29  5:41 [bitcoin-dev] Variable Block Size Proposal Justin M. Wray

  2015-08-29 18:25   ` Justin M. Wray
  2015-08-29 20:59   ` Jorge Timón
  
From: Jameson Lopp @ 2015-08-29 14:22 UTC (permalink / raw)
  To: Justin M. Wray;  Bitcoin Dev

[-- Attachment #1: Type: text/plain, Size: 6183 bytes --]

I don't think you'll find much support for introducing a mandatory minimum
block size. It's quite wasteful to "pad" blocks with transactions that the
miner is just sending back to themself. If you want to solve the block
propagation issue, I'd recommend instead working on O(1) block propagation.

The Bitcoin Relay Network already allows miners to relay blocks much
faster: http://bitcoinrelaynetwork.org/

The next step would be getting O(1) block propagation into the Bitcoin
protocol. Check out Gavin's proposal:
https://gist.github.com/gavinandresen/e20c3b5a1d4b97f79ac2

- Jameson

On Sat, Aug 29, 2015 at 1:41 AM, Justin M. Wray via bitcoin-dev <
bitcoin-dev@lists•linuxfoundation.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Hey Bitcoiners!
>
> While I am an avid Bitcoin supporter, long-term user, and have done
> development work on tools and platforms surrounding Bitcoin, I have
> been very busy these past few weeks and haven't had a chance to fully
> (or closely) monitor the Block Size debate.
>
> I'm familiar with the basics, and have read abstracts about the
> front-running proposals (BIP 100, 101, and 102). Though I've honestly
> not read those in depth either. With that said, I was driving
> the other day and thought of a potential idea. I'll be clear, this is
> just an idea, and I haven't fully fleshed it out. But I thought I'd
> throw it out there and see what people thought.
>
> My Goal:
>
> Provide a variable block size that provides for sustainable, long-term
> growth, and balances the block propagation, while also being mindful
> of potential spam attacks.
>
> The Proposal:
>
> Every 2016 blocks (approximately every two weeks, at the same time the
> difficulty is adjusted), the new block size parameters are calculated.
>
> The calculation determines the average (mean) size of the past 2016
> blocks. This "average" size is then doubled (200%) and used as the
> maximum block size for the subsequent 2016 blocks. At any point, if
> the new maximum size is calculated to be below 1MB, 1MB is used
> instead (which prevents regression from our current state).
>
> Introduce a block minimum, the minimum will be 25% of the current
> maximum, calculated at the same time (that is, every 2016 blocks, at
> the same time the maximum is calculated). All blocks must be at least
> this size in order to be valid, for blocks that do not have enough
> transactions to meet the 25%, padding will be used. This devalues the
> incentive to mine empty blocks in either an attempt to deflate the
> block size, or to obtain a propagation advantage. Miners will be
> incentivized to include transactions, as the block must meet the
> minimum. This should ensure that even miners wishing to always mine
> the minimum are still confirming Bitcoin transactions.
>
> At the block in which this is introduced the maximum would stay at 1MB
> for the subsequent 2016 blocks. With the minimum being enforced of 256KB
> .
>
> Example:
>
>     * Average Block Size for the last 2016 blocks: 724KB
>     * New Maximum: 1448KB
>     * New Minimum: 362KB
>
> Example: (Regression Prevention)
>
>     * Average Block Size for the last 2016 blocks: 250KB
>     * New Maximum: 1MB
>     * New Minimum: 256KB
>
> The Future:
>
> I believe that the 1MB regression prevention might need to be changed
> in the future, to prevent a large mining population from continually
> deflating the block size (and keeping us at the 1MB limit).
>
> For this, the hard limit could be changed in the future manually,
> through a process similar to the current one, though hopefully with
> far less urgency and hysteria.
>
> Another option is to add an additional calculation, preventing the new
> maximum from being lower than 75% of the current maximum. This would
> substantially slow down a block-size deflation attack.
>
>  Example of Block-Size Deflation Attack Prevention:
>
>  * Average Block Size for the last 2016 blocks:  4MB
>  * New Maximum:  8MB
>  * New Minimum:  2MB
>
>  * Average Block Size for the last 2016 blocks:  2MB
>  * New Maximum:  6MB  (2 * 200% = 4, 4< 75% of 8, So use 8 * .75 = 6)
>  * New Minimum:  1.5MB
>
> This would provide a maximum growth of 200% per recalculation, but a
> maximum shrinkage of 75%.
>
> Request For Comments:
>
> I'd love to hear your thoughts. Why wouldn't this work? What portion
> is flawed? Will the miners support such a proposal? Would this even
> solve the block size issue?
>
> I will note that I don't find the 100% and 25% to be hard and fast in
> my idea. Those we're just the values that initially jumped out at me.
> I could easily see the minimum being anything below 50% (above 50% and
> the network can never adjust to smaller block sizes). I could also see
> the maximum being anything over 100%.  Lastly, if a inflation attack
> is a valid concern, a hard upper limit could be set (or the historical
> 32MB limit could remain).
>
> I think the great part about this variable approach is that the
> network can adjust to address spikes in volume and readjust once those
> spikes dissipate.
>
> - --
> Thanks!
>
> - -----
> Justin M. Wray
> -----BEGIN PGP SIGNATURE-----
> Comment: GPGTools - https://gpgtools.org
>
> iQIcBAEBCgAGBQJV4UXvAAoJENo/Q5Xwcn83ZWEP/iXAlNk5p9OlOPNSoHkECcxe
> AcartxMLrmOvAZVudU4+239TEvwPydmYX/ptmBYgrvRJfm/TWmi0ZbTioxbxTIWM
> IlNta1Y8IOHOEgBCtSW01j1PFHIzkBHQGIuqrKHhjcNVGbegXlPm3Da0gjNuTBIe
> IV58gf1OfYK2XjuCMQMvo3VyXUKhqbOvBNnZXr+Qo2sAtanmxHQ+TU/gjA02L9LO
> bb8WqQDj/veGnMexGh/X58tfQ5KCfLO401F7KnConDaFdKVDikp32zaSXZ7JWf/K
> OeseHW1OHHVdYpHvh5VG5GLtYYB5rnq8g7B0/kyx5n4ldB6GkLxzH9CPB0vxpMnZ
> dVCS/+EUe/wkHrpRVNhMwP8XfG+8gv9upKg6H/u39XmpL2H2G4cKeot5xRiWRNqY
> oJclAeIhDTL1bx/9e/VqvM91ESWpBLs+O8Mh9OzgfbN3gKR6BuoWHNwM9jSMDAT1
> YzwdneSvAEFzgELMlae2QIzAUHno9qkHMkDVbdY3bBtSM9Xz4ditGgnq1D40ZZ+J
> zx5WVY7HCebgbk7T35xgKzSKQSEG9zFNW5Dvq66Se3Zpc5vCPw7Q2xwjjPz3zdXQ
> Lub0ohVWTzKr05tN1e/nu6keiY5cXRZ0w2MtHb19jtdWyoHEWWHanfOZjgbVSsuA
> saFCydA7O4E4BFxgtNze
> =JthX
> -----END PGP SIGNATURE-----
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists•linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

[-- Attachment #2: Type: text/html, Size: 7439 bytes --]

 permalink raw reply	[|nested]
2015-08-29 14:22 ` Jameson Lopp

  2015-08-29 20:59   ` Jorge Timón
  
From: Justin M. Wray @ 2015-08-29 18:25 UTC (permalink / raw)
  To: Jameson Lopp;  Bitcoin Dev

[-- Attachment #1: Type: text/plain, Size: 8167 bytes --]


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

That's fine too.  Obviously the variable maximum would work just fine
without a minimum.  In fact, with the O(1) propagation proposal, a
minimum number of transactions could be enforced, think - a percentage
of the current mempool.  That's actually far more meaningful to both
miners and consumers.

On 8/29/15 10:22 AM, Jameson Lopp wrote:
> I don't think you'll find much support for introducing a mandatory minimum block size. It's quite
wasteful to "pad" blocks with transactions that the miner is just
sending back to themself. If you want to solve the block propagation
issue, I'd recommend instead working on O(1) block propagation.
>
> The Bitcoin Relay Network already allows miners to relay blocks much
faster: http://bitcoinrelaynetwork.org/
>
> The next step would be getting O(1) block propagation into the Bitcoin
protocol. Check out Gavin's proposal:
https://gist.github.com/gavinandresen/e20c3b5a1d4b97f79ac2
>
> - Jameson
>
> On Sat, Aug 29, 2015 at 1:41 AM, Justin M. Wray via bitcoin-dev
<bitcoin-dev@lists•linuxfoundation.org
<mailto:bitcoin-dev@lists•linuxfoundation.org>> wrote:
>
>     -----BEGIN PGP SIGNED MESSAGE-----
>     Hash: SHA512
>
>     Hey Bitcoiners!
>
>     While I am an avid Bitcoin supporter, long-term user, and have done
>     development work on tools and platforms surrounding Bitcoin, I have
>     been very busy these past few weeks and haven't had a chance to fully
>     (or closely) monitor the Block Size debate.
>
>     I'm familiar with the basics, and have read abstracts about the
>     front-running proposals (BIP 100, 101, and 102). Though I've honestly
>     not read those in depth either. With that said, I was driving
>     the other day and thought of a potential idea. I'll be clear, this is
>     just an idea, and I haven't fully fleshed it out. But I thought I'd
>     throw it out there and see what people thought.
>
>     My Goal:
>
>     Provide a variable block size that provides for sustainable, long-term
>     growth, and balances the block propagation, while also being mindful
>     of potential spam attacks.
>
>     The Proposal:
>
>     Every 2016 blocks (approximately every two weeks, at the same time the
>     difficulty is adjusted), the new block size parameters are calculated.
>
>     The calculation determines the average (mean) size of the past 2016
>     blocks. This "average" size is then doubled (200%) and used as the
>     maximum block size for the subsequent 2016 blocks. At any point, if
>     the new maximum size is calculated to be below 1MB, 1MB is used
>     instead (which prevents regression from our current state).
>
>     Introduce a block minimum, the minimum will be 25% of the current
>     maximum, calculated at the same time (that is, every 2016 blocks, at
>     the same time the maximum is calculated). All blocks must be at least
>     this size in order to be valid, for blocks that do not have enough
>     transactions to meet the 25%, padding will be used. This devalues the
>     incentive to mine empty blocks in either an attempt to deflate the
>     block size, or to obtain a propagation advantage. Miners will be
>     incentivized to include transactions, as the block must meet the
>     minimum. This should ensure that even miners wishing to always mine
>     the minimum are still confirming Bitcoin transactions.
>
>     At the block in which this is introduced the maximum would stay at 1MB
>     for the subsequent 2016 blocks. With the minimum being enforced of
256KB
>     .
>
>     Example:
>
>         * Average Block Size for the last 2016 blocks: 724KB
>         * New Maximum: 1448KB
>         * New Minimum: 362KB
>
>     Example: (Regression Prevention)
>
>         * Average Block Size for the last 2016 blocks: 250KB
>         * New Maximum: 1MB
>         * New Minimum: 256KB
>
>     The Future:
>
>     I believe that the 1MB regression prevention might need to be changed
>     in the future, to prevent a large mining population from continually
>     deflating the block size (and keeping us at the 1MB limit).
>
>     For this, the hard limit could be changed in the future manually,
>     through a process similar to the current one, though hopefully with
>     far less urgency and hysteria.
>
>     Another option is to add an additional calculation, preventing the new
>     maximum from being lower than 75% of the current maximum. This would
>     substantially slow down a block-size deflation attack.
>
>      Example of Block-Size Deflation Attack Prevention:
>
>      * Average Block Size for the last 2016 blocks:  4MB
>      * New Maximum:  8MB
>      * New Minimum:  2MB
>
>      * Average Block Size for the last 2016 blocks:  2MB
>      * New Maximum:  6MB  (2 * 200% = 4, 4< 75% of 8, So use 8 * .75 = 6)
>      * New Minimum:  1.5MB
>
>     This would provide a maximum growth of 200% per recalculation, but a
>     maximum shrinkage of 75%.
>
>     Request For Comments:
>
>     I'd love to hear your thoughts. Why wouldn't this work? What portion
>     is flawed? Will the miners support such a proposal? Would this even
>     solve the block size issue?
>
>     I will note that I don't find the 100% and 25% to be hard and fast in
>     my idea. Those we're just the values that initially jumped out at me.
>     I could easily see the minimum being anything below 50% (above 50% and
>     the network can never adjust to smaller block sizes). I could also see
>     the maximum being anything over 100%.  Lastly, if a inflation attack
>     is a valid concern, a hard upper limit could be set (or the historical
>     32MB limit could remain).
>
>     I think the great part about this variable approach is that the
>     network can adjust to address spikes in volume and readjust once those
>     spikes dissipate.
>
>     - --
>     Thanks!
>
>     - -----
>     Justin M. Wray
>     -----BEGIN PGP SIGNATURE-----
>     Comment: GPGTools - https://gpgtools.org
>
>     iQIcBAEBCgAGBQJV4UXvAAoJENo/Q5Xwcn83ZWEP/iXAlNk5p9OlOPNSoHkECcxe
>     AcartxMLrmOvAZVudU4+239TEvwPydmYX/ptmBYgrvRJfm/TWmi0ZbTioxbxTIWM
>     IlNta1Y8IOHOEgBCtSW01j1PFHIzkBHQGIuqrKHhjcNVGbegXlPm3Da0gjNuTBIe
>     IV58gf1OfYK2XjuCMQMvo3VyXUKhqbOvBNnZXr+Qo2sAtanmxHQ+TU/gjA02L9LO
>     bb8WqQDj/veGnMexGh/X58tfQ5KCfLO401F7KnConDaFdKVDikp32zaSXZ7JWf/K
>     OeseHW1OHHVdYpHvh5VG5GLtYYB5rnq8g7B0/kyx5n4ldB6GkLxzH9CPB0vxpMnZ
>     dVCS/+EUe/wkHrpRVNhMwP8XfG+8gv9upKg6H/u39XmpL2H2G4cKeot5xRiWRNqY
>     oJclAeIhDTL1bx/9e/VqvM91ESWpBLs+O8Mh9OzgfbN3gKR6BuoWHNwM9jSMDAT1
>     YzwdneSvAEFzgELMlae2QIzAUHno9qkHMkDVbdY3bBtSM9Xz4ditGgnq1D40ZZ+J
>     zx5WVY7HCebgbk7T35xgKzSKQSEG9zFNW5Dvq66Se3Zpc5vCPw7Q2xwjjPz3zdXQ
>     Lub0ohVWTzKr05tN1e/nu6keiY5cXRZ0w2MtHb19jtdWyoHEWWHanfOZjgbVSsuA
>     saFCydA7O4E4BFxgtNze
>     =JthX
>     -----END PGP SIGNATURE-----
>     _______________________________________________
>     bitcoin-dev mailing list
>     bitcoin-dev@lists•linuxfoundation.org
<mailto:bitcoin-dev@lists•linuxfoundation.org>
>     https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>

- -- 
Thanks!

- -----
Justin M. Wray
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJV4fkUAAoJENo/Q5Xwcn834OIP/3A/tZGM0csz5QkJKW9jyyPN
yaewQ4CpP6N/y1g7YOXm4kwvCqofzbM++yeiBVN6pW+q7EyZr7vf6V8MYvRbhjAN
GxYxNWFAkSIcOFa3E92O4eGx7eG5Pn5bw0NWN2QHnmo8doPX/iwzOnv+l+yLQM5L
dcml0Bg2Gj2F5BLhS04XsgcqaZ+maUzmP27niVHYHF1qhSr2JmwWnHJ6u3Zp6Mb1
J7/tkm10p0PMNhnukMqrm9merC77mhBPQ40GXJSlIwXUNjZh6/7fbIP9hSUv4+HJ
K5IX+0gVAUlt2A6bTmswDDJLQGp/hnjKNMNsGIXy2/IZLRgmo3h83q+xZSAaDl9P
21QArg3Js5LIMwDZdOvhqcmfm5mShEa08UUo0rceGvg6YVQjPpHdPO9LjcUzoFoq
sD5UgCUuHCLwfk6AKS4L+NJU+Z9LyuQiLR5Of59Wn8Ri4viE2HecKWkZk8W9T1Ko
a1Juyg+7njFePrpQN7ck2twyrkhZo6vcRlo+VGaliCzMatl0aifEm1hrOlP/uEFj
B8vJP+kscbHagmUBDEZFcnlEKt46xEW6TxxXYkfGyyDJ7SyOzmKbtYJGkqAfWZLQ
93W6nHmnhjpVSrA1yWjka0gllt56izzMrG/5i7PlAQnocQhQGh0u/X7qdkrYezZH
5Fp416atfYdigXclXT00
=z9Sx
-----END PGP SIGNATURE-----


[-- Attachment #2: Type: text/html, Size: 11982 bytes --]

 permalink raw reply	[|nested]
2015-08-29 14:22 ` Jameson Lopp
  2015-08-29 18:25   ` Justin M. Wray

  
From: Jorge Timón @ 2015-08-29 20:59 UTC ( / )
  To: Jameson Lopp;  Bitcoin Dev

On Sat, Aug 29, 2015 at 4:22 PM, Jameson Lopp via bitcoin-dev
<bitcoin-dev@lists•linuxfoundation.org> wrote:
> I don't think you'll find much support for introducing a mandatory minimum
> block size. It's quite wasteful to "pad" blocks with transactions that the
> miner is just sending back to themself. If you want to solve the block
> propagation issue, I'd recommend instead working on O(1) block propagation.

O(1) propagation can never be achieved without a centralized topology.
No matter how efficient of an IBLT (or similar) we implement, O(1) can
only be achieved for transmitting a block between 2 nodes. The
propagation time of a block across the whole network (or even to the
miner's sub-network) will always depend on the concrete network
topology.

That's not to say that transmitting a block between to peers in
constant time wouldn't greatly help with mining centralization
concerns related the maximum block size, but I'm concerned about this
incorrect "O(1) block propagation" meme keeps spreading.
Even with ansibles [1] and safe zk-SNARKS [2] for constant time block
validation (somehow removing the trusted setup), both of which are
science fiction right now you need to verify the snark proof for every
node receiving and relaying the block.
At that point block propagation would be meaningless as a
miner-centralization concern for not raising the maximum block size
though: the minimum CPU costs for being able to mine profitably would
be the next concern or "bottleneck".

I completely agree with the minimum block size being inappropriate
though. I don't even believe that the stated goals of the size minimum
can be accomplished with it.

[1] https://en.wikipedia.org/wiki/Ansible
[2] https://eprint.iacr.org/2013/879.pdf