Skip to content
Blockchain LabTHE VENTURE STUDIO

LibraryConsensus2015Design paperCorpus record

Proofs of Space

Proofs of space. Stefan Dziembowski, Sebastian Faust, Vladimir Kolmogorov and Krzysztof Pietrzak.

A proof that a machine reserved storage, not that it burned energy on a puzzle. The verifier checks a small challenge. Chia is a later system that pairs this idea with a verifiable delay. The paper is not Chia.

A proof of space shows that a prover stored a large structure that cannot be recomputed quickly. The verifier checks a few random locations. Electricity is no longer the resource being measured. Computation that replaces storage defeats the proof.

The five-minute read

Initialisation is the expensive part

The prover fills disk with a table that has to be built, not with random bytes. If the table can be regenerated during the challenge faster than it can be read, the prover never needed the disk.

The challenge is a small read

The verifier asks for a handful of positions. A prover who stored the table answers quickly. A prover who did not has to recompute.

The bound is the paper

The theorem is a tradeoff between space and the time needed to answer. A loose bound means a clever encoding still wins with CPUs. The proof is only as good as that bound.

Chia added a clock

A later network pairs space proofs with a verifiable delay so farmers cannot grind many challenges. That delay is not in this paper. Do not import it backwards.

One action, walked through

  1. The prover runs an initialisation on a nonce and fills storage.
  2. A challenge is derived, in a full protocol from the chain, in the paper from the verifier.
  3. The prover returns the table entries the challenge names, plus whatever proof shows they sit in the initialised structure.
  4. The verifier checks the entries with little work.
  5. A quality function can rank proofs so a lottery can pick one winner among many provers.

The argument, unpacked

Space is not 'unused hard drives' by magic

The economic story people tell, that empty disks are greener than hash machines, is not the theorem. The theorem is a time-space tradeoff. If plotting is itself an energy-intensive industry, the deployment has left the slogan even when the proof still measures disk.

Grinding is the next problem

If a prover can try many challenges cheaply, they do not need more space. They need more attempts. Delay functions were added later because this paper's proof, alone, does not stop that.

What has to be true

  • Recomputing the table is slower than storing it, by the margin the proof claims.
  • The verifier's challenge is unpredictable before the table is fixed. Otherwise the prover stores only the answers.
  • Provers do not share a single table while pretending to be many. Sybil behaviour depends on the surrounding protocol.
  • The quality ranking, if used for a lottery, is the one the verifier recomputes.

What happened after the paper

Chia is the well-known deployment that combined proofs of space with proofs of time. Filecoin's proofs of replication are a different statement: that a specific file is stored, not that some structure of the right size exists. The 2015 paper is the space proof. It is not either network.

What to check before you use the idea

  • What is stored, and can it be recomputed during the challenge?
  • Is the challenge fixed before the prover can regenerate answers?
  • Is there a delay function, or can the prover grind?
  • Is the proof about reserved space or about a specific file?

Terms

Proof of space
A proof that the prover expended storage, checked by a small random read.
Time-space tradeoff
The claim that answering without the stored table costs more computation than the protocol allows.

The problem the paper names

Proof of work buys Sybil resistance with electricity. Proofs of space try to buy it with dedicated disk, so that the cost is a stock of storage rather than a continuous burn.

What the design proposes

  • An initialization that fills disk with a structure the prover cannot recompute quickly.
  • A challenge that asks for a few locations.
  • A bound on how much computation can replace storage. That bound is the whole game.

How the mechanism is specified

  • If the structure can be recomputed faster than reading the disk, the proof no longer measures space.
  • The quality of a proof can be graded, so a lottery can pick a winner among provers.
  • Nothing here orders transactions or pays a farmer. Those are protocol choices made later.

What this page does not treat as proven

  • A proof of space does not, by itself, stop a grinding attack on the challenge. Chia adds a delay function for that reason. This paper does not include that delay.
  • Storage that is not dedicated can be rented. The economic assumption is not in the theorem.
  • Plotting hardware and energy still exist in later systems. Do not repeat a claim that the paper does not make.

Why a venture studio still reads it

Ask what resource is actually scarce after a clever encoding. If the answer is still parallel computation, you do not have a proof of space.

This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.

Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.