<p>They really don't have any similarities, so I'm not sure that there's much point in comparing them or talking about their differences. If you understand what PoW is and what it does and you understand BFT algorithms and what they do, there's no much else to know.</p>

<p>Both algorithms are algorithms designed to get eventual agreement on how to make forward progress in systems that can make forward progress in more than one valid way where agreement on which way to go forward is needed for the system to be useful.</p>

<p>PoW algorithms are slow and expensive and don't provide any actual finality but eventually provide practical finality. They're vulnerable to majority attacks and require honest participants to actually spend, on a continuous basis, to protect the network more than any attacker is willing to spend to harm it.</p>

<p>PoW algorithms are dangerous on blockchains that have non-native tokens. For example, Ethereum's security comes from PoW and the value of its native token, Eth. But it also has an ERC-20 ecosystem of non-native tokens. Things get scary if the value of Eth doesn't remain high enough to keep this ecosystem secure. Ethereum is a secure platform to build DeFi on so long as all these DeFi projects together don't get too valuable for Eth to secure.</p>

<p>BFT algorithms are fast and cheap and can provide actual finality. You get to choose who you trust, rather than having to trust whoever has money and cheap power as you have to do with PoW algorithms.</p>

<p>One very important thing to understand about Libra is that it cannot possibly ever be decentralized. Whatever legal entities control the assets that back Libra are parties without which the Libra currency will lose its value. That means that for any proposed hard fork, those custodians get to decide which side of the fork keeps the economic value. Because any rules change can be imposed by a hard fork, that means that the custodians get to choose the rules, period. That means no real decentralization ever, period.</p>

<p>Suppose, for example, that someone proposes adding respect for a government-provided censorship list to Libra. If the custodians say that they will issue and redeem on the censorship side of the hard fork, then that's it. The censorship wins, and it doesn't matter what anyone else wants or says. The censorship side of the fork will have the backing which is what gives Libra its value. By design, Libra cannot ever possibly be decentralized so long as it is backed.</p>

CC BY-SA 4.0
2019-07-08T21:56:32.857Z
I very much like this answer, but perhaps one additional important distinction: in BFT solutions the participants need to have identities that are known to other participants. PoW is designed to work without prior knowledge of who may be participating (implying you can participate anonymously).
Pieter Wuille
CC BY-SA 4.0
2019-07-08T22:16:29.437Z
@PieterWuille They don't. Since they can't double spend, it's perfectly fine to just choose anyone anonymous (by public key) that appears to be operating properly. If you choose people who don't let the network make censorship-free forward progress, you can just change who you chose. It is true, though, that PoW can be used to do the initial distribution of a cryptocurrency while BFT algorithms really can't. If the network makes censorship-free forward progress, and the "participants" can't double spend or censor, then it doesn't matter who "participates". (You often can't even tell!)
David Schwartz
CC BY-SA 4.0
2019-07-08T22:24:09.097Z
Well that still requires some pseudonymous identity at least, with public keys as identifiers, and participants need to choose to accept these keys. In PoW, you cannot distinguish whether two attempted updates were created by the same party or not.
Pieter Wuille
CC BY-SA 4.0
2019-07-08T22:25:15.133Z
If you're talking about BFT where everyone is assumed to just accept any key that shows up until they show signs of misbehaviour, I expect you'll end up with trivial DoS attacks - something PoW doesn't suffer from.
Pieter Wuille
CC BY-SA 4.0
2019-07-08T22:30:35.080Z
@PieterWuille No. I'm talking about BFT where you and the people you want to do business with agree on a set of keys that appear to be behaving reliably. It's like letting three companies in China choose which transactions go in which blocks except you pick those three companies, don't pay them millions of dollars a day, and can easily change them if they censor. And you don't have to wait an hour. ;)
David Schwartz
CC BY-SA 4.0
2019-07-08T22:31:02.640Z
@DavidSchwartz That's a perfectly reasonable choice, but it involves identity!
Pieter Wuille
CC BY-SA 4.0
2019-07-08T22:31:43.457Z
@PieterWuille If you consider an arbitrary public key an identity even if you can't map it to any real world person or entity. No identities are needed for that process other than public keys.
David Schwartz
CC BY-SA 4.0
2019-07-08T22:32:02.607Z
If you're going to use it to associate a reputation with, yes.
Pieter Wuille
CC BY-SA 4.0
2019-07-08T22:32:52.067Z
@PieterWuille Then I would argue that using demonstration of SHA256 hashing power as a way to get trust is identity as well. You are associating a reputation with the majority holder of the hashing power. I think it's a vacuous use of the concept of identity.
David Schwartz
CC BY-SA 4.0
2019-07-08T22:34:19.807Z
@PieterWuille For example, say at some defined day we chose the public keys with the lowest SHA256 hashes, rejecting any that misbehave and keeping any that behave properly. It's PoW for setup, but then BFT from then on. Is that identity because we use a public key? I don't think you can make this meaningful.
David Schwartz
CC BY-SA 4.0
2019-07-08T22:36:18.117Z
Perhaps identity is a confusing term then. Howabout permissionlessness vs DoS protection? A system where operators need to make a choice what keys to accept is clearly not permissionless. One where this choice is made automatically based on apparent-good behavior is trivially vulnerable to DoS. PoW allows combining DoS resistance with permissionlessness. I don't see a way in which BFT can do that.
Pieter Wuille
CC BY-SA 4.0
2019-07-08T22:37:23.100Z
Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/95887/discussion-between-david-schwartz-and-pieter-wuille).
David Schwartz
CC BY-SA 4.0
2019-07-08T21:24:30.977Z
2019-07-08T21:28:37.683Z
2019-07-08T21:28:37.683Z
David Schwartz
<p>What is the difference PoW algorithms (as used in Bitcoind) and BFT (used for instance in Libra) ?</p>

<proof-of-work><consensus><byzantine-fault-tolerance>
Difference between PoW and BFT
vincenzopalazzo
# Difference between PoW and BFT

(Asked by: username_0 on 2019-07-07)

What is the difference PoW algorithms (as used in Bitcoind) and BFT (used for instance in Libra) ?

**Tags:** proof-of-work, consensus, byzantine-fault-tolerance


---

## 1 answers

### Answer by username_1 on 2019-07-08. Score: 4 | Accepted answer

They really don't have any similarities, so I'm not sure that there's much point in comparing them or talking about their differences. If you understand what PoW is and what it does and you understand BFT algorithms and what they do, there's no much else to know.

Both algorithms are algorithms designed to get eventual agreement on how to make forward progress in systems that can make forward progress in more than one valid way where agreement on which way to go forward is needed for the system to be useful.

PoW algorithms are slow and expensive and don't provide any actual finality but eventually provide practical finality. They're vulnerable to majority attacks and require honest participants to actually spend, on a continuous basis, to protect the network more than any attacker is willing to spend to harm it.

PoW algorithms are dangerous on blockchains that have non-native tokens. For example, Ethereum's security comes from PoW and the value of its native token, Eth. But it also has an ERC-20 ecosystem of non-native tokens. Things get scary if the value of Eth doesn't remain high enough to keep this ecosystem secure. Ethereum is a secure platform to build DeFi on so long as all these DeFi projects together don't get too valuable for Eth to secure.

BFT algorithms are fast and cheap and can provide actual finality. You get to choose who you trust, rather than having to trust whoever has money and cheap power as you have to do with PoW algorithms.

One very important thing to understand about Libra is that it cannot possibly ever be decentralized. Whatever legal entities control the assets that back Libra are parties without which the Libra currency will lose its value. That means that for any proposed hard fork, those custodians get to decide which side of the fork keeps the economic value. Because any rules change can be imposed by a hard fork, that means that the custodians get to choose the rules, period. That means no real decentralization ever, period.

Suppose, for example, that someone proposes adding respect for a government-provided censorship list to Libra. If the custodians say that they will issue and redeem on the censorship side of the hard fork, then that's it. The censorship wins, and it doesn't matter what anyone else wants or says. The censorship side of the fork will have the backing which is what gives Libra its value. By design, Libra cannot ever possibly be decentralized so long as it is backed.

> **Comments:**
> **username_2**: I very much like this answer, but perhaps one additional important distinction: in BFT solutions the participants need to have identities that are known to other participants. PoW is designed to work without prior knowledge of who may be participating (implying you can participate anonymously).  
> **username_1**: @username_2 They don't. Since they can't double spend, it's perfectly fine to just choose anyone anonymous (by public key) that appears to be operating properly. If you choose people who don't let the network make censorship-free forward progress, you can just change who you chose. It is true, though, that PoW can be used to do the initial distribution of a cryptocurrency while BFT algorithms really can't. If the network makes censorship-free forward progress, and the "participants" can't double spend or censor, then it doesn't matter who "participates". (You often can't even tell!)  
> **username_2**: Well that still requires some pseudonymous identity at least, with public keys as identifiers, and participants need to choose to accept these keys. In PoW, you cannot distinguish whether two attempted updates were created by the same party or not.  
> **username_2**: If you're talking about BFT where everyone is assumed to just accept any key that shows up until they show signs of misbehaviour, I expect you'll end up with trivial DoS attacks - something PoW doesn't suffer from.  
> **username_1**: @username_2 No. I'm talking about BFT where you and the people you want to do business with agree on a set of keys that appear to be behaving reliably. It's like letting three companies in China choose which transactions go in which blocks except you pick those three companies, don't pay them millions of dollars a day, and can easily change them if they censor. And you don't have to wait an hour. ;)  
> **username_2**: @username_1 That's a perfectly reasonable choice, but it involves identity!  
> **username_1**: @username_2 If you consider an arbitrary public key an identity even if you can't map it to any real world person or entity. No identities are needed for that process other than public keys.  
> **username_2**: If you're going to use it to associate a reputation with, yes.  
> **username_1**: @username_2 Then I would argue that using demonstration of SHA256 hashing power as a way to get trust is identity as well. You are associating a reputation with the majority holder of the hashing power. I think it's a vacuous use of the concept of identity.  
> **username_1**: @username_2 For example, say at some defined day we chose the public keys with the lowest SHA256 hashes, rejecting any that misbehave and keeping any that behave properly. It's PoW for setup, but then BFT from then on. Is that identity because we use a public key? I don't think you can make this meaningful.  
> **username_2**: Perhaps identity is a confusing term then. Howabout permissionlessness vs DoS protection? A system where operators need to make a choice what keys to accept is clearly not permissionless. One where this choice is made automatically based on apparent-good behavior is trivially vulnerable to DoS. PoW allows combining DoS resistance with permissionlessness. I don't see a way in which BFT can do that.  
> **username_1**: Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/95887/discussion-between-username_1-username_1-and-username_2-username_2).  

---

