This 51% numbers kills everything!

[DeathAndTaxes]

The attacker can then "slow down" allow difficulty to fall and mine again but even that won't be necessary.  Remember what makes the chain the "longest" the total combined difficulty.  So a very far miner will build a longer chain eventually.  It might have a lower block height but it will be "longer".

I don't know if there is a stat for the total combined blockchain difficulty (sum of all difficulties of all blocks in the blockchain) but I would guestimate it at ~250 billion combined difficulty (roughly 100,000 blocks in last 2 years @ avg difficult of 2 million and a much smaller amount prior to that).

Still it will require a lot of hashpower, far more than 51%.  Also as time goes on the blockchain contains more and more "stored difficulty" especially years and years of high difficulty (ASIC generated) blocks the amount of hashpower required to rewrite a significant portion of the blockchain becomes prohibitive.

Also I would point out the reference client (and many others) use checkpointing which means that one can't rewrite the blockchain prior to the last checkpoint even with infinite amount of hashpower.

51% attack is a credible threat but much like the attack on napster spawned better protected p2p networks and eventually bittorrent a 51% attack would simply pawn new cryptocurrencies hardened against brute force attacks.  

[1713555225]

1713555225

[1713555225]

1713555225

[DannyHamilton]

In practice it's impossible to rewrite 1 year of blockchain faster than the honest network in hope that will become the longest chain and replace the legit one. Even if you're hashing your blockchain offline you must obey the rules of the protocol which means that the difficulty will update each 2016 blocks (up to a maximum of 4 times the previous difficulty if i'm not mistaken). Even if you're using processing power orders of magnitude higher than the honest network the difficulty will catch up with your hashrate leaving you producing blocks at the same average (around 10 min each) and your blockchain will never ever catch up.

Except that there is no need for your blockcahin to become "the longest chain".  It is only necessary to have the chain with the highest total difficulty.  If your blocks are created at 10 minutes per block, but the difficulty of your blocks are four times higher than the difficulty of the blocks in "honest network", then your blockchain can/will replace the network blocks when you've created one-fourth as many blocks as the "honest network"

[rizzla]

In practice it's impossible to rewrite 1 year of blockchain faster than the honest network in hope that will become the longest chain and replace the legit one. Even if you're hashing your blockchain offline you must obey the rules of the protocol which means that the difficulty will update each 2016 blocks (up to a maximum of 4 times the previous difficulty if i'm not mistaken). Even if you're using processing power orders of magnitude higher than the honest network the difficulty will catch up with your hashrate leaving you producing blocks at the same average (around 10 min each) and your blockchain will never ever catch up.

Except that there is no need for your blockcahin to become "the longest chain".  It is only necessary to have the chain with the highest total difficulty.  If your blocks are created at 10 minutes per block, but the difficulty of your blocks are four times higher than the difficulty of the blocks in "honest network", then your blockchain can/will replace the network blocks when you've created one-fourth as many blocks as the "honest network"

Oh didn't know that. I thought that only the block height was relevant.

[Gabi]

In practice it's impossible to rewrite 1 year of blockchain faster than the honest network in hope that will become the longest chain and replace the legit one. Even if you're hashing your blockchain offline you must obey the rules of the protocol which means that the difficulty will update each 2016 blocks (up to a maximum of 4 times the previous difficulty if i'm not mistaken). Even if you're using processing power orders of magnitude higher than the honest network the difficulty will catch up with your hashrate leaving you producing blocks at the same average (around 10 min each) and your blockchain will never ever catch up.

As other said, the "longest" blockchain is the one with the highest difficulty, not the one with more blocks. 1 difficulty 100 block is worth 5 difficulty 20 blocks

[Gabi]

Why does people keep comparing mining with supercomputers? Supercomputers have petabytes of hard disks and terabytes of ram memory, totally useless for mining. Supercomputers are a network of thousands of cores, totally useless for mining. And so on.

The today fastest supercomputer (top500.org) has approximately 300 000 opteron cores and 19 000 tesla cards.

CPU and nvidia mining so. No wonder they would epic fail at such attack!

It becomes instantly useful again the moment the attack ceases.

If it ceases.

The attack will stop if legitimate miners can upgrade their equipment faster than the government does (which the government has to constantly pay for). Also, I didn't know the government got free electricity.

Government can print money at will, hundreds of billions of dollars printed at will. They "pay"? Electricity is not "free"? Lol. They spend so many billions every year for war and now they can't even spare 20-30 millions for a 51% attack?

Double spends can't be fixed by reverting to a back-up blockchain

Every block created during the 51% attack obviously can't be trusted. So you must revert to a backup blockchain. And yes, they can be reverted

[wtfvanity]

Isn't the chance of some super group of ASIC's coming from behind and eating up the entire block chain non-existent because with each new release we lock in the block chain? They might be able to go back x number of blocks but not swallow the whole thing up.

[TangibleCryptography]

Isn't the chance of some super group of ASIC's coming from behind and eating up the entire block chain non-existent because with each new release we lock in the block chain? They might be able to go back x number of blocks but not swallow the whole thing up.

Yes.  More complex methods of checkpointing could also be done if necessary.  If a 51% attack materializes and sufficiently disrupts the Bitcoin network I imagine lots of work being put into a cryptocurrency which combines POW & POS.  There is no requirement that a new coin start from scratch (although all to date have).  The Bitcoin blockchain up to a certain point could form the genesis block for a new more secure cryptocurrency.

Cryptocurrency is a concept.  It can't be killed.