Bitcoin Forum
May 08, 2024, 07:26:06 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: freshly created address argument (50% attack)  (Read 534 times)
adam3us (OP)
Sr. Member
****
expert
Offline Offline

Activity: 404
Merit: 360


in bitcoin we trust


View Profile WWW
April 27, 2013, 11:16:24 PM
Last edit: May 29, 2013, 08:23:42 AM by adam3us
Merited by ABCbits (1)
 #1

So reading the bitcoin paper it is claimed that the recipient generating his
address at the last minute before accepting the payment makes him less
vulnerable to a 50% double spend attack.  This argument doesnt seem correct
to me, though creating new addresses serves as secondary purpose a mild
privacy feature.

Lets consider two attack approaches, a) where all users generate fresh
addresses to receive each payment and b) using prior knowledge of victims
address,

a) is the attack described in the paper: attacker tries to create a block
chain fork of longer length than the rest of the network by working on a
chain that he does not publish yet, spending a coin to himself on this for
now private chain.  Now and then with probability determined by his ratio of
network power he gets ahead of the network by 2 chain links, so he starts
the double spend attempt, paying it to the fresh address of a victim.  Once
the rest of the miners publish a block containing the victims confirmation,
and once victim to sees the confirmation, the attacker publishes his up to
now private chain which contains a different spend.  Now there is a network
fork, and the network will believe the 2 chain links branch over the 1 link
branch, for any coins that are spent in both.  The network has no way to
distinguish which spend to reject other than the CPU voting, and that is
indicated by the chain length.  The network abandons the short fork of the
chain, and the victim's received payment is considered a double spend by all
nodes.  If the victim accepts with 0 or 1 confirmations, he loses; if the
would be victim waits for 2 confirmations the attack fails as he would not
yet consider it valid.  (Analogous for n confirmations with correspondingy
longer private chain).

b) the attacker tries to gain some additional advantage from prior knowledge
of the victims address.  If the attacker accelerates the confirmation by
also computing the confirmation rather than letting the network do it, he
does work the network would do for him reducing his power to amass a
sufficient length private block chain that he must do privately, and so
reduces his chance of success to construct a n confirmation defeating
private chain.  And yet he gains no success advantage.  What he does do is
avoid make speculative payments to the victim.  However there will exist
payments that result in resellable virtual goods.  Or online gambling that
is approximately zero sum so those payments do not have to be considered a
loss or penalty, only the transaction fee & resale (virtual goods) or house
cut (online gambling).  eg Satoshi dice apparently is popular.

Maybe I am misunderstanding what Nakamoto meant in the paper, but I
dont see any 50% attack extra defense coming from choosing address just
before receiving payment.

Adam

hashcash, committed transactions, homomorphic values, blind kdf; researching decentralization, scalability and fungibility/anonymity
1715196366
Hero Member
*
Offline Offline

Posts: 1715196366

View Profile Personal Message (Offline)

Ignore
1715196366
Reply with quote  #2

1715196366
Report to moderator
The network tries to produce one block per 10 minutes. It does this by automatically adjusting how difficult it is to produce blocks.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1715196366
Hero Member
*
Offline Offline

Posts: 1715196366

View Profile Personal Message (Offline)

Ignore
1715196366
Reply with quote  #2

1715196366
Report to moderator
1715196366
Hero Member
*
Offline Offline

Posts: 1715196366

View Profile Personal Message (Offline)

Ignore
1715196366
Reply with quote  #2

1715196366
Report to moderator
1715196366
Hero Member
*
Offline Offline

Posts: 1715196366

View Profile Personal Message (Offline)

Ignore
1715196366
Reply with quote  #2

1715196366
Report to moderator
gglon
Member
**
Offline Offline

Activity: 64
Merit: 10


View Profile
April 28, 2013, 12:15:20 AM
 #2

I think you're right. Here is the scenario if receiver waits for 1 conf:
a)
1. block #x mined by network
2. attacker starts mining  2 blocks with hostile tx2
2. publish tx1
3. block #x+1 with tx1 mined by network
4. attacker gets product
5. attacker publish 2 mined blocks#x+1 and #x+2 with tx2
6. block #x+3 with tx2 mined by the network

b)
1. block #x mined by network
2. attacker starts mining block with tx1 and block with tx2
3. attacker publish block #x+1 with tx1 only to the receiver node and block #x+1 with tx2 to others
4. attacker gets product
5. block #x+2 mined by network with tx2

 
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!