Bitcoin Forum
November 22, 2017, 01:26:46 PM *
News: Latest stable version of Bitcoin Core: 0.15.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: « 1 [2] 3 4 5 6 7 8 9 10 11 »  All
  Print  
Author Topic: Majority is not Enough: Bitcoin Mining is Vulnerable  (Read 50398 times)
RodeoX
Legendary
*
Offline Offline

Activity: 2464


The revolution will be monetized!


View Profile
November 04, 2013, 06:19:31 PM
 #21

If I'm reading this correctly, an attacker is more likely to loose value performing this attack than to profit from it. Is that right?

The gospel according to Satoshi - https://bitcoin.org/bitcoin.pdf

Free bitcoin in ICELAND - https://bitcointalk.org/index.php?topic=1610684
1511357206
Hero Member
*
Offline Offline

Posts: 1511357206

View Profile Personal Message (Offline)

Ignore
1511357206
Reply with quote  #2

1511357206
Report to moderator
Join ICO Now Coinlancer is Disrupting the Freelance marketplace!
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1511357206
Hero Member
*
Offline Offline

Posts: 1511357206

View Profile Personal Message (Offline)

Ignore
1511357206
Reply with quote  #2

1511357206
Report to moderator
1511357206
Hero Member
*
Offline Offline

Posts: 1511357206

View Profile Personal Message (Offline)

Ignore
1511357206
Reply with quote  #2

1511357206
Report to moderator
1511357206
Hero Member
*
Offline Offline

Posts: 1511357206

View Profile Personal Message (Offline)

Ignore
1511357206
Reply with quote  #2

1511357206
Report to moderator
Peter Todd
Legendary
*
expert
Offline Offline

Activity: 1106


View Profile
November 04, 2013, 06:26:50 PM
 #22

I believe I have a simple and effective solution: http://www.mail-archive.com/bitcoin-development@lists.sourceforge.net/msg03137.html

Nope, that idea doesn't work: http://www.mail-archive.com/bitcoin-development@lists.sourceforge.net/msg03155.html

zvs
Legendary
*
Offline Offline

Activity: 1484


I have some bitcoins. Somewhere.


View Profile WWW
November 04, 2013, 06:50:16 PM
 #23

Makes it even easier when you have all these non-relaying nodes in the network and ppl falling behind several blocks.  Just add 70  more of those swiss nodes, gtg

Dacentec, best deals for US dedicated servers. They regularly restock $20-$25 Opterons with 8-16GB RAM & 2x1-2TB HDD's (ofc, usually lots of other good stuff to choose from).  I did a Serverbear benchmark of one of my $20/mo Opteron (June last year), it's here.  Have had about a half dozen different servers with Dacentec, & none have failed to sustain at least 40MB/s (burst higher). My favorite is a 12-month rent-to-own ZT Systems 2XL5520 16GB 2x2TB SATA for $40/month (got lucky with the 'off-brand', haven't seen a RTO 2xL5520 for under $50/mo since -- at least for monthly contracts).  wholesaleinternet.com has some ancient 2-core intel CPUs @ $10/mo sometimes (I got an Intel Core 2 6300 @ 1.86GHz, with a 250GB HDD with 46000 hours on it, LOL. $20 @ Dacentec is much better, if you can grab one). joesdatacenter.com (same location as Wholesale Internet) also occasionally has specials (or if you don't want to wait, it has an AMD Opteron 170 @ $16/mo).
lenny_
Legendary
*
Offline Offline

Activity: 1050


DARKNETMARKETS.COM


View Profile WWW
November 04, 2013, 09:09:32 PM
 #24

@OP:

That's why p2pool should be a solution. To prevent such things from happening in the future.

DARKNET MARKETS >> https://DARKNETMARKETS.COM
Enochian
Full Member
***
Offline Offline

Activity: 126


View Profile
November 05, 2013, 01:28:19 AM
 #25

I just printed out the paper and read it.

Since the algorithm for "Selfish Mining" is now public, all miners have an opportunity to employ it if they feel it gives them an advantage.  So the notion that there is only a single pool of colluding miners growing as other miners join it to reap its advantages is moot.

Initially the colluding pool is a small fraction of total hashrate, and therefore has a vanishingly small probability of being able to mine consecutive blocks on its private chain.  So the only thing it can do is force other people to waste time by delaying publication when it mines a block, and some fraction of the time, its block wins over the public block, and people who have attempted to append to that block lose their work.

This seems to me to be such a small epsilon in the hashing activity that no one is really going to care, and no one is going to bother to do Selfish Mining.  The work to reward ratio here is pretty large.

So basically, "Nothing to See Here," and no modification to the Bitcoin protocol is needed.





Peter Todd
Legendary
*
expert
Offline Offline

Activity: 1106


View Profile
November 05, 2013, 01:57:26 AM
 #26

Since the algorithm for "Selfish Mining" is now public, all miners have an opportunity to employ it if they feel it gives them an advantage.  So the notion that there is only a single pool of colluding miners growing as other miners join it to reap its advantages is moot.

With multiple competing selfish miners the one with the lowest latency network wins. Or to be exact, some function of lowest latency per dollar spent. Not unlike the race in high-frequency trading to get ever lower latency network connections.

Sticking our collective heads in the sand and singing la-la-la doesn't lead to solutions, something we may need some time in the future as the profit margins in mining become lower. There's a lot of people who should know better who keep on saying that miners have proven to be altruistic and interested in the long-term success of Bitcoin, but Bitcoin is much stronger if we don't need that tenuous assumption.

justusranvier
Legendary
*
Offline Offline

Activity: 1400



View Profile WWW
November 05, 2013, 02:01:07 AM
 #27

something we may need some time in the future as the profit margins in mining become lower.
Profit margins will go up when the transaction rate gets high enough to generate significant transaction fees compared to the block subsidy.
Peter Todd
Legendary
*
expert
Offline Offline

Activity: 1106


View Profile
November 05, 2013, 02:06:45 AM
 #28

something we may need some time in the future as the profit margins in mining become lower.
Profit margins will go up when the transaction rate gets high enough to generate significant transaction fees compared to the block subsidy.

a) mining is a zero-sum game

b) increased transaction rates mean more money spent on overhead, rather than the hashing power that keeps bitcoin secure

justusranvier
Legendary
*
Offline Offline

Activity: 1400



View Profile WWW
November 05, 2013, 02:09:39 AM
 #29

b) increased transaction rates mean more money spent on overhead, rather than the hashing power that keeps bitcoin secure
Yeah, well there's a huge amount of room for optimization there that currently isn't being done.

Either the transaction rate goes up high enough to pay for all this mining infrastructure or else Bitcoin dies.
revans
Sr. Member
****
Offline Offline

Activity: 336


View Profile
November 05, 2013, 02:42:41 AM
 #30

b) increased transaction rates mean more money spent on overhead, rather than the hashing power that keeps bitcoin secure
Yeah, well there's a huge amount of room for optimization there that currently isn't being done.

Either the transaction rate goes up high enough to pay for all this mining infrastructure or else Bitcoin dies.


And if you'd read and understood the paper you would know it is the latter; maths and human nature= bye bye Bitcoin. But fear not cryptocurrency cultists there are already a few hundred alternative ponzi scheme for you to get involved in.
revans
Sr. Member
****
Offline Offline

Activity: 336


View Profile
November 05, 2013, 02:46:13 AM
 #31

I just printed out the paper and read it.

Since the algorithm for "Selfish Mining" is now public, all miners have an opportunity to employ it if they feel it gives them an advantage.  So the notion that there is only a single pool of colluding miners growing as other miners join it to reap its advantages is moot.

Initially the colluding pool is a small fraction of total hashrate, and therefore has a vanishingly small probability of being able to mine consecutive blocks on its private chain.  So the only thing it can do is force other people to waste time by delaying publication when it mines a block, and some fraction of the time, its block wins over the public block, and people who have attempted to append to that block lose their work.

This seems to me to be such a small epsilon in the hashing activity that no one is really going to care, and no one is going to bother to do Selfish Mining.  The work to reward ratio here is pretty large.

So basically, "Nothing to See Here," and no modification to the Bitcoin protocol is needed.








Umm WTF are you talking about? Try reading it again, only this time whilst not high on Bitcrack. Maths + human nature= a selfish mining future and the end of Cultcoin. In a sense the popularity you so longed Bitcoin to have has destroyed it as peer review is demonstrating just how architecturally boken Bitcoin is.
Peter Todd
Legendary
*
expert
Offline Offline

Activity: 1106


View Profile
November 05, 2013, 03:03:45 AM
 #32

My ELI5 explanation that I posed to bitcoin-development might help people understand the attack:

Alice is a miner with some amount of hashing power. She has the ability to detect new blocks on the network extremely effectively because she has controls a lot of nodes with low-latency, high-bandwidth connections; in short she has unusually good knowledge of the state of the network. She is also very good at publishing her blocks and getting them to the majority of hashing power in very little time; she has unusually good connectivity to all miners. (again low-latency and high bandwidth)

She's so good at this that when she finds a new block, she keeps it a secret! She can get away with this because she knows that the moment any other miner, like Bob, finds a block, she can immediately broadcast it to the rest of the network before the other block propagates. Instead of building on Bob's blocks, almost everyone builds on Alice's block, having seen it first, depriving Bob of the revenue. Gradually Alice gets more and more miners because all the other pools don't pay out as much as Alice's pool does. This eventually leads to Alice having a majority of hashing power, or if not that due to social pressure, a majority of the mining revenue.

eldentyrell
Donator
Legendary
*
Offline Offline

Activity: 980


felonious vagrancy, personified


View Profile WWW
November 05, 2013, 03:10:35 AM
 #33

your blocks ends up increasing the risk that you get orphaned since nodes prefer the first block they heard.

I think this assumption of theirs is the flaw.

Successful pools do not build on the first block they hear; they build on the most difficult block they hear.

If you rerun their calculations under that assumption, the cost of losing the work done on their second block in the private two-block chain swamps out any possible benefit.

If the end-user bitcoin-qt client is using the "first block heard" rather than "most difficult block heard", then it's a bug, and one that is already fixed on the network nodes that matter most for security (the mining pools and large solo miners).

Here is where they acknowledge introducing this bug in their simulation:

Quote
In the case of two branches of the same length, we artificially divide the non-pool miners such that a ratio of γ of them mine on the pool’s branch and the rest mine on the other branch.

The printing press heralded the end of the Dark Ages and made the Enlightenment possible, but it took another three centuries before any country managed to put freedom of the press beyond the reach of legislators.  So it may take a while before cryptocurrencies are free of the AML-NSA-KYC surveillance plague.
dree12
Legendary
*
Offline Offline

Activity: 1246



View Profile
November 05, 2013, 03:11:58 AM
 #34

your blocks ends up increasing the risk that you get orphaned since nodes prefer the first block they heard.

I think this assumption of theirs is the flaw.

Successful pools do not build on the first block they hear; they build on the most difficult block they hear.

If you rerun their calculations under that assumption, the cost of losing the work done on their second block in the private two-block chain swamps out any possible benefit.

If the end-user bitcoin-qt client is using the "first block heard" rather than "most difficult block heard", then it's a bug, and one that is already fixed on the network nodes that matter most for security (the mining pools and large solo miners).


Blocks that are not near a difficulty change will always have the same difficulty.
eldentyrell
Donator
Legendary
*
Offline Offline

Activity: 980


felonious vagrancy, personified


View Profile WWW
November 05, 2013, 03:15:03 AM
 #35

Blocks that are not near a difficulty change will always have the same difficulty.

No, the difficulty of a block is binomially distributed.

The minimum difficulty required for a block to be valid is the thing that stays the same.  Within that 2016-block window the actual difficulty of various blocks varies above that threshold.

The printing press heralded the end of the Dark Ages and made the Enlightenment possible, but it took another three centuries before any country managed to put freedom of the press beyond the reach of legislators.  So it may take a while before cryptocurrencies are free of the AML-NSA-KYC surveillance plague.
justusranvier
Legendary
*
Offline Offline

Activity: 1400



View Profile WWW
November 05, 2013, 03:16:22 AM
 #36

Blocks that are not near a difficulty change will always have the same difficulty.

No, the difficulty of a block is binomially distributed.

The minimum difficulty required for a block to be valid is the thing that stays the same.  Within that 2016-block window the actual difficulty of various blocks varies above that threshold.
It would be less ambiguous if you said, "Successful pools do not build on the first block they hear; they build on the block with the highest work they hear."
eldentyrell
Donator
Legendary
*
Offline Offline

Activity: 980


felonious vagrancy, personified


View Profile WWW
November 05, 2013, 03:20:56 AM
 #37

The minimum difficulty required for a block to be valid is the thing that stays the same.  Within that 2016-block window the actual difficulty of various blocks varies above that threshold.

It would be less ambiguous if you said, "Successful pools do not build on the first block they hear; they build on the block with the highest work they hear."

Well, we're splitting hairs here, but technically I might have gotten lucky and not worked very hard to find a block whose hash, in binary, ends with 250 zeroes in a row (outrageously high difficulty).  "Difficulty" and "target" are actual technical terms with precise definitions in the block protocol.

But yeah we're talking about the same thing.

The printing press heralded the end of the Dark Ages and made the Enlightenment possible, but it took another three centuries before any country managed to put freedom of the press beyond the reach of legislators.  So it may take a while before cryptocurrencies are free of the AML-NSA-KYC surveillance plague.
Enochian
Full Member
***
Offline Offline

Activity: 126


View Profile
November 05, 2013, 03:21:08 AM
 #38

Umm WTF are you talking about? Try reading it again, only this time whilst not high on Bitcrack. Maths + human nature= a selfish mining future and the end of Cultcoin. In a sense the popularity you so longed Bitcoin to have has destroyed it as peer review is demonstrating just how architecturally boken Bitcoin is.

Do you have a specific criticism?

You are welcome to set up a selfish mining rig and prove me wrong.  Unless you have sufficient hash power to be mining blocks very frequently, no one is even going to notice you exist.

This is an academic exercise with very tiny practical implications, and in any case, a very small threat on the long list of threats.

eldentyrell
Donator
Legendary
*
Offline Offline

Activity: 980


felonious vagrancy, personified


View Profile WWW
November 05, 2013, 03:22:52 AM
 #39

This is an academic exercise

It isn't even that; arxiv is not peer reviewed.

The printing press heralded the end of the Dark Ages and made the Enlightenment possible, but it took another three centuries before any country managed to put freedom of the press beyond the reach of legislators.  So it may take a while before cryptocurrencies are free of the AML-NSA-KYC surveillance plague.
dree12
Legendary
*
Offline Offline

Activity: 1246



View Profile
November 05, 2013, 03:23:32 AM
 #40

The minimum difficulty required for a block to be valid is the thing that stays the same.  Within that 2016-block window the actual difficulty of various blocks varies above that threshold.

It would be less ambiguous if you said, "Successful pools do not build on the first block they hear; they build on the block with the highest work they hear."

Well, we're splitting hairs here, but technically I might have gotten lucky and not worked very hard to find a block whose hash, in binary, ends with 250 zeroes in a row (outrageously high difficulty).

But yeah we're talking about the same thing.

This is a statistical fallacy. Two blocks will always be equally difficult when they were mined with the same target.

What you mean to say is that clients prefer to choose the block with the least block hash. This is effectively a deterministic pseudo-random algorithm for choosing which block to build on. I do not remember this being the case, but it is possible this has changed recently.
Pages: « 1 [2] 3 4 5 6 7 8 9 10 11 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!