What it costs to kill Bitcoin: $20 million

[Gibybo]

The amount of money miners make from mining per year: avg transaction fee * transactions per block * blocks per year + bounties in BTC generation. Bounties will eventually go away, and the value of the currency depends on its ability to be secure even when there are no bounties, so I'm going to remove them from future calculations.

Two of those numbers are fixed, so we get a maximum of: avg transaction fee * 4000 * 50,000, or avg transaction fee * 200 million.

Assuming the amount of money miners spend on hardware is <= the amount they get paid, it follows that any individual or cooperative entity can own 50% of the network's computational power for a cost <= the amount the miners get paid.

So, the cost for any individual or cooperative entity to destroy the Bitcoin network is 200 million * the average transaction fee.

If transaction fees are the equivalent of 10 cents per transaction, PayPal can spend $20 million to destroy Bitcoin. If they are $1 per transaction, PayPal can spend $200 million to destroy Bitcoin.

Even if transactions were the equivalent of $100 per transaction, it would only cost a sufficiently motivated government $20 billion to destroy the network.

Please tell me I'm wrong, because that looks pretty weak.

[FreeMoney]

Why do you think the network is dead if someone has half of the network power? Have you researched this at all?

[Gibybo]

From https://en.bitcoin.it/wiki/Weaknesses

An attacker that controls more than 50% of the network's computing power can, for the time that he is in control, exclude and modify the ordering of transactions. This allows him to:
Reverse transactions that he sends while he's in control
Prevent some or all transactions from gaining any confirmations
Prevent some or all other generators from getting any generations

[Bit_Happy]

Part 1: Don't worry, Be Happy:
Markets are really smart* when so much info is public. These are known weaknesses, yet Bitcoin keeps setting record highs.
This means "the market" strongly believes solutions will be found whenever the need is urgent enough.

Part 2:
The need is urgent enough, what's the real answer?


*Edit: Of course really smart markets sometimes have excess speculation, but that is another subject.

[crema]

I don't understand that:
transactions per block = 4000
I can't find this information

[caveden]

This should be a FAQ question. It's not the first time I answer this.

A >50% overtake is bad, but not that bad.

It only allows the attacker to erase/rewrite recent transactions, from the point he started mining in secret on. Keep in mind that he cannot create invalid transactions, like, create more money than there could possibly be at a particular address. Nor he can spend money that he never owned. So, basically, he can erase valid transactions, that's all.

This attack can have two purposes:

• Double-spend, or "profit motivated attack". The attacker could erase transactions of his own, for which he already received the good/service he bought. That would be stealing from the vendor. Bad, yes, but how far can the attacker go with this? I hardly think he could steal more than 20 million dollars to make it worth the investment, without being caught.
• Just mess around, or "politically motivated attack". This could annoy bitcoin users, but valid honest transactions will be resent anyway, so this won't do much more than annoyance. Honestly, it's a silly kind of attack for a government to take, as it may end up getting some quite bad press for this.

An easy way to mitigate the risk: reject any "too long" block reorganization. The "too long" constant should be determined mathematically, in order to be sure that there is no reasonable chance that such block reorganization is an honest chain split.
I can't do the math on my own, but I really doubt that an honest split could last as long as a week for example.

[Gibybo]

If the attacker is PayPal or a government looking to shut down Bitcoin, isn't blocking transactions sufficient?

I don't understand how clients could detect the 'block reorganization'. Won't they always move to the longest block chain? If not, can't I create an attack without even needing 50%?

[ploum]

I don't want to discuss if this is right or not, I don't feel qualified, but I only want to point out that there's an obvious mix between bitcoins and dollars in the reasoning.

You don't have any unit in you text but, when you start, we can assume you speak in BTC (transaction fees are in BTC) then, at the end, you talk about dollars (a government spending 2 billions is in dollars, as there will never be 2 billions BTC).

Where happens the switch between btc and $? I don't know and, obviously, you don't too.

That's why, independently of its truth value, this first post is completely illogical. (and thus, we cannot make any conclusion from it).

(no, a simple translation from btc to dollars cannot be done as, if a government want to do that, they will start buying all bitcoins, raising the value of bitcoins in the process.)

[Gibybo]

I don't want to discuss if this is right or not, I don't feel qualified, but I only want to point out that there's an obvious mix between bitcoins and dollars in the reasoning.

You don't have any unit in you text but, when you start, we can assume you speak in BTC (transaction fees are in BTC) then, at the end, you talk about dollars (a government spending 2 billions is in dollars, as there will never be 2 billions BTC).

Where happens the switch between btc and $? I don't know and, obviously, you don't too.

That's why, independently of its truth value, this first post is completely illogical. (and thus, we cannot make any conclusion from it).

(no, a simple translation from btc to dollars cannot be done as, if a government want to do that, they will start buying all bitcoins, raising the value of bitcoins in the process.)

You are jumping to conclusions, I was very careful with my units. The transaction fees are in dollars because USD is more stable and it is fair to call them equivalent in low amounts. The large amounts ($2 billion, for example) refer to the cost of buying the hardware, which can easily be done in USD.

[FreeMoney]

From https://en.bitcoin.it/wiki/Weaknesses

An attacker that controls more than 50% of the network's computing power can, for the time that he is in control, exclude and modify the ordering of transactions. This allows him to:
Reverse transactions that he sends while he's in control
Prevent some or all transactions from gaining any confirmations
Prevent some or all other generators from getting any generations

Okay, so someone can spend $20M to pause the network. It isn't dead and can be awoken for $1.

[sherbetlemon]

I don't want to discuss if this is right or not, I don't feel qualified, but I only want to point out that there's an obvious mix between bitcoins and dollars in the reasoning.

You don't have any unit in you text but, when you start, we can assume you speak in BTC (transaction fees are in BTC) then, at the end, you talk about dollars (a government spending 2 billions is in dollars, as there will never be 2 billions BTC).

Where happens the switch between btc and $? I don't know and, obviously, you don't too.

That's why, independently of its truth value, this first post is completely illogical. (and thus, we cannot make any conclusion from it).

(no, a simple translation from btc to dollars cannot be done as, if a government want to do that, they will start buying all bitcoins, raising the value of bitcoins in the process.)

but could they get to a point where they control the market, if they bought up enough coins? sorry newbie trying to understand.

[Gibybo]

Okay, so someone can spend $20M to pause the network. It isn't dead and can be awoken for $1.

For $20M they can 'pause' it for a year. For $40 M they can pause it for two. How long will a currency last when it cannot be traded? How long will it last with even a vague threat that it can be paused?

[Raulo]

An easy way to mitigate the risk: reject any "too long" block reorganization. The "too long" constant should be determined mathematically, in order to be sure that there is no reasonable chance that such block reorganization is an honest chain split.
I can't do the math on my own, but I really doubt that an honest split could last as long as a week for example.

A how do you know which one is honest and which one is "evil"? An evil bit set?

There is no way to differentiate an honest and a bad one.

[caveden]

Okay, so someone can spend $20M to pause the network. It isn't dead and can be awoken for $1.

For $20M they can 'pause' it for a year. For $40 M they can pause it for two. How long will a currency last when it cannot be traded? How long will it last with even a vague threat that it can be paused?

They can pause it for as long as honest people figure out a way of identifying the attacker blocks. In the case of someone really trying to pause the network completely, it is easy. A block reorganization which sets a lot of empty blocks is clearly not honest, particularly if there are transactions with fees that were discarded.
If such attack really takes place one day, full clients could set a rule saying that, if there's available block space, transactions paying more than a certain threshold in fees cannot be excluded from a block, for example.

[caveden]

A how do you know which one is honest and which one is "evil"? An evil bit set?

There is no way to differentiate an honest and a bad one.

By the length. Honest block splits cannot, probabilistic speaking, last too long.

[Zibbo]

This should be a FAQ question. It's not the first time I answer this.

A >50% overtake is bad, but not that bad.

It only allows the attacker to erase/rewrite recent transactions, from the point he started mining in secret on. Keep in mind that he cannot create invalid transactions, like, create more money than there could possibly be at a particular address. Nor he can spend money that he never owned. So, basically, he can erase valid transactions, that's all.

This attack can have two purposes:

• Double-spend, or "profit motivated attack". The attacker could erase transactions of his own, for which he already received the good/service he bought. That would be stealing from the vendor. Bad, yes, but how far can the attacker go with this? I hardly think he could steal more than 20 million dollars to make it worth the investment, without being caught.
• Just mess around, or "politically motivated attack". This could annoy bitcoin users, but valid honest transactions will be resent anyway, so this won't do much more than annoyance. Honestly, it's a silly kind of attack for a government to take, as it may end up getting some quite bad press for this.

An easy way to mitigate the risk: reject any "too long" block reorganization. The "too long" constant should be determined mathematically, in order to be sure that there is no reasonable chance that such block reorganization is an honest chain split.
I can't do the math on my own, but I really doubt that an honest split could last as long as a week for example.

Trying to game the bitcoin network with >50% of hashing power is not that easy, but if your goal is shutting down the bitcoin, it's trivial. You can effectively deny any transactions taking place, or invalidate past transactions by hashing your own longer chain in the dark, and dumping it to the rest of the network whenever you feel like it would do the most damage, or any number of more or less detectable and destructive attacks. With that kind of activity, people would lose faith in bitcoin really fast, making it worthless.

The longest blockchain is THE central authority of bitcoin, and if you don't want to trust that authority 100%, you have to give some of that power (choosing the valid chain) to individuals, and we know how that works out. Take your pick.

[Zibbo]

Okay, so someone can spend $20M to pause the network. It isn't dead and can be awoken for $1.

For $20M they can 'pause' it for a year. For $40 M they can pause it for two. How long will a currency last when it cannot be traded? How long will it last with even a vague threat that it can be paused?

They can pause it for as long as honest people figure out a way of identifying the attacker blocks. In the case of someone really trying to pause the network completely, it is easy. A block reorganization which sets a lot of empty blocks is clearly not honest, particularly if there are transactions with fees that were discarded.

Attacker can fill the blocks with believable looking transaction by recycling their own wallets.

[Bit_Happy]

Take your pick:
Are you confident you know what you are talking about re: "hashing your own longer chain in the dark, and dumping it to the rest of the network?"
I'm pretty sure you will be proven wrong.   

[caveden]

Attacker can fill the blocks with believable looking transaction by recycling their own wallets.

True, but still that could be suspicious. Suddenly, the block chain changes to another one with lots of transactions which have never been seen by anyone? And then that happens again, and again, and again? People will quickly figure out somebody's messing around, particularly if the network is already rejecting "too long" block reorganizations. And once honest miners see the network is under this kind or political attack, they might figure out ways of blocking it.

[Raulo]

A how do you know which one is honest and which one is "evil"? An evil bit set?

There is no way to differentiate an honest and a bad one.

By the length. Honest block splits cannot, probabilistic speaking, last too long.

And how do you know which one is honest? Maybe the attacker "invited" you to his chain and you were being fed the evil one. And now you see another chain? How do you know which one is honest? Ask bitcoin developers? Look at blockexplorer?

As Zibbo wrote above, the longest chain is the authority. If you start to decide which chain is right based on some other criteria, you need to accept some external authority. And this is the end of Bitcoin as a decentralized system.