3 ms·
> Programmable blockchains allow generalized applications requiring decentralized trust. Yeah, they don't really though. They allow a few extremely specific ap
by vec 8y ago
> Programmable blockchains allow generalized applications requiring decentralized trust.
Yeah, they don't really though. They allow a few extremely specific applications requiring decentralized trust. The trust guarantees only hold if no single party can, even momentarily, control more hashing power than was collectively used to generate the last X blocks, where X is number of updates made since the data you want to tamper with was inserted.
To put it in concrete terms, pretend we have a blockchain for publishing PGP keys, and that your public key is 10 blocks down in the chain. If I want to maliciously replace your key with one of my own then all I need to do is rent a few dozen servers off of AWS for a day or two and use them to generate a modified chain that has my key instead of yours in the 11th block down and then rehash all ten blocks spending slightly more compute power each time than the original committers did. The network will recognize my fork as the authoritative one because it's got more proof of work. That's expensive, but it's certainly not infeasible.
This trust mechanism works out for cryptocurrencies because their only value is monetary. That means that people are incentivized to set up mining rigs to spend a lot of real resources on mining because they automatically get compensated. It also means that there's a bounded maximum amount of effort that a rational actor will spend to tamper with the chain, because there's a finite limit on the available profit to be gained.
Neither of these are true for PGP keys. Publishing a secure update to a PGP key database is not, in and of itself, a profit generating enterprise, meaning fewer miners and far less resources spent per mining rig. And the potential upside of successfully tampering with the right key is enormous.
The actual mechanism which produces the security guarantees in blockchains isn't cryptographic, it's economic. Tampering with a cryptocurrency's blockchain isn't actually impossible, or even difficult, it's just by definition more expensive than it's worth. When you try and move to an application other than financial assets the economics break down, the security guarantees go out the window, and all you're left with is an extremely inefficient git clone.
- neospice 8y agoPlease forgive my ignorance if I’m missing something obvious but in your PGP public key tampering example, wouldn’t this attack be ineffective against a blockchain that is stored in multiple peers. I.E your hashes wouldn’t match those of the peer copies of the blockchain?
- vec 8y agoNope. The whole point of proof of work is that it informs clients which version to consider authoritative in the case of a conflict. If my tampered copy has higher proof of work than the peer with the correct version then, by definition, mine is correct and the other peer's is outdated. Correctly implemented peers will recognize this and overwrite their local cache with mine, and even if they don't other peers will always prefer my version to theirs when deciding which update to sync.
- neospice 8y agoHow is "higher proof of work" defined in this context? Also, doesn't consensus of the majority of peers have any bearing on which is more authoritative? I.e. if all nodes except for your malicious node report a single chain, why would yours not be rejected?
- vec 8y ago"Proof of work" means the total number of hashing functions, from the point of divergence forward, used in signing the blocks. Consensus doesn't work like you're implying. If it did, I could spin up a peer on N+1 AWS servers, where N is the current number of peers on the network, and now my version has the majority of peers supporting it. The whole idea behind proof of work is that it's impossible to fake. The version that took the most net computing power to generate is by definition authoritative. This means that the only way to make a malicious version of a chain is to actually, genuinely do more total work than the legitimate actors collectively did. The other side of this coin, though, is that it explicitly allows me to generate a malicious version of the chain by actually, genuinely doing more total work than the legitimate actors collectively did.