7 ms·

...and to achieve that, Bitcoin has a backwards approach to security where the honest parties must work harder than the attackers, which ultimately means that n

...and to achieve that, Bitcoin has a backwards approach to security where the honest parties must work harder than the attackers, which ultimately means that nobody can confidently say that the system is secure unless a majority of energy produced on Earth is being devoted to honest parties mining Bitcoin. It is also wrong to suggest that the bank in Chaum's system is a "trusted third party," as if the bank can unilaterally break any security property of the system. In fact the bank in an ecash system is very much constrained. The bank cannot violate a user's privacy (in the sense of linking a user's transactions) unless the user attempts to spend the same coin twice. The bank's ability to claim that a user was trying to conduct some kind of double-spending attack is also constrained (the no-frame-ups property) so that a user must actually attempt to double spend a coin for the bank to produce evidence of such a crime. It is also possible to create a distributed trust model where several parties must jointly issue the coins (threshold blind signatures). Unlike Bitcoin, the security model of ecash is well-defined and follows the basic philosophy of cryptographic security: the computational difficult of attacking the system grows exponentially with the computational work performed by honest parties. Put another way, the energy expended in an ecash system will grow linearly with the number of transactions being performed in the system, and the incentive is to reduce the energy consumption by finding more efficient ways to process transactions. If the cost of a well-defined, rigorous security model, a system that incentivizes minimizing energy consumption, and features that Bitcoin can never actually support (e.g. direct peer-to-peer payments that do not require an Internet connection or any communication with any third parties), is to have a central bank or consortium of banks that issues the coins, you can count me in.

billytetrud 5y ago
> unless a majority of energy produced on Earth is being devoted to honest parties mining Bitcoin. Nope, try again
- betterunix2 5y ago
  How do you know when enough computational effort / energy has been devoted to mining i.e. how do you know that there is no attacker out there who is working harder than all the honest users combined?
  - billytetrud 5y ago
    You can calculate how much capital an attacker would need to purchase the necessary mining equipment. When that amount of capital is more than large nations would be willing to commit, then you know it's pretty safe. Currently, the amount of capital is in the tens of billions, which is already rather out of reach for most governments to allocate for this kind of thing. Yes a government like the US could theoretically do it, but it would be incredibly difficult to make that fly politically.
    - betterunix2 5y ago
      That is a lot of assumptions about an attacker's means and willingness to invest in the attack. German cryptographers made that same mistake during World War II: they knew how to attack the Enigma cipher in principle, but assumed, incorrectly, that none of the allied powers would be willing to make the necessary investment. Tens of billions dollars is within reach for many governments, corporations, and even some individual people. It is not hard to imagine what might motivate an attack, whether politically (perhaps to disrupt the Western financial system once more institutional investors have take on large Bitcoin positions) or financially (imagine building a large short position in Bitcoin futures, then executing a 51% attack). Moreover, why assume that the attacker will necessarily have to work as hard as the total work being done by honest miners, when the attacker might first try to take down the largest miners as a first step to reduce the capital investment? Blackouts in China significantly reduced the hashrate of several large mining pools recently. An attacker willing to invest tens of billions of dollars in an attack would have little difficulty sabotaging mining operations, especially given how concentrated and centralized those operations have become. Really though, in what other context would we accept an argument that comes down to assumptions about what an attacker is willing to do? Cryptographic security demands that the attack effort grows exponentially (or super-polynomial in the case of public key cryptography) so that we can make the attack effort larger than the number of atoms on our planet (or galaxy or universe), which renders all speculation on the attacker's motives or willingness to invest an attack moot. With Bitcoin you can never make such a claim until most of the world's available energy is consumed by honest miners (the only point at which the attack is actually impossible, at least if we assume that the honest parties cannot be corrupted).

billytetrud 5y ago

> unless a majority of energy produced on Earth is being devoted to honest parties mining Bitcoin. Nope, try again

betterunix2 5y ago
How do you know when enough computational effort / energy has been devoted to mining i.e. how do you know that there is no attacker out there who is working harder than all the honest users combined?
- billytetrud 5y ago
  You can calculate how much capital an attacker would need to purchase the necessary mining equipment. When that amount of capital is more than large nations would be willing to commit, then you know it's pretty safe. Currently, the amount of capital is in the tens of billions, which is already rather out of reach for most governments to allocate for this kind of thing. Yes a government like the US could theoretically do it, but it would be incredibly difficult to make that fly politically.
  - betterunix2 5y ago
    That is a lot of assumptions about an attacker's means and willingness to invest in the attack. German cryptographers made that same mistake during World War II: they knew how to attack the Enigma cipher in principle, but assumed, incorrectly, that none of the allied powers would be willing to make the necessary investment. Tens of billions dollars is within reach for many governments, corporations, and even some individual people. It is not hard to imagine what might motivate an attack, whether politically (perhaps to disrupt the Western financial system once more institutional investors have take on large Bitcoin positions) or financially (imagine building a large short position in Bitcoin futures, then executing a 51% attack). Moreover, why assume that the attacker will necessarily have to work as hard as the total work being done by honest miners, when the attacker might first try to take down the largest miners as a first step to reduce the capital investment? Blackouts in China significantly reduced the hashrate of several large mining pools recently. An attacker willing to invest tens of billions of dollars in an attack would have little difficulty sabotaging mining operations, especially given how concentrated and centralized those operations have become. Really though, in what other context would we accept an argument that comes down to assumptions about what an attacker is willing to do? Cryptographic security demands that the attack effort grows exponentially (or super-polynomial in the case of public key cryptography) so that we can make the attack effort larger than the number of atoms on our planet (or galaxy or universe), which renders all speculation on the attacker's motives or willingness to invest an attack moot. With Bitcoin you can never make such a claim until most of the world's available energy is consumed by honest miners (the only point at which the attack is actually impossible, at least if we assume that the honest parties cannot be corrupted).