3 ms·

Modern cryptography is about a lot more than sending private messages over public channels. The entire field of secure multiparty computation is about mutually

Modern cryptography is about a lot more than sending private messages over public channels. The entire field of secure multiparty computation is about mutually distrustful parties participating in a distributed computation of some kind. Bootstrapping trust from "nothing" is part of that, and the theoretical work in that field establishes the limits and feasibility of accomplishing that goal. There are settings where "trust from nothing" (more precisely, when only one party is honest) is possible to achieve with cryptographic security -- for example, if aborting the protocol (stopping the computation) is an acceptable outcome (this is unavoidable if there are only two parties). "Honest parties have the advantage that it's easier for them to agree (and they are rewarded for agreeing)." I should clarify that when I used the term "advantage" I was referring to something analogous to mechanical advantage. A basic tenet of cryptographic security definitions is that the honest parties should have an advantage over the attackers in the sense that a small increase the work done by the honest parties results in a large increase in the work that must be done to attack the system. Note also that cryptographic security definitions assume the opposite of what you said: that the honest parties are not coordinated and are operated independently, but that the attackers do coordinate with each other (in fact we just refer to "the adversary" which has full control over all the attacking parties, with full access to their internal state, inputs, outputs, randomness, and whatever else). You mention incentive structures, but incentive structures are not very reliable. You need to make a lot of assumptions about motivation before an incentive structure makes sense, and those assumptions can easily fail because of something external to the system. What if a group of miners who collectively control 51% of the mining capacity of Bitcoin realized that they could open short positions in Bitcoin futures and make a fortune if they triggered a panic by e.g. executing very obvious double-spending attacks? Historically incentive structures have failed to prevent wars, crime, and other unwanted behaviors. "Bitcoin might become more popular and therefore might have bigger security demands" One does not follow from the other. Security requirements have nothing to do with popularity and everything to do with the ability of some attacker to succeed in attacking a system. Even if nothing about Bitcoin changes, a change elsewhere in the world may create an opportunity to profit from attacking Bitcoin (and there is no reason to think anyone other than the attacker would be aware of that opportunity). The attacker may not be rational at all; maybe the attacker just wants to create chaos, even at great expense. Like I said, incentive structures are unreliable and make for a poor approach to security on the Internet.

shawnz 5y ago
> A basic tenet of cryptographic security definitions is that the honest parties should have an advantage over the attackers in the sense that a small increase the work done by the honest parties results in a large increase in the work that must be done to attack the system. I think a more accurate claim would be that cryptography aims to achieve the best security guarantees that can be assured mathematically. In the case of establishing consensus the best guarantees you can achieve are just different from what you can achieve in those other situations. That doesn't mean that Bitcoin is somehow going against some kind of cryptographic standard like you are implying here. It is using cryptographic technologies to achieve the most secure possible solution (as far as we have discovered) to the problem which it aims to solve. It just happens to be a different problem than those other problems and therefore the nature of the solution is different. > Note also that cryptographic security definitions assume ... that the attackers do coordinate with each other That's just one possible scenario which you might consider. Again I think it is misleading to imply this is some kind of "cryptographic litmus test" or something. > You mention incentive structures, but incentive structures are not very reliable. Right, but there's just no stronger guarantees which you can make when it comes to this problem. > One does not follow from the other. Security requirements have nothing to do with popularity and everything to do with the ability of some attacker to succeed in attacking a system. I think you are interpreting what I said backwards. Popularity defines what level of security is required. The level of security defines what attacks can be resisted. The more popular the coin, the bigger need it will have to resist attacks. And this is accommodated in the design: the higher the market price of the coin, the bigger the reward will be for miners (thus funding more mining, increasing the cost of an attack).

shawnz 5y ago

> A basic tenet of cryptographic security definitions is that the honest parties should have an advantage over the attackers in the sense that a small increase the work done by the honest parties results in a large increase in the work that must be done to attack the system. I think a more accurate claim would be that cryptography aims to achieve the best security guarantees that can be assured mathematically. In the case of establishing consensus the best guarantees you can achieve are just different from what you can achieve in those other situations. That doesn't mean that Bitcoin is somehow going against some kind of cryptographic standard like you are implying here. It is using cryptographic technologies to achieve the most secure possible solution (as far as we have discovered) to the problem which it aims to solve. It just happens to be a different problem than those other problems and therefore the nature of the solution is different. > Note also that cryptographic security definitions assume ... that the attackers do coordinate with each other That's just one possible scenario which you might consider. Again I think it is misleading to imply this is some kind of "cryptographic litmus test" or something. > You mention incentive structures, but incentive structures are not very reliable. Right, but there's just no stronger guarantees which you can make when it comes to this problem. > One does not follow from the other. Security requirements have nothing to do with popularity and everything to do with the ability of some attacker to succeed in attacking a system. I think you are interpreting what I said backwards. Popularity defines what level of security is required. The level of security defines what attacks can be resisted. The more popular the coin, the bigger need it will have to resist attacks. And this is accommodated in the design: the higher the market price of the coin, the bigger the reward will be for miners (thus funding more mining, increasing the cost of an attack).