3 ms·

Here's one of Ethereum's lead researchers talking about the attacks in that paper. The fixes are simple and not expected to delay the merge. https://blog.ether

Here's one of Ethereum's lead researchers talking about the attacks in that paper. The fixes are simple and not expected to delay the merge. https://blog.ethereum.org/2021/11/02/finalized-no-31/ https://blog.ethereum.org/2021/11/02/finalized-no-31/

Gosper 5y ago
Written for public consumption that post conveys a great deal of certainty while eliding over doubts: "Change fork choice rule to mitigate balancing and reorging attacks" https://ethresear.ch/t/change-fork-choice-rule-to-mitigate-balancing-and-reorging-attacks/11127 https://ethresear.ch/t/change-fork-choice-rule-to-mitigate-b... And more fundamentally at the heart of the matter https://ethresear.ch/t/comment-on-three-attacks-on-proof-of-stake-ethereum/11216 https://ethresear.ch/t/comment-on-three-attacks-on-proof-of-... > Moreover, there is a general argument that the attacker will always be able to keep the consensus from finalizing nomatter what the fix is. > The argument simply comes from the fact, that mathematically provable binary consensus algorithms known in this universe have n2 behavior, and ETH2 is linear in n . > Therefore, the only way to really fix ETH2 is to make it n2 . Otherwise it is unfixable from the math point of view. There will always be another attack. > It may be that by continuing patching a fix after a fix after a fix one can end up with something that will work from an engineering point of view. > This will be security by obscurity. > But it will not be secure from the math point of view. So while bodging in patches might work one day, it's an immature approach and a scary place to try store value. The sheer number of moving parts create a scary amount of emergent complexity and complexity is the enemy of security. Disclosure: I'm an early but now uncomfortable ETH holder.
- DennisP 5y ago
  On the "fundamental" link, see this reply that appeared after you commented: "The reason that Ethereum’s consensus can run in n time rather than n^2 is BLS signature aggregation. The attacks in the paper however aren’t attacks on signature aggregation. So I don’t think your argument is valid."
- DennisP 5y ago
  > mathematically provable binary consensus algorithms known in this universe have n^2 behavior Is there a convenient way for an uneducated schmuck like me to read up on this? Just a comment without references isn't much to go on.

Gosper 5y ago

Written for public consumption that post conveys a great deal of certainty while eliding over doubts: "Change fork choice rule to mitigate balancing and reorging attacks" https://ethresear.ch/t/change-fork-choice-rule-to-mitigate-balancing-and-reorging-attacks/11127 https://ethresear.ch/t/change-fork-choice-rule-to-mitigate-b... And more fundamentally at the heart of the matter https://ethresear.ch/t/comment-on-three-attacks-on-proof-of-stake-ethereum/11216 https://ethresear.ch/t/comment-on-three-attacks-on-proof-of-... > Moreover, there is a general argument that the attacker will always be able to keep the consensus from finalizing nomatter what the fix is. > The argument simply comes from the fact, that mathematically provable binary consensus algorithms known in this universe have n2 behavior, and ETH2 is linear in n . > Therefore, the only way to really fix ETH2 is to make it n2 . Otherwise it is unfixable from the math point of view. There will always be another attack. > It may be that by continuing patching a fix after a fix after a fix one can end up with something that will work from an engineering point of view. > This will be security by obscurity. > But it will not be secure from the math point of view. So while bodging in patches might work one day, it's an immature approach and a scary place to try store value. The sheer number of moving parts create a scary amount of emergent complexity and complexity is the enemy of security. Disclosure: I'm an early but now uncomfortable ETH holder.

DennisP 5y ago
On the "fundamental" link, see this reply that appeared after you commented: "The reason that Ethereum’s consensus can run in n time rather than n^2 is BLS signature aggregation. The attacks in the paper however aren’t attacks on signature aggregation. So I don’t think your argument is valid."
DennisP 5y ago
> mathematically provable binary consensus algorithms known in this universe have n^2 behavior Is there a convenient way for an uneducated schmuck like me to read up on this? Just a comment without references isn't much to go on.