4 ms·

If you don't mind, how is Bitcoin not secure under the security notions used by cryptographers? This is interesting because if it wasn't secure I wonder why hu

If you don't mind, how is Bitcoin not secure under the security notions used by cryptographers? This is interesting because if it wasn't secure I wonder why hundreds of millions of dollars have not been stolen yet? You could probably steal 100 million from some top addresses, move to MtGox and sell for a very decent rate before what you did became apparent (of course once what did became apparent Bitcoin would collapse forever) Or if the addresses are secure and its something else that is not secure what is it? I am on the bitcointalk forum a lot and I have not read anything about the crypto being not secure. Maybe I misunderstand what you mean by security?

DanBC 14y ago
Cryptographers have a high standard for 'not broken'. A cryptographic algorithm could have no real world attack, but be declared broken because there's a mathematical flaw. In the case of Bitcoin there's the 51% attack, which is pretty serious flaw even if to carry it out is unfeasable. We don't know if NSA or GCHQ have broken bitcoin (although they've certainly investigated it); and we haven't seen much crypt-analysis on it; but we have seen very many people trying (sometimes successfully) to attack Bitcoin and the wallets and the exchanges.
- arpp 14y ago
  Democracy is also vulnerable to 51% attacks ;P
- nullc 14y ago
  > the 51% attack, which is pretty serious flaw even if to carry it out is unfeasable There isn't anything magical about the number 51, the original Bitcoin paper gives a program that can be used to compute the success probability for an attacker with a given share of the computing power to reverse transactions to a given depth... At >=50% the probability becomes one but at that point only if the attack is of infinite duration. But, for example an attacker with 40% hashpower can reverse six blocks with a 50% success rate. Any kind of consensus system is going to be vulnerable to a majority attack of some kind— otherwise you'd have "minority imposes a wrong outcome" attacks. At least in Bitcoin the "consensus" only controls transaction ordering: a majority attacker can't inflate the supply or spend other people's coins... they can only DOS and remove transactions from the fixed consensus (and thus replace their own). Which is powerful but still limited.
deepblueocean 14y ago
I look at it this way: there are two kinds of rules in the Bitcoin system: crypto rules and social rules. Some are self-executing, by which I mean that they can be enforced "by construction" - if you create an object that doesn't follow the rule, other people will know. Said another way, breaking the rule would also require breaking some crypto. Some rules, though, are social. For example, why does everyone try to extend the longest branch in the block chain? Sure, the protocol says it's the rule, but why should that mean anything? People don't follow rules because they want to. They follow rules because it's in their enlightened self interest to do so. If you could make money by choosing a different rule, somebody would do that instead. So it must be that these rules get followed because it's in the interest of Bitcoin players to follow them. The natural follow-up question is whether these social/economic rules are stable. That is, why not some other solution? Why not only extend blocks whose (nonce % 0x0d) == 0? Cryptographers use a very particular notion of security in which they like the security of their schemes to "reduce" to a well-understood assumption. That is, we prefer it you can prove something like "if you can break my system, then you can also solve problem X" where problem X is well-known and widely thought to be very hard. Then either I am forced to believe that your system is secure or that you have found an efficient way to solve problem X. And since solving problem X is unlikely, I should consider your system secure. As I said, some parts of Bitcoin do reduce in this way to known cryptographic primitives (which in turn reduce to problems we believe are hard). But not all the parts.
- josephagoss 14y ago
  Thanks, this is exactly what I wanted to know. You make a good point about the social rules. The biggest hole in the entire system is the network is still dictated entirely by these rules and the main client is the vessel in which all these rules are set. But its not set in stone and the lead developers do have a huge amount of control. Also many disagreements in the forum about the max block size and blocking Satoshi Dice do worry me.
  - Frozenlock 14y ago
    The max block size, and consequently the transaction fees, are the most urgent problems to solve IMO. There's still time, but it really is something you don't want to mess up. https://bitcointalk.org/index.php?topic=157141.0 https://bitcointalk.org/index.php?topic=157141.0
eru 14y ago
Cryptograhpers are a strange and paranoid bunch. They have a few notions of security, including https://en.wikipedia.org/wiki/Information_theoretic_security https://en.wikipedia.org/wiki/Information_theoretic_security or https://en.wikipedia.org/wiki/Semantic_security https://en.wikipedia.org/wiki/Semantic_security and a few others. You can follow the links from those two pages to find the other concepts.

DanBC 14y ago

Cryptographers have a high standard for 'not broken'. A cryptographic algorithm could have no real world attack, but be declared broken because there's a mathematical flaw. In the case of Bitcoin there's the 51% attack, which is pretty serious flaw even if to carry it out is unfeasable. We don't know if NSA or GCHQ have broken bitcoin (although they've certainly investigated it); and we haven't seen much crypt-analysis on it; but we have seen very many people trying (sometimes successfully) to attack Bitcoin and the wallets and the exchanges.

arpp 14y ago
Democracy is also vulnerable to 51% attacks ;P
nullc 14y ago
> the 51% attack, which is pretty serious flaw even if to carry it out is unfeasable There isn't anything magical about the number 51, the original Bitcoin paper gives a program that can be used to compute the success probability for an attacker with a given share of the computing power to reverse transactions to a given depth... At >=50% the probability becomes one but at that point only if the attack is of infinite duration. But, for example an attacker with 40% hashpower can reverse six blocks with a 50% success rate. Any kind of consensus system is going to be vulnerable to a majority attack of some kind— otherwise you'd have "minority imposes a wrong outcome" attacks. At least in Bitcoin the "consensus" only controls transaction ordering: a majority attacker can't inflate the supply or spend other people's coins... they can only DOS and remove transactions from the fixed consensus (and thus replace their own). Which is powerful but still limited.

deepblueocean 14y ago

I look at it this way: there are two kinds of rules in the Bitcoin system: crypto rules and social rules. Some are self-executing, by which I mean that they can be enforced "by construction" - if you create an object that doesn't follow the rule, other people will know. Said another way, breaking the rule would also require breaking some crypto. Some rules, though, are social. For example, why does everyone try to extend the longest branch in the block chain? Sure, the protocol says it's the rule, but why should that mean anything? People don't follow rules because they want to. They follow rules because it's in their enlightened self interest to do so. If you could make money by choosing a different rule, somebody would do that instead. So it must be that these rules get followed because it's in the interest of Bitcoin players to follow them. The natural follow-up question is whether these social/economic rules are stable. That is, why not some other solution? Why not only extend blocks whose (nonce % 0x0d) == 0? Cryptographers use a very particular notion of security in which they like the security of their schemes to "reduce" to a well-understood assumption. That is, we prefer it you can prove something like "if you can break my system, then you can also solve problem X" where problem X is well-known and widely thought to be very hard. Then either I am forced to believe that your system is secure or that you have found an efficient way to solve problem X. And since solving problem X is unlikely, I should consider your system secure. As I said, some parts of Bitcoin do reduce in this way to known cryptographic primitives (which in turn reduce to problems we believe are hard). But not all the parts.

josephagoss 14y ago
Thanks, this is exactly what I wanted to know. You make a good point about the social rules. The biggest hole in the entire system is the network is still dictated entirely by these rules and the main client is the vessel in which all these rules are set. But its not set in stone and the lead developers do have a huge amount of control. Also many disagreements in the forum about the max block size and blocking Satoshi Dice do worry me.
- Frozenlock 14y ago
  The max block size, and consequently the transaction fees, are the most urgent problems to solve IMO. There's still time, but it really is something you don't want to mess up. https://bitcointalk.org/index.php?topic=157141.0 https://bitcointalk.org/index.php?topic=157141.0

eru 14y ago

Cryptograhpers are a strange and paranoid bunch. They have a few notions of security, including https://en.wikipedia.org/wiki/Information_theoretic_security https://en.wikipedia.org/wiki/Information_theoretic_security or https://en.wikipedia.org/wiki/Semantic_security https://en.wikipedia.org/wiki/Semantic_security and a few others. You can follow the links from those two pages to find the other concepts.