3 ms·

> That is still not precise enough to be used in a rigorous analysis. I think that is a precise definition of "double spend" in bitcoin. Do you agree with that

by javert 14y ago

> That is still not precise enough to be used in a rigorous analysis. I think that is a precise definition of "double spend" in bitcoin. Do you agree with that definition? As for all the other stuff you're talking about re: polynomial algorithms, collusion, etc.... I am just puzzled that you are bringing all that stuff up. It is widely known that bitcoin is resilient to any attempt to double-spend unless there is a coordinated attack by greater than 50% of the total hashing power. And double-spend is the _only_ attack at the distributed algorithm level. Can you comment on the above paragraph? I mean, were you not aware of the 50% issue, or were you aware of it but have a problem with it? And do you agree that double-spend is the only kind of attack at the algorithmic level? Of course, there is always DDoSing the peers at the protocol layer, and stuff like that, but I think we can agree that that is not what we are interested in discussing. And then there is the crypto level, which you bring up by mentioning ElGamal. Bitcoin uses ECDSA, but only for signing; nothing is encrypted. So one can talk about whether ECDSA is breakable, but I'm not losing any sleep over it, personally.

betterunix 14y ago
"It is widely known that bitcoin is resilient to any attempt to double-spend unless there is a coordinated attack by greater than 50% of the total hashing power" First of all, it is hard to even analyze "total hashing power." There are far too many slippery details for any formal analysis -- you need to know how the hash function is actually implemented, what sort of hardware, etc. That being said, how do you know there are no other double spending attacks? Where is the proof of that? "double-spend is the _only_ attack at the distributed algorithm level." Prove it. "then there is the crypto level" There is no such separation. Bitcoin is not a signature system, nor is it a hash function. The fact that ECDSA and SHA256 are used in Bitcoin does not imply that Bitcoin is secure. All that you can really say is that Bitcoin does not meet its security goals (whatever those are) if ECDSA or SHA256 are not secure.
- javert 14y ago
  > First of all, it is hard to even analyze "total hashing power." There are far too many slippery details for any formal analysis -- you need to know how the hash function is actually implemented, what sort of hardware, etc. I don't understand why you're bringing that up. You don't need any of that. Anyway, the total hashing power is currently 79,854.53 gigahashes per second (where one "hash" is actually a double SHA-256). > That being said, how do you know there are no other double spending attacks? Where is the proof of that? Any double spend in a block will be immediately rejected by all nodes. So the only question is, "Which blocks are actually valid blocks, and which blocks are orphans?" Blocks that form part of the longest extant blockchain are considered valid; all others are orphans. So the only question at that point is, "Which is actually the longest extant blockchain?" If you have massive hashing power, you can create an alternate blockchain and release it, allowing double-spends of transactions in all the blocks back to the point that your alternate blockchain forks from what was previously considered to be the longest blockchain. Mathematically, you need > 50% of the total hashing power to do this. The proof of that is in the paper. (Though it's worth acknowledging that there are a lot of details that are _not_ in the paper, and you have to talk to bitcoin devs or read the wiki or the source or the forums to figure them out.) > Prove it. Preventing double spends (and spending of money that doesn't exist - semantically also a double spend) is the sole purpose of bitcoin's distributed algorithm. All the rest is just verifying that transactions are signed properly. > The fact that ECDSA and SHA256 are used in Bitcoin does not imply that Bitcoin is secure. True, but there are other things that imply that Bitcoin is secure, and my only point here is that the use of ECDSA and SHA256 are nothing to worry about. There certainly can be and have been security flaws in the code, but they're not related to the actual fundamentals. That's why they've always been easy to fix and why Bitcoin has never been "hacked."

by javert 14y ago

betterunix 14y ago

"It is widely known that bitcoin is resilient to any attempt to double-spend unless there is a coordinated attack by greater than 50% of the total hashing power" First of all, it is hard to even analyze "total hashing power." There are far too many slippery details for any formal analysis -- you need to know how the hash function is actually implemented, what sort of hardware, etc. That being said, how do you know there are no other double spending attacks? Where is the proof of that? "double-spend is the _only_ attack at the distributed algorithm level." Prove it. "then there is the crypto level" There is no such separation. Bitcoin is not a signature system, nor is it a hash function. The fact that ECDSA and SHA256 are used in Bitcoin does not imply that Bitcoin is secure. All that you can really say is that Bitcoin does not meet its security goals (whatever those are) if ECDSA or SHA256 are not secure.

javert 14y ago
> First of all, it is hard to even analyze "total hashing power." There are far too many slippery details for any formal analysis -- you need to know how the hash function is actually implemented, what sort of hardware, etc. I don't understand why you're bringing that up. You don't need any of that. Anyway, the total hashing power is currently 79,854.53 gigahashes per second (where one "hash" is actually a double SHA-256). > That being said, how do you know there are no other double spending attacks? Where is the proof of that? Any double spend in a block will be immediately rejected by all nodes. So the only question is, "Which blocks are actually valid blocks, and which blocks are orphans?" Blocks that form part of the longest extant blockchain are considered valid; all others are orphans. So the only question at that point is, "Which is actually the longest extant blockchain?" If you have massive hashing power, you can create an alternate blockchain and release it, allowing double-spends of transactions in all the blocks back to the point that your alternate blockchain forks from what was previously considered to be the longest blockchain. Mathematically, you need > 50% of the total hashing power to do this. The proof of that is in the paper. (Though it's worth acknowledging that there are a lot of details that are _not_ in the paper, and you have to talk to bitcoin devs or read the wiki or the source or the forums to figure them out.) > Prove it. Preventing double spends (and spending of money that doesn't exist - semantically also a double spend) is the sole purpose of bitcoin's distributed algorithm. All the rest is just verifying that transactions are signed properly. > The fact that ECDSA and SHA256 are used in Bitcoin does not imply that Bitcoin is secure. True, but there are other things that imply that Bitcoin is secure, and my only point here is that the use of ECDSA and SHA256 are nothing to worry about. There certainly can be and have been security flaws in the code, but they're not related to the actual fundamentals. That's why they've always been easy to fix and why Bitcoin has never been "hacked."