4 ms·

Bitcoin has much deeper issues as a cryptosystem than that. There is no actual security definition, just vague concepts about what should not be possible. Eve

Bitcoin has much deeper issues as a cryptosystem than that. There is no actual security definition, just vague concepts about what should not be possible. Even under the vague notion of Bitcoin's security, there is a known, efficient, and technically feasible attack -- at best all anyone can say is that it is an expensive attack, in the low billions of dollars to pull off. Preventing that attack would require half the computing resources in the world to be devoted to Bitcoin at all times.

VMG 13y ago
are you talking about a double-spend attack?
- jedunnigan 13y ago
  Sounds like a 51% attack. But to the subject of the thread: Baidu should be using a Hierarchical Deterministic pub/priv key tree. [1] Increases their financial privacy 10-fold. [1] https://en.bitcoin.it/wiki/BIP_0032 https://en.bitcoin.it/wiki/BIP_0032
  - VMG 13y ago
    Right, I also meant 51% attack. I'm not sure if he also meant it, because the attack described by betterunix isn't quite what a 51% attack is about.
    - jedunnigan 13y ago
      >that it is an expensive attack, in the low billions of dollars to pull off. Preventing that attack would require half the computing resources in the world to be devoted to Bitcoin at all times. That sounds like a 51% attack, although the 'half of all computing resources' is off the mark. The OP is right here, it is a very feasible attack at the moment, which is why some are concerned that SHA256 is too specializable (ASICs) which means that a dedicated adversary with access to chip manufacturing could print a few wafers and own the network at low cost. There aren't many attacks on the network that require that kind of computational power. I could see the NSA running a large portion of nodes to de-anonymize users, but beyond that I don't know what else it could be. A double spend attack wouldn't require much effort (right now at least, that will change) [1]. [1]http://www.tik.ee.ethz.ch/file/848064fa2e80f88a57aef43d7d5956c6/P2P2013_093.pdf http://www.tik.ee.ethz.ch/file/848064fa2e80f88a57aef43d7d595... [1a]http://www.tik.ee.ethz.ch/file/49318d3f56c1d525aabf7fda78b23fc0/P2P2013_041.pdf http://www.tik.ee.ethz.ch/file/49318d3f56c1d525aabf7fda78b23... [1b] We will see some of these changes in bitcoind .9 (so says Gavin)
      - betterunix 13y ago
        "'half of all computing resources' is off the mark." I suppose that I could have stated it somewhat better by saying this: half the energy output of the planet needs to be devoted to the most energy-efficient Bitcoin mining hardware possible to guarantee that no attack is occurring, and only if that hardware is being used by honest miners and not an attacker. Of course, in practice no attacker will amass anything close to that (it would leave no power left for anything other than Bitcoin), but in practice the world will never devote anything close to half its energy resources to Bitcoin. Even generous estimates of what the world's energy economy could devote to Bitcoin leave an awful lot of room for an attack, and while the attack might not make economic sense in terms of the market value of Bitcoin or the mining payoff, it might be part of some broader plot (perhaps a war against a country where Bitcoin is popular and widely relied on). "I could see the NSA running a large portion of nodes to de-anonymize users" Why would they bother? Bitcoin transactions are broadcast to the entire Bitcoin network anyway. All the NSA would need is a handful of desktops and some auxiliary information about which wallets belong to which users (perhaps gather by watching Bitcoin exchanges). Bitcoin makes no anonymity guarantees at all.
        jedunnigan 13y ago
        > Even generous estimates of what the world's energy economy could devote to Bitcoin leave an awful lot of room for an attack, and while the attack might not make economic sense in terms of the market value of Bitcoin or the mining payoff, it might be part of some broader plot... I won't refute this, because you are right. I was just speaking in more manageable/realistic terms. >Why would they bother? Bitcoin transactions are broadcast to the entire Bitcoin network anyway. All the NSA would need is a handful of desktops and some auxiliary information about which wallets belong to which users (perhaps gather by watching Bitcoin exchanges). Bitcoin makes no anonymity guarantees at all. Bitcoin is not anonymous, correct. That doesn't mean that it is easy to break the barrier from pseudonymous - > known identity. Let's say there is a clever participant in the network, Satoshi, who is under investigation by the NSA. The NSA knows they will be sending 10btc to their cohort at address xyz. Satoshi is smart, he is not going to use an exchange to get his coins. Maybe he mined them. Maybe he got them in a f2f transaction. This leaves few options to find out information about Satoshi. However, if the NSA ran a sufficient number of nodes, they could easily determine the first node to propagate a transaction. This would be Satoshi's IP address. That is why they would do this.
  - clarkm 13y ago
    Yep, everyone should be using HD Wallets. Not only are they essential for one's own privacy, but they are also good for preserving overall network privacy. Plus, they make accounting easier.
phaemon 13y ago
Yes, just like preventing invasion of your country would require half the military resources in the world to be devoted to your protection at all times.
- betterunix 13y ago
  The difference being that military resources have little use outside of military operations. The resources needed to secure Bitcoin have many uses beyond Bitcoin. All that energy, all the silicon, all the computer time, etc., etc., etc. could be used more productively. You are also forgetting that the invasion of one nation is not equivalent to the invasion of all nations, but that if one attacker controls Bitcoin's block chain, the security of all Bitcoin users is compromised. Meanwhile, in the world of cryptography research, we have known how to make secure digital cash, with rigorous security definitions, without the need for such vast energy or computing resources, with support for offline transactions, etc., for decades. The only real difference is that academic systems call for an authority or group of authorities that issue the currency, though that is not as bad as it might sound if you consider the problem of actually defining security without such an authority (Bitcoin's solution, as I mentioned, is to simply not bother with such a definition). It is hard to even say that Bitcoin has no central authority at this point; the developers of popular Bitcoin software have tremendous power over Bitcoin (e.g. they can trigger block chain forks).
  - jafaku 13y ago
    > The only real difference is that academic systems call for an authority or group of authorities that issue the currency. That's quite a difference, and one of the main features of Bitcoin. See the message in the genesis block. > It is hard to even say that Bitcoin has no central authority at this point; the developers of popular Bitcoin software have tremendous power over Bitcoin (e.g. they can trigger block chain forks). I agree with you on that.
    - betterunix 13y ago
      "That's quite a difference, and one of the main features of Bitcoin. See the message in the genesis block." That is a political statement not a technical statement, and this gets to the heart of the problem with Bitcoin and with its lack of a security definition. Bitcoin is popular, particularly among those who distrust the banking system, because there is no requirement for a central authority; that is certainly true but only in a pedantic sense. Without a security definition it is hard to even talk about what Bitcoin requires. What we have therefore is a situation where no amount of technical criticism can matter with Bitcoin. Polynomial time attacks are irrelevant, because there is no requirement that Bitcoin resist polynomial time attacks. There is similarly no particular scalability requirement, and so there can be no real criticism of Bitcoin's scalability. "True believers" in Bitcoin can easily shoot down criticism because critics cannot actually point to any requirement that Bitcoin fails to fulfill: there are no clear requirements to point to. To illustrate this point, consider this statement: There is a polynomial time attack on Bitcoin, and the whitepaper itself describes it. Now, is this a problem? Well, the answer I consistently get from Bitcoin devotees is no, that is not a problem because that is how Bitcoin works. With logic like that, who can argue? So while you call the lack of an authority a feature, I call it a logical gap until a rigorous security definition is presented. Otherwise you have a solution in search of a problem, coupled with a community of people who all have their own vague notions of what they want Bitcoin to do for them.

VMG 13y ago

are you talking about a double-spend attack?

jedunnigan 13y ago
Sounds like a 51% attack. But to the subject of the thread: Baidu should be using a Hierarchical Deterministic pub/priv key tree. [1] Increases their financial privacy 10-fold. [1] https://en.bitcoin.it/wiki/BIP_0032 https://en.bitcoin.it/wiki/BIP_0032
- VMG 13y ago
  Right, I also meant 51% attack. I'm not sure if he also meant it, because the attack described by betterunix isn't quite what a 51% attack is about.
  - jedunnigan 13y ago
    >that it is an expensive attack, in the low billions of dollars to pull off. Preventing that attack would require half the computing resources in the world to be devoted to Bitcoin at all times. That sounds like a 51% attack, although the 'half of all computing resources' is off the mark. The OP is right here, it is a very feasible attack at the moment, which is why some are concerned that SHA256 is too specializable (ASICs) which means that a dedicated adversary with access to chip manufacturing could print a few wafers and own the network at low cost. There aren't many attacks on the network that require that kind of computational power. I could see the NSA running a large portion of nodes to de-anonymize users, but beyond that I don't know what else it could be. A double spend attack wouldn't require much effort (right now at least, that will change) [1]. [1]http://www.tik.ee.ethz.ch/file/848064fa2e80f88a57aef43d7d5956c6/P2P2013_093.pdf http://www.tik.ee.ethz.ch/file/848064fa2e80f88a57aef43d7d595... [1a]http://www.tik.ee.ethz.ch/file/49318d3f56c1d525aabf7fda78b23fc0/P2P2013_041.pdf http://www.tik.ee.ethz.ch/file/49318d3f56c1d525aabf7fda78b23... [1b] We will see some of these changes in bitcoind .9 (so says Gavin)
    - betterunix 13y ago
      "'half of all computing resources' is off the mark." I suppose that I could have stated it somewhat better by saying this: half the energy output of the planet needs to be devoted to the most energy-efficient Bitcoin mining hardware possible to guarantee that no attack is occurring, and only if that hardware is being used by honest miners and not an attacker. Of course, in practice no attacker will amass anything close to that (it would leave no power left for anything other than Bitcoin), but in practice the world will never devote anything close to half its energy resources to Bitcoin. Even generous estimates of what the world's energy economy could devote to Bitcoin leave an awful lot of room for an attack, and while the attack might not make economic sense in terms of the market value of Bitcoin or the mining payoff, it might be part of some broader plot (perhaps a war against a country where Bitcoin is popular and widely relied on). "I could see the NSA running a large portion of nodes to de-anonymize users" Why would they bother? Bitcoin transactions are broadcast to the entire Bitcoin network anyway. All the NSA would need is a handful of desktops and some auxiliary information about which wallets belong to which users (perhaps gather by watching Bitcoin exchanges). Bitcoin makes no anonymity guarantees at all.
      - jedunnigan 13y ago
        > Even generous estimates of what the world's energy economy could devote to Bitcoin leave an awful lot of room for an attack, and while the attack might not make economic sense in terms of the market value of Bitcoin or the mining payoff, it might be part of some broader plot... I won't refute this, because you are right. I was just speaking in more manageable/realistic terms. >Why would they bother? Bitcoin transactions are broadcast to the entire Bitcoin network anyway. All the NSA would need is a handful of desktops and some auxiliary information about which wallets belong to which users (perhaps gather by watching Bitcoin exchanges). Bitcoin makes no anonymity guarantees at all. Bitcoin is not anonymous, correct. That doesn't mean that it is easy to break the barrier from pseudonymous - > known identity. Let's say there is a clever participant in the network, Satoshi, who is under investigation by the NSA. The NSA knows they will be sending 10btc to their cohort at address xyz. Satoshi is smart, he is not going to use an exchange to get his coins. Maybe he mined them. Maybe he got them in a f2f transaction. This leaves few options to find out information about Satoshi. However, if the NSA ran a sufficient number of nodes, they could easily determine the first node to propagate a transaction. This would be Satoshi's IP address. That is why they would do this.
- clarkm 13y ago
  Yep, everyone should be using HD Wallets. Not only are they essential for one's own privacy, but they are also good for preserving overall network privacy. Plus, they make accounting easier.

phaemon 13y ago

Yes, just like preventing invasion of your country would require half the military resources in the world to be devoted to your protection at all times.

betterunix 13y ago
The difference being that military resources have little use outside of military operations. The resources needed to secure Bitcoin have many uses beyond Bitcoin. All that energy, all the silicon, all the computer time, etc., etc., etc. could be used more productively. You are also forgetting that the invasion of one nation is not equivalent to the invasion of all nations, but that if one attacker controls Bitcoin's block chain, the security of all Bitcoin users is compromised. Meanwhile, in the world of cryptography research, we have known how to make secure digital cash, with rigorous security definitions, without the need for such vast energy or computing resources, with support for offline transactions, etc., for decades. The only real difference is that academic systems call for an authority or group of authorities that issue the currency, though that is not as bad as it might sound if you consider the problem of actually defining security without such an authority (Bitcoin's solution, as I mentioned, is to simply not bother with such a definition). It is hard to even say that Bitcoin has no central authority at this point; the developers of popular Bitcoin software have tremendous power over Bitcoin (e.g. they can trigger block chain forks).
- jafaku 13y ago
  > The only real difference is that academic systems call for an authority or group of authorities that issue the currency. That's quite a difference, and one of the main features of Bitcoin. See the message in the genesis block. > It is hard to even say that Bitcoin has no central authority at this point; the developers of popular Bitcoin software have tremendous power over Bitcoin (e.g. they can trigger block chain forks). I agree with you on that.
  - betterunix 13y ago
    "That's quite a difference, and one of the main features of Bitcoin. See the message in the genesis block." That is a political statement not a technical statement, and this gets to the heart of the problem with Bitcoin and with its lack of a security definition. Bitcoin is popular, particularly among those who distrust the banking system, because there is no requirement for a central authority; that is certainly true but only in a pedantic sense. Without a security definition it is hard to even talk about what Bitcoin requires. What we have therefore is a situation where no amount of technical criticism can matter with Bitcoin. Polynomial time attacks are irrelevant, because there is no requirement that Bitcoin resist polynomial time attacks. There is similarly no particular scalability requirement, and so there can be no real criticism of Bitcoin's scalability. "True believers" in Bitcoin can easily shoot down criticism because critics cannot actually point to any requirement that Bitcoin fails to fulfill: there are no clear requirements to point to. To illustrate this point, consider this statement: There is a polynomial time attack on Bitcoin, and the whitepaper itself describes it. Now, is this a problem? Well, the answer I consistently get from Bitcoin devotees is no, that is not a problem because that is how Bitcoin works. With logic like that, who can argue? So while you call the lack of an authority a feature, I call it a logical gap until a rigorous security definition is presented. Otherwise you have a solution in search of a problem, coupled with a community of people who all have their own vague notions of what they want Bitcoin to do for them.