4 ms·

Could someone with knowledge of Bitcoin explain what happens when a share of the pool hits 51%? Is this dangerous in some way? Edit: Thanks to those who took t

Could someone with knowledge of Bitcoin explain what happens when a share of the pool hits 51%? Is this dangerous in some way? Edit: Thanks to those who took the time to explain. Very interesting.

lmb 13y ago
Essentially, Ghash.io would be in control of the Bitcoin blockchain, allowing double spending of BTC and other nefarious deeds. See https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_computing_power https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_... Edit: According to the Wiki linked, these attacks are also possible with <50% mining rate, although with lower probability of success. So this is a problem even if Ghash.io does not crack the 51%.
krig 13y ago
My understanding is that if one entity controls 51% of the network, they can push arbitrary modifications into the block chain. In effect, they can do whatever they want.
- rlpb 13y ago
  > ...they can push arbitrary modifications into the block chain. In effect, they can do whatever they want. No, since who holds what coin is defined by consensus, which has to stretch out of the mining pool. If they arbitrarily gave themselves coin, for example, then no other client would accept that they hold that. See smtddr's reply for details of what they can and cannot do.
  - andyjohnson0 13y ago
    "If they arbitrarily gave themselves coin, for example, then no other client would accept that they hold that." Would this be detectable in practice?
    - VMG 13y ago
      yes, ever other Bitcoin client would refuse the blocks because they don't follow the transaction spec The purpose of Bitcoin mining is to establish an ordered sequence of transactions
    - guard-of-terra 13y ago
      This will cause block chain to split into two (we've already observed that a year ago due to sqlite glitch between versions) and the offender (ghash, 51%) will get exactly 0% in the block chain that every other client will be using.
- yebyen 13y ago
  That is not correct, the consequences are still very bad. What can you do with 51%? You can (theoretically) revert a transaction that has been confirmed, by mining blocks attached to a prior point in the blockchain and getting a longer chain than the rest of the network. What can't you do? You can't spend someone's coins when you never had their private key to begin with. Making a transaction is an act of "signing" and public-private key cryptography is not dependent on the block chain style technique for sending messages, only for making sure that they got through and maintaining them as a ledger. You can probably single out arbitrary transactions and make sure that those are the ones that are reversed -- your transactions, so the evidence would point back to you, and whomever accepted your bitcoins as payment for something, would potentially know it was you who wronged them. You could also decline to single out a transaction, just reversing all transactions after a given block and starting a "new life" for all the people who spent their coins after that. When you refused to re-sign the transactions that you made, you would then out yourself. All of this is fairly academic since the person in charge of 51% of the hash power (GHash.io owner/operator) is a known actor, the hordes have not trusted him/them anonymously, and it turns out that miners have the least incentive to perform this kind of attack, since you lose an amount of revenue equal to the contents of the number of (your) solved blocks that you reversed. They would be more likely in my opinion to accept hashes and proof of work, but then renege and refuse payment to their miners, since this is really a less sophisticated attack and either way you should lose all of your credibility as a pool operator when you are discovered.
  - makomk 13y ago
    The thing you're not taking into account is that, even if GHash.io are trustworthy, this still makes them a single point of failure - any attacker who compromises their systems can carry out double spends, or they can even do it themselves and then blame it on an outsider. What's more, this has already happened with GHash.io and it hasn't damaged their reputation in the slightest. (Back when they were a smaller portion of the network, someone spotted malicious double spends of coins obviously linked to GHash.io that were equally obviously done using the miners they controlled. They blamed it on rogue insiders and everyone carried on using them.)
darkFunction 13y ago
The pool operators could launch 'double spend' attacks. Essentially with > 50% of the hashing power, a bad operator is able to generate a chain faster than the rest of the network. They can hold back this longer chain in secret, execute some transactions on the honest chain, then broadcast their chain (which doesn't have those transactions included) to the network. The network will use the evil chain since it is the longest, and since those transactions are not included, whoever accepted them beforehand has been ripped off. It worries me that it's this hard to convince miners to leave a pool. If I wanted to kill Bitcoin and had a few million to spare, I'd open a pool with no fees PLUS a bonus of 1 or 2% from my own pocket. Good luck getting people to leave that pool.
- btcwatcher 13y ago
  Who would want to kill bitcoin apart from governments? (They can just outlaw it.) It's not possible to short it yet, is it?
- jackgavigan 13y ago
  There are rumours that that double-spend attacks have already been tried or experimented with by someone linked to the Ghash.io pool: https://bitcointalk.org/index.php?topic=327767.0 https://bitcointalk.org/index.php?topic=327767.0
- flatline 13y ago
  There is even some evidence that double-spending attacks have already happened. You don't strictly speaking need 51%, that majority just ensures that your chain will win out over time. The original bitcoin paper[1] details the probabilities involved for nodes controlling < 51%, if anyone is interested it is a short and good read. It could be even worse than that however. Another post on BCT[2] talks about a "time warp attack", where at 51% node could effectively mine all remaining bitcoins in one fell swoop. [1] http://bitcoin.org/bitcoin.pdf http://bitcoin.org/bitcoin.pdf [2] https://bitcointalk.org/index.php?topic=114751.0 https://bitcointalk.org/index.php?topic=114751.0
aestra 13y ago
Here you go: http://bitcoin.stackexchange.com/questions/658/what-can-an-attacker-with-51-of-hash-power-do http://bitcoin.stackexchange.com/questions/658/what-can-an-a... http://learncryptography.com/51-attack/ http://learncryptography.com/51-attack/
nhaehnle 13y ago
Despite the good responses, there are two points that I believe are important that haven't been pointed out yet. 1. While a 51% pool operator could double spend, none of the participants can do that. The social incentives against a pool operator exploiting this power are very strong, however, because double spends are basically impossible to hide and would destroy the value Bitcoin - which is pretty much against the operator of a mining pool who is likely to hold significant amounts of Bitcoin herself. 2. There is a second possible exploit that is not so well known, which is that a >50% pool can capture all mining rewards. They can do so by never accepting a block mined by somebody else, and instead always mining on their private chain. This pool-specific chain will always ultimately become longer. The loss of confidence associated with such an attack is probably smaller. So I would bet that if the pool operator has evil intentions, that would be the way to go for them.
- josu 13y ago
  I hadn't heard of the second possible attack that you mention until now. Could you please point me to an article or somewhere that develops the idea. I'm intrigued about what people predict that the miners of such pool would do in that scenario.
  - nhaehnle 13y ago
    The interesting point about the second possible attack is that a weaker form is possible even with less than 50% of the hashing power. The term to search for in a search engine is "selfish mining", e.g. here: http://bitcoinmagazine.com/7953/selfish-mining-a-25-attack-against-the-bitcoin-network/ http://bitcoinmagazine.com/7953/selfish-mining-a-25-attack-a...
- mapt 13y ago
  Can #2 be turned on and off in a controllable manner, such that it grants only a modest statistical advantage (sufficient, say, to keep the pool above 50%) ?
- deleted 13y ago
  [deleted]

Could someone with knowledge of Bitcoin explain what happens when a share of the pool hits 51%? Is this dangerous in some way? Edit: Thanks to those who took the time to explain. Very interesting.

lmb 13y ago

Essentially, Ghash.io would be in control of the Bitcoin blockchain, allowing double spending of BTC and other nefarious deeds. See https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_computing_power https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_... Edit: According to the Wiki linked, these attacks are also possible with <50% mining rate, although with lower probability of success. So this is a problem even if Ghash.io does not crack the 51%.

krig 13y ago

My understanding is that if one entity controls 51% of the network, they can push arbitrary modifications into the block chain. In effect, they can do whatever they want.

rlpb 13y ago
> ...they can push arbitrary modifications into the block chain. In effect, they can do whatever they want. No, since who holds what coin is defined by consensus, which has to stretch out of the mining pool. If they arbitrarily gave themselves coin, for example, then no other client would accept that they hold that. See smtddr's reply for details of what they can and cannot do.
- andyjohnson0 13y ago
  "If they arbitrarily gave themselves coin, for example, then no other client would accept that they hold that." Would this be detectable in practice?
  - VMG 13y ago
    yes, ever other Bitcoin client would refuse the blocks because they don't follow the transaction spec The purpose of Bitcoin mining is to establish an ordered sequence of transactions
  - guard-of-terra 13y ago
    This will cause block chain to split into two (we've already observed that a year ago due to sqlite glitch between versions) and the offender (ghash, 51%) will get exactly 0% in the block chain that every other client will be using.
yebyen 13y ago
That is not correct, the consequences are still very bad. What can you do with 51%? You can (theoretically) revert a transaction that has been confirmed, by mining blocks attached to a prior point in the blockchain and getting a longer chain than the rest of the network. What can't you do? You can't spend someone's coins when you never had their private key to begin with. Making a transaction is an act of "signing" and public-private key cryptography is not dependent on the block chain style technique for sending messages, only for making sure that they got through and maintaining them as a ledger. You can probably single out arbitrary transactions and make sure that those are the ones that are reversed -- your transactions, so the evidence would point back to you, and whomever accepted your bitcoins as payment for something, would potentially know it was you who wronged them. You could also decline to single out a transaction, just reversing all transactions after a given block and starting a "new life" for all the people who spent their coins after that. When you refused to re-sign the transactions that you made, you would then out yourself. All of this is fairly academic since the person in charge of 51% of the hash power (GHash.io owner/operator) is a known actor, the hordes have not trusted him/them anonymously, and it turns out that miners have the least incentive to perform this kind of attack, since you lose an amount of revenue equal to the contents of the number of (your) solved blocks that you reversed. They would be more likely in my opinion to accept hashes and proof of work, but then renege and refuse payment to their miners, since this is really a less sophisticated attack and either way you should lose all of your credibility as a pool operator when you are discovered.
- makomk 13y ago
  The thing you're not taking into account is that, even if GHash.io are trustworthy, this still makes them a single point of failure - any attacker who compromises their systems can carry out double spends, or they can even do it themselves and then blame it on an outsider. What's more, this has already happened with GHash.io and it hasn't damaged their reputation in the slightest. (Back when they were a smaller portion of the network, someone spotted malicious double spends of coins obviously linked to GHash.io that were equally obviously done using the miners they controlled. They blamed it on rogue insiders and everyone carried on using them.)

darkFunction 13y ago

The pool operators could launch 'double spend' attacks. Essentially with > 50% of the hashing power, a bad operator is able to generate a chain faster than the rest of the network. They can hold back this longer chain in secret, execute some transactions on the honest chain, then broadcast their chain (which doesn't have those transactions included) to the network. The network will use the evil chain since it is the longest, and since those transactions are not included, whoever accepted them beforehand has been ripped off. It worries me that it's this hard to convince miners to leave a pool. If I wanted to kill Bitcoin and had a few million to spare, I'd open a pool with no fees PLUS a bonus of 1 or 2% from my own pocket. Good luck getting people to leave that pool.

btcwatcher 13y ago
Who would want to kill bitcoin apart from governments? (They can just outlaw it.) It's not possible to short it yet, is it?
jackgavigan 13y ago
There are rumours that that double-spend attacks have already been tried or experimented with by someone linked to the Ghash.io pool: https://bitcointalk.org/index.php?topic=327767.0 https://bitcointalk.org/index.php?topic=327767.0
flatline 13y ago
There is even some evidence that double-spending attacks have already happened. You don't strictly speaking need 51%, that majority just ensures that your chain will win out over time. The original bitcoin paper[1] details the probabilities involved for nodes controlling < 51%, if anyone is interested it is a short and good read. It could be even worse than that however. Another post on BCT[2] talks about a "time warp attack", where at 51% node could effectively mine all remaining bitcoins in one fell swoop. [1] http://bitcoin.org/bitcoin.pdf http://bitcoin.org/bitcoin.pdf [2] https://bitcointalk.org/index.php?topic=114751.0 https://bitcointalk.org/index.php?topic=114751.0

aestra 13y ago

Here you go: http://bitcoin.stackexchange.com/questions/658/what-can-an-attacker-with-51-of-hash-power-do http://bitcoin.stackexchange.com/questions/658/what-can-an-a... http://learncryptography.com/51-attack/ http://learncryptography.com/51-attack/

nhaehnle 13y ago

Despite the good responses, there are two points that I believe are important that haven't been pointed out yet. 1. While a 51% pool operator could double spend, none of the participants can do that. The social incentives against a pool operator exploiting this power are very strong, however, because double spends are basically impossible to hide and would destroy the value Bitcoin - which is pretty much against the operator of a mining pool who is likely to hold significant amounts of Bitcoin herself. 2. There is a second possible exploit that is not so well known, which is that a >50% pool can capture all mining rewards. They can do so by never accepting a block mined by somebody else, and instead always mining on their private chain. This pool-specific chain will always ultimately become longer. The loss of confidence associated with such an attack is probably smaller. So I would bet that if the pool operator has evil intentions, that would be the way to go for them.

josu 13y ago
I hadn't heard of the second possible attack that you mention until now. Could you please point me to an article or somewhere that develops the idea. I'm intrigued about what people predict that the miners of such pool would do in that scenario.
- nhaehnle 13y ago
  The interesting point about the second possible attack is that a weaker form is possible even with less than 50% of the hashing power. The term to search for in a search engine is "selfish mining", e.g. here: http://bitcoinmagazine.com/7953/selfish-mining-a-25-attack-against-the-bitcoin-network/ http://bitcoinmagazine.com/7953/selfish-mining-a-25-attack-a...
mapt 13y ago
Can #2 be turned on and off in a controllable manner, such that it grants only a modest statistical advantage (sufficient, say, to keep the pool above 50%) ?
deleted 13y ago
[deleted]