Quote from: jonald_fyookball on March 31, 2015, 01:31:17 AM

Quote from: koubiac on March 30, 2015, 10:14:10 PM

Quote from: jonald_fyookball on March 30, 2015, 05:36:02 PM

But none of these time intervals happen in real time or matter to the attacker
in a PoS. They can all be spoofed...You can always broadcast a false chain
and that has always been the problem with PoS.

(Only PoW is resistant to time manipulations because it takes real time
to do the work.)

Can someone explain to me what is really new here?

Hi jonald,

I'd love to go into details about the grinding attack.
Could you clarify a few points for me before we dig in so that I don't paraphrase the paper.
1/What do you mean by "creating a false chain"? Creating a competing chain? I'm not sure what "false" means here.
2/What do you mean by "time intervals can all be spoofed". Of course, the attacker doesn't have to "redo the work" if he can reuse some previously create proofs but in this case his fork (at the beginning) will be a subset of the mainchain.

More generally, could you please provide a detailed description of how you would conduct such an attack (even a high level explanation would be great)
thanks !

There is some mechanism to decide who gets
to stake the next block.

In PoW, you must solve be the first to
solve a puzzle. In PoS, you need only
meet certain conditions with your stake.
(And those conditions must be flexible
enough to ensure that blocks come out
in a timely manner -- should the chosen
participant not mint the block, an alternate
must be quickly selected).

Forcing a reorganization by broadcasting
a longer chain is the same mechanism
whether one is attempting a double spend
or simply trying to garner transaction
fees.

As the paper, says, grinding refers
to "cheaply searching the blockspace to find blocks
that direct history in their favor".

So a false chain is any other chain than
the main chain -- it is one that you forked
from a previous point on the main chain,
either for the purposes of double spending,
or gaining fees.

As far as spoofing the time intervals,
lets say you want to start a chain
"from 200 minutes ago". You can have
a computer calculate an alternate
chain that supposedly started 200 minutes
ago in a few seconds, and broadcast
that in realtime right now. Nodes receiving that
would not know that the blocks on
the false chain weren't really
built 200 minutes ago.

Nodes must accept the longest chain,
otherwise you will loose consensus and
risk a fork in the blockchain.

You won't always be able to achieve this,
but occassionally you will, and since
the cost is minimal, why not try it?

Of course, if everyone starts doing that,
you are back to the issue of using
competing computing resources, and thus
energy costs will rise to the level of
marginal profitability, which is the
very thing that PoS claims to avoid.

I'm not sure what the 200 minute buffer
zone applies to (new coins staking?),
but that really doesn't solve the issue,
as you can keep trying to attack with
old coins, or you can attack less frequenly
(every 200 minutes) with coins you just
bought and sold. In addition, I believe
it opens additional attack vectors based
on older stake participants rejecting
newer participants.

Again, this kind of thing has always
been a problem with PoS coins.
I just don't see how neucoin is anything new.

disclaimer: I'm not an expert and I could certainly
be wrong, but I would like someone to
explain why I am wrong.

I like the unusual formatting, since it makes your post look like poetry.
Were you on a phone (very small screen) typing it?