Quote from: koubiac on April 01, 2015, 10:13:48 AM

Quote from: jonald_fyookball on March 31, 2015, 01:37:55 PM

As you said, an attacker can simply use coins that are old
enough and keep trying with them. Those attacks would
be smaller than 200 block reorgs.

A common misconception is that you can "keep trying". What do you mean by keep trying?
You can try creating forks at every block of the main chain but the probability to create more blocks than the rest of the network combined over a significant period of time (significant doesn't have to be more than say 10 minutes) is negligible you don't own a very large portion of the mining coins.
If you mean "keep trying" as in trying many times to create a fork at a given height, you simply cannot do that because the outcome will always be the same (since the computation is deterministic and the input is seeded on the mainchain). To get a different outcome and thus be able to "keep trying" the attacker needs to move his coins to the fork and that's when the minimum stake age kicks in.
This is what necessarily creates a lag.

Quote

As far as the new coins (or any coins), what you are not considering is that the blockchain
MUST find new blocks.

Assume you have a 10 percent stake, so you'd have a
1 in 10 chance of being awarded a block.
Your argument is that you'd have a 10% chance (or .1 probability)
of succeeding at one block, .1^2 for two blocks in a row, .1^3 for
blocks in a row, etc.

However, here's where that argument falls apart:

What if the block found "deterministically"
wasn't broadcast by the chosen stakeholder? Now the network
must choose again, so you get another 10% chance. This
process can continue ad infinitum in a grinding fashion.

What do you mean it can continue ad infinitum? What you're describing is basically the percentage of coins mining dropping to zero! This is not realistic assumption!
The blocks that should mine and don't are already taken into account in the computation because the attacker compares his stake to the total mining coins and not the total coins.

Exactly. The percentage of mining from other people would drop to zero in a false chain that the attacker generates on his own through grinding. It would have to, by definition, since the attacker must create the entire chain. However, since no one really knows who owns what coins, the network would not be able to tell the difference except that perhaps there is a longer time than usual between blocks.

Then, you might propose restricting chains with too long gaps between blocks.

Let's explore this idea further: say you have a rule that says every minute I'm doing to cut in half the hash value or requirement to forge a new block. So if you have a ten percent stake, you have a ten percent chance. after two minutes it's twenty, after three minutes it's forty, and after four minutes it's eighty. So based on that, let's say it's taking you 3.5 minutes between blocks. (Keep in mind these spaces of 3.5 minutes would be time stamps only for the attacker, not real gaps of time.)

So if I broadcast a false chain, all the blocks are going to about 3.5 minutes apart in their time stamps.

You might consider, say, a weighted function that decreases the chain's "effective length" when using the longest chain rule. For example, we divide each block by the number of minutes, so that a block taking 3 minutes instead of 1 only counts for a third of a block. So now you would need a chain 3.5 times as long.

But then attackers could simply build longer chains.

You could in turn, prevent this from occurring in long range attacks
by creating an additional rule that the time stamps can't be
too far in the future, but it doesn't prevent shorter term grinding
attacks from older coins.

One idea I've seen to prevent these kinds of PoS attacks is Vitalik Buterin's suggestion of using security deposits, but even that doesn't solve the problem
because you can just attack once you get your deposit back, so it may lessen the frequency of attacks, similar to the 200 minute rule proposed here, but I don't think it stops them.

You also have to be careful with these kinds of rules and not making them too restrictive so you don't risk losing distributed consensus (blockchain fork) or the network halting because no chain is valid when an edge case arises involving low miner participation, ddos, etc, as well as opening up new attack vectors. I don't think there is any free lunch.