Quote from: iddo on December 01, 2012, 05:49:56 PM

Quote from: cunicula on December 01, 2012, 04:51:05 PM

No, there is an unexpected twist. Any block of height t containing N txns maps to exactly the same satoshis. The lottery is deterministic rather than random. The only random element is who happens to have their computer online. We could predict who is going to mine in advance. This isn't necessary to think about, but in theory the whole mining process could be scheduled because of this.

However, once the block hash is signed by the first winner, then the block contents cannot be modified by the other winners. By default, the group is not supposed to sign more than one version of block t. They could cheat and sign a very large number of versions of block t with N txns.

Three cases if they cheat:
1) If one version has already been built upon and the other blocks are orphans, then keep building on the longest version.
2) You are aware of more than one version, but haven't seen any that have been built on. In this case, combine any two duplicate blocks t and mine a 'null block'. The record of the cheating is put in the blockchain. All txn for time t are ignored and you move on to block t+1.
3) You are only aware of one version. In this case try to build on it until you hear about another. (You don't know that cheating has occurred yet.)

If it's deterministic given t and N, then rational/malicious stakeholders could collude in advance regarding future interval of the chain where they are the derived winning stakeholders for N=1, by preparing a secret branch of length (say) 6 blocks with N=1 in all the 6 blocks, and reveal this secret branch after the honest branch reaches 6 blocks in order to reverse some txn and double-spend.

Yes, they could definitely do that. I'm not worried about it for the following reasons:
1) For 6 blocks, this is collusion involving 24 keys. You can't just need to find 24 random people. You need to convince 24 specific people to do this. Moreover, some of these people will likely have a nontrivial investment in the system. I think that organizing this collusion would be prohibitively difficult.
2) If it is not difficult or there is a lot of money involved you can just wait. Say we wait a full day's worth of 10 minute blocks, this is then a conspiracy involving 576 people. At some point (I think less than a day, but perhaps more than 6 blocks) this becomes ridiculous.
3) The profit here is just a simple double-spend. If this occurs at rare intervals I don't see that as a big problem. If a lot of money is involved, you can wait.
4) In theory, everything the network does can be scheduled. I'm not sure exactly how it would end up working, but I'm sure this would allow for very quick block intervals. Say we have a 1 minute block interval. This would mean that 1 hour of collusion would require a conspiracy of 240 different people.