Quote from: cunicula on December 01, 2012, 06:20:52 PM

Yes, they could definitely do that. I'm not worried about it for the following reasons:
1) For 6 blocks, this is collusion involving 24 keys. You can't just need to find 24 random people. You need to convince 24 specific people to do this. Moreover, some of these people will likely have a nontrivial investment in the system. I think that organizing this collusion would be prohibitively difficult.
2) If it is not difficult or there is a lot of money involved you can just wait. Say we wait a full day's worth of 10 minute blocks, this is then a conspiracy involving 576 people. At some point (I think less than a day, but perhaps more than 6 blocks) this becomes ridiculous.
3) The profit here is just a simple double-spend. If this occurs at rare intervals I don't see that as a big problem. If a lot of money is involved, you can wait.
4) In theory, everything the network does can be scheduled. I'm not sure exactly how it would end up working, but I'm sure this would allow for very quick block intervals. Say we have a 1 minute block interval. This would mean that 1 hour of collusion would require a conspiracy of 240 different people.

Actually, collusion between different people might not be needed. We can have one attacker with (say) 10% stake, so if 3 lucky stakeholders sign each block, the attacker can prepare in advance a secret branch for some future interval of the chain, by doing N=1,2,3... attempts for each block in his secret branch (i.e. create a block with N txns that he sends to himself), and on average each of his blocks will have N=1000 txns.

If it's for example 5 lucky stakeholders instead of 3, then the honest stakeholders' participation level should meet a higher bar as well, etc. Edit: raising the 210 coins threshold would make the attack more difficult, but would also make it harder for the honest network to increment t when the pseudorandom stakeholders aren't active. I don't think that deterministic derivation is a good idea. Having different pseudorandom stakeholders for each txn of at least (say) 210 coins, where each such txn derives other stakeholders when it is tweaked, is probably better.

If the secret branch is too far into the future then it decreases his chances, because follow-the-satoshi can pick a satoshi among satoshis that haven't been minted yet, so the 10% stake figure of the attacker decreases. Edit: this isn't helpful if it's a protocol with finite monetary inflation.

Even if the attacker would want to prepare a secret branch that's closer to the present (rather than far into the future), my earlier comment about doing PoW-style mining still applies. It's just PoW attempts with N=1,2,3... instead of PoW attempts with a tweaked txn.

How new coins are minted is also still vague. For now all the pure-PoS protocols seem dubious to me, if you could refine one of your ideas into a workable pure-PoS protocol then it'd be very impressive. So far it seems that the mixed PoW+PoA (mandatory blocks lottery) is workable.