Quote from: Nagalim on November 26, 2017, 06:59:45 PM

So you are talking about a 50% attack, which is also executable on the Bitcoin chain and basically any crypto. It at first appears more tempting for Peercoin because it doesn't require investment in hardware like it does on Bitcoin. However, you do invest in the digital coins, hoping to sell them before you unleash your attack chain. This is similar to selling your Bitcoin hardware after attacking the chain, in that you can recover some of your investment and still carry out the attack. So on its face, 50% attacking Peercoin is similar to 50% attacking any crypto, in that it requires overcoming whatever network effect the coin has generated.

The difference between a PoW 50% attack and the long-range attack I described is that in the 50% PoW attack the attacker could not mine his "longer chain" in secret - he must point all his hashpower to the chain, publicly. That's why it would be easier to "defend" against this attack - "honest" miners could instantly try to out-power the attacker few blocks after the 50% attack. And they could blacklist all coins that he earned via block rewards and try to detect the double spend before it can do harm (e.g. he is able to sell the coins at the exchange). If his attack is successful, the money he uses to buy hashrate is burnt, because if the coin is destroyed (or loses lots of value) after the attack, his hardware would not be worth much.

A PoS long-range attack is more dangerous, because the attacker can sell the coins undetected before he releases the "attack chain". But it is also probably more expensive than a 50% PoW attack, and there are certainly possibilities to design a 50% PoW attack in such a way that it may be profitable (For example, I calculated that attacking Bitcoin via a 50% attack would cost about 2% of it's supply - it may be possible to arrange a short sell of this amount).

Quote

For the specific long-range nature of the attack you describe, it is important to realize that clients will not reorg beyond a certain depth (Peercoin has two types of checkpoints: 'synchronized', which is what we've been talking about, and 'hard', which is what I'm talking about now and something that Bitcoin also has).

I know the "hard checkpoints", but aren't these only published when a new Peercoin version is released? Because the distance between two releases (several months) is enough for a long-range attack.

Obviously, if Peercoin already has a "reorg limit" of a fixed numbers of blocks (for example, NXT has 1440 blocks, roughly 24 hours because they have a 60 second block interval), then it's already protected pretty well against this type of attack. I thought it had not, but I may be wrong. Nxt's reorg limit for me seems a little bit short, I would be more happy with approximately a week.

PS: I'm not a PoS skeptic like those "critics" that think that "PoS does not work" - only I am skeptic regarding the sense of the synchronized checkpoints and would like to see them replaced with rolling checkpoints or Vitalik's "soft checkpoints".