Quote from: hannesnaude on November 06, 2013, 11:23:10 AM

Quote from: kjj on November 06, 2013, 04:58:27 AM

Quote from: gmaxwell on November 04, 2013, 06:11:37 AM

Ideally I'd like to think about it carefully, read the paper a few times, and run some simulations before commenting, but I'll likely be tied up at the IETF all week and people are already panicking and pushing for hasty changes in response to this which may be ill-advised, so I'm going to offer some preliminary comments here.

Please do run your simulations. When you do, make sure that you faithfully simulate a network with latency. The word latency exists in their paper exactly one time, as a casual aside in the solution section, which should immediately set alarm bells ringing in all of our heads. In addition, they seem to suffer from the strange notion that work in bitcoin can be wasted.

If I boot up my multi TH mining rig and start mining blocks from the genesis block onward, is my work not wasted? Does it contribute to network security? Will I earn any block rewards for the blocks I mine? As far as the rest of the network is concerned, I might as well not exist.

Well done, you got me. Work can be wasted if done at the wrong end of the chain. If you read on to the end though, I clarify that expression.

Quote from: hannesnaude on November 06, 2013, 11:23:10 AM

Quote from: kjj on November 06, 2013, 04:58:27 AM

Let me start with latency. As far as I can tell from the paper, their "simulation" (and here you should imagine me doing very sarcastic air quotes) involves a network where the evil miners have magically found a way to detect the competing block in the honest miner's memory, before it has begins to spread on the network. Gamma seems to play some sort of role here, but the meaning of it seems to change from page to page. Or at the very least between pages 8 and 11. Can anyone give me a good justification for abusing this poor variable in this way?

I have taken a look and cannot for the life of me understand what is confusing you. Gamma is defined quite clearly:"We denote by gamma the ratio of honest miners that choose to mine on the [selfish] pool's block, and the other (1-gamma) of the non-pool miners mine on the other branch." The variable is consistently used with this meaning. And your assertion that "the evil miners have magically found a way to detect the competing block in the honest miner's memory, before it has begins to spread on the network." is plainly false. The situation that you describe would correspond to a gamma of 0 (the worst case). But even when gamma is 1 (i.e. "the honest miners have magically found a way to always work on the honest block in the case of a tie") the attack works for an attacker with >33% of network hash power. I find the researchers' claim that a gamma of 1 is attainable by an attacker in the current bitcoin network to be tenuous at best, but this is not that important, since the attack works even for the best case where gamma=0.

What may have tripped me up was the way they describe gamma on the various pages. When I was reading the paper, I was struggling to find a unifying theme for all of the ways they use gamma. It seems to be a choice on one page, and then an expression of the natural race between competing blocks on the next.

In regards to latency, you seem to be missing a very important aspect of reality on the bitcoin network. If you are sitting on a block, waiting for the rest of the network to find one so that you can publish yours, the signal that you need to act is also the signal that you have already lost. Don't feel bad, this entire paper was written because of the same misunderstanding. You can not win races by waiting for the rest of the network to pass you.

Quote from: hannesnaude on November 06, 2013, 11:23:10 AM

Quote from: kjj on November 06, 2013, 04:58:27 AM

The charts are very illuminating. In figure 2, each of the simulation points is exactly on the calculated line. This is a dead giveaway. The only way that can happen is if their model is fully deterministic except for mining function.

BS I replicated this result and I can guarantee you that the mining function is not deterministic. Besides, your premise is laughable. How accurately can you really read that chart? Enough to say that the simulated results are within 1% of the predicted values? 0.1%? You can easily get simulation results accurate to a fraction of that in a modest amount of time on a dated single core machine. I know because I tried.

I agree with you so much that I traveled back in time to do it. What is fully deterministic in their model is everything else. When a new block is found, gamma of the network switches to it, while 1-gamma switches to the attack block. This is not reality.

Quote from: hannesnaude on November 06, 2013, 11:23:10 AM

Quote from: kjj on November 06, 2013, 04:58:27 AM

The real gold of this paper comes on page 13. On page 13 they handwave over the latency issue by pointing out that an attacker could insert itself between every other node on the network. Let me just sum up a few years of discussion on this topic...

Strawman. Nowhere on page 13 do they suggest that or anything that I can interpret as being equivalent to an attacker being required to "insert itself between every other node on the network". If you disagree please post the relevant quote. As stated earlier, I find their assertion that gamma close to 1 is attainable to be tenuous, but this is just a misrepresentation of their position.

Quote

But a savvy pool operator can perform a sybil attack on honest miners by adding
a signicant number of zero-power miners to the Bitcoin miner network. These
virtual miners act as advance sensors by participating in data dissemination,
but do not mine new blocks.

"every other node" was hyperbole, but not far off from what it would really take. If the bitcoin network was laid out like an efficient mesh on a flat sheet, you wouldn't need many sensors. But the bitcoin network is tangled up like a wad of Christmas lights.

Quote from: hannesnaude on November 06, 2013, 11:23:10 AM

Quote from: kjj on November 06, 2013, 04:58:27 AM

Of course, everyone instantly sees how silly that is, so they had to dress it up in pseudo-scientific gibberish so that people would click on their crappy website and check out the douchebag's glamour shot.

Real mature. This is peer-review, is it?

When you run to the press, you tell the world that you are no longer interested in civil peer review.