Quote from: devphp on June 08, 2014, 07:41:43 PM

Quote from: Peter R on June 08, 2014, 07:39:15 PM

The attacker needs 51% of coins the existed at some point in the past. He can attack the network with 0% of the coins that are currently considered as valid. That's why it's called "nothing at stake": he can attack the network using coins that were already spent!

Can you provide technical explanation of this attack?

DeathAndTaxes is probably the clearest writer on this topic. I suggest you read his comments from the "PoS vs PoW" thread starting with this one:

Quote from: DeathAndTaxes on May 15, 2014, 08:42:49 PM

You misunderstand. The risk isn't that someone could attack the network, it is that they could attack the network with no cost.

Imagine bitcoin worked using a PoS. An early adopter had acquired 1M BTC at one time in the past but over time he lost/sold/spent/transferred them. Today he has no bitcoins but the blockchain contains a history of a time when he did have 1M BTC. If the amount of the stake being used is <1M BTC he could rewrite history not by using coins he has today (a real cost), not by buying millions of mining rigs (a real cost) but by using the history of the coins he once had (no cost). He has absolutely nothing at risk and nothing to lose. If he and potentially others decided to attack the network they would rewrite the blockchain starting from when they had a larger stake, creating a parallel history where they didn't lose/sell/spend/transfer the coins.

They can attack the network based on what they had (but no longer do) in the past. There is nothing at risk and no cost to the attack. THAT is the PoS problem.

Quote

If bitcoin miners collude, they could alter the past.

Sure they can, however there is a cost to that attack and there is something at risk which they lose if they fail. With PoS you can attack the network for "free" using something you had but no longer do. It is very hard to secure against an attack where the attacker can do so at any time without any cost and without any risk.

Section 5 of Andytoshi's paper tries to address this too, but not in as much detail as DeathAndTaxes:

https://download.wpsoftware.net/bitcoin/asic-faq.pdf