Quote from: TheFascistMind on October 06, 2014, 02:20:18 AM

Perhaps I am closer to describing more specifically how a BCX-like an attack might be feasible. Note I still haven't done any precise quantification so interpret this as probing FUD.

A key algorithmic insight may be that the attacker's hidden fork is evaluated when it is published according to difficulty in place at that time, not the difficulty that existed while the attack was mining the hidden fork.

TW and other difficulty adjustment attacks are based on lowering the difficulty at which the attackers fork is measured, non-linearly relative to the proportion of the attacker's percentage of the network hashrate.

For example, the attacker could introduce a lot of orphans and cause the network to waste hashrate, thus lowering the difficulty at the next adjustment.

Or the attacker can leverage flaws in the difficulty adjustment that cause the majority to mine at a higher difficulty than the majority's hashrate, then the attacker publishes his hidden fork when the difficulty readjustments. For example, Kimoto Gravity Well has a flaw in that it thresholds the adjustment so the attacker can trigger a huge difficulty raise, then pull his hashrate away but not too fast so the difficulty adjustment stays under the threshold and doesn't adjust until the attacker is ready for it to.

I believe the discarding of the 20% tails of the timestamp distributions in Cryptonote's difficulty adjustment might present such a flaw, but I am not attempting to quantify it and prove it (not my job). Imagine that every distribution of timestamps follows some bell curve. So if the hacker puts his timestamps on one side of the mean, he can shift the mean.

So attacker has 25% of hashrate, so he pulls it after the difficulty adjustment (mines another coin), then mines a secret fork at 33% hashrate starting with a few blocks before the next difficulty adjustment. If he has 25% he can amplify that further. Instead of mining another coin, he can selfish mine which further pulls down the hashrate due to all the orphans created.

While doing that selfish mine on CN he can possibly set his timestamps such that he causes the 20% fastest blocks from honest miners to be discarded. Thus the difficulty will reduced even more, thus he is mining on his secret chain just before the next difficulty adjustment at up to 0.25 / (0.8 x 0.75) = 42% effective hashrate, thus he can mine 9 blocks on his secret chain with a 50% probability of success.

That doesn't sound that dangerous, but every time he pumps the hashrate back up for one difficulty adjustment period he reduces miner income and the amplified selfish mining is reducing miner income.

Thus the honest mining hashrate declines over time. Isn't this what was happening to Auroracoin where it had declined from 16 ghps to 2.4 ghps, before the block 5400 eta of TW exploit to take over the chain?

Remember that post during his Auroracoin attack where BCX wrote, "doesn't seem miners are too interested to defend this coin, LOL".

So if you want to look for his exploit, check to see if there is evidence of increasing orphans around difficulty adjustments. And/or look for increasing swings in the difficulty and hashrate.

Edit: thus the shorter the interval of the block adjustment, the faster he gains on the majority. This is why he said "haven't developers learned to not make their difficulty adjustment fast". Sounds to me, he knows his book.