Quote from: andytoshi on November 01, 2014, 04:05:56 PM

Quote from: achimsmile on November 01, 2014, 07:58:28 AM

I still don't see how a nothing at stake attack could succeed.

Maybe if you read my PoS paper where I actually give a specific attack?

Quote

Buying majority of PoS coin supply isn't exactly nothing,

It isn't exactly anything, either. "majority of PoS coin" is not well-defined in the absence of consensus.

Quote

and finding private keys of the initial stakeholders does not help if you have checkpoints.

...yes, obviously you can create a non-distributed consensus. Humans have been doing this since before we had language.

Quote

Nxt uses a reorg window of 720 blocks. blocks older than that won't be accepted by any client. This means that checkpoints are set up in decentralized manner (each client sets its own reorg limit). You need to effectively buy 51%.

Is this actually what they do? Reorg windows simply make forks permanent. There is literally no attack they are capable of mitigating -- either you have no deep forks and they are pointless, or you do and they result in permanent partitioning of the network. (This idea has come up hundreds, if not thousands of times, and is orthogonal to the consensus mechanism.)

Quote

I would like to see a nothing at stake attack succeed,

Stake-grinding is an example of a NaS attack. See peercoin or the original NXT for examples.

Quote

so far I only saw 51% attacks on low hashrate PoW coins. Also I don't see how decentralized consensus should not be possible in PoS?

Maybe if you read my PoS paper?

Quote

I see it working in real world while the "consensus is not possible" statement is theoretical.

I see this claim, along with its variant ""consensus is not possible" statement is bullshit", a lot. But this paper has been out for over six months, has been read by thousands of people, has changed the discourse around PoS to the point where I was accused of strawmanning after its last appearance on Reddit since "nobody is actually proposing distributed consensus by PoS", and yet there have been exactly zero counterarguments. I'm getting tired of these sorts of proudly uninformed comments.

Your paper is too vague.

Quote

an attacker with enough past signing keys can modify the
history he has direct control over, causing future signer selections to always happen in his
favour. (It is likely he needs to grind through many choices of block before he finds one
which lets him keep control of the signer selection. In effect, he has replaced proof-of-stake
with proof-of-work, but a centralized one.)

You make it sound easy to just grind through "many" choices of blocks, yet don't provide a model of how many that excatly means. This attack vector may have been possible with peercoin and an early version of Nxt (before transparent forging was partly implemented at block height 30000, in the current version the account that will forge the next block is already known, you don't have enough time to produce a valid block and influence the desired next forging account, you would need huuuge amounts of computing power to do so).

You need to provide mathematical proof of how much cumputing power is needed to build a long enough chain and trick the network to accept your fake chain. I say (sorry only speaking about Nxt again) you'd need too much. Prove me wrong.

And Nxt does not use coin age, which released minting power to the account that signed the block, if the block was orphaned. So that attack vector is also gone.

Quote

Suppose that at some early
point in consensus time, a single person has the ability to extend history. (For example,
they have control over every key which a new block is required to be signed by.) This may
have happened organically, if this persons keys were chosen randomly by the stake-choosing
algorithm, but it could also happen if this person tracks down the other keyholders and buys
their keys. This may happen much later in consensus time (and real time), so there is no
reason to believe these keyholders are still incentivized to keep their keys secret. Alternately,
they may have revealed the keys through some honest mistake, the chances of which increase
as time passes, backups are lost, etc

720 blocks is not "much later".