Quote from: gatra on November 13, 2014, 02:33:06 PM

Quote from: Daedelus on November 13, 2014, 01:23:08 PM

Alice wants to attack the blockchain.
She owns private keys of 400 accounts totalling to 75% of the stake.
She is planning to rewrite the history from block 5'000.
Legit chain is at block 5'300 (less than 720).
Cumulative difficulty at block 5'000 is 8'000'000.
Cumulative difficulty at block 5'300 is 9'000'000.
How many SHA256 operations in average it's necessary to do to find a branch where cumulative difficulty at block 5'300 is at least 9'000'001?
Hint: Blocks from 5'000 to 5'300 were forged by 100% of the stake.

There is no answer because the question makes no sense.
first answer this: why do you think there are many SHA256 operations involved? how would a large hashrate benefit an attacker?
it's not a matter of hashrate, it's 300 blocks * 60 seconds * 400 accounts = 7200000. Hashing that many SHA256 takes less than one second on a modern cpu.

The question is not clear because it talks about "the stake", but what is "the stake"? the total amount of coins? or the amount of coins actively forging at the given time? were your 400 accounts forging on the main chain at block 5000 or not?

If you control more coins at block 5000 than those that were forging at block 5000 then you can simply rewrite everything.

why do you think there are many SHA256 operations involved?
That is what is required to calculate a longer chain that stands a chance of being accepted as legitimate.

Quote from: Daedelus on November 13, 2014, 08:50:21 AM

The better chain needs to almost mirror the honest one in terms of certain properties.

The retargeting algo in Nxt plays an important role in this.

how would a large hashrate benefit an attacker?
See above.

it's not a matter of hashrate, it's 300 blocks * 60 seconds * 400 accounts = 7200000
Which POS implementation is this possible in? It doesn't look very secure.

what is "the stake"?
The stake is Alice's coins, 75% of all coins in existence.

were your 400 accounts forging on the main chain at block 5000 or not?
Assume worst case for coin, best in favour of the attacker.