Why is 6 the number of confirms that is considered secure?

Question

Why is 6 is the number of confirms that is considered secure? I haven't found any mathematical explanation or otherwise that explains with it is 6 and not 5 or 7. Is there a historical reason for 6? Is there no for sure way to calculate it so 6 is just a number that was chosen?

Answer 1

I believe this is addressed in page 8 of Satoshi's Bitcoin paper when showing the probability of an attacker catching up.

The wiki states: "Only 6 blocks or 1 hour is enough to make reversal computationally impractical."
https://en.bitcoin.it/wiki/FAQ#Why_do_I_have_to_wait_10_minutes_before_I_can_spend_money_I_received.3F I think the key word is "impractical".

The important sentence in Satoshi's paper is: "assuming the honest blocks took the average expected time per block, the attacker's potential progress will be a Poisson distribution".

So it is not that someone couldn't create the worlds first and only $50 million GPU farm so as to have the ability to overtake the blockchain from a fork six blocks prior but that doing so would be a.) a massive undertaking, b.) obvious to all and c.) terrifically unprofitable to the attacker.

Answer 2

Here are some of the relevant sections from Satoshi's paper: http://bitcoin.org/bitcoin.pdf

"11. Calculations We consider the scenario of an attacker trying to generate an alternate chain faster than the honest chain. ... The race between the honest chain and an attacker chain can be characterized as a Binomial Random Walk. The success event is the honest chain being extended by one block, increasing its lead by +1, and the failure event is the attacker's chain being extended by one block, reducing the gap by -1. ... The probability of an attacker catching up from a given deficit is analogous to a Gambler's Ruin problem. ...

p = probability an honest node finds the next block q = probability the attacker finds the next block qz = probability the attacker will ever catch up from z blocks behind

Given our assumption that p > q, the probability drops exponentially as the number of blocks the attacker has to catch up with increases. With the odds against him, if he doesn't make a lucky lunge forward early on, his chances become vanishingly small as he falls further behind ... the attacker's potential progress will be a Poisson distribution ... To get the probability the attacker could still catch up now, we multiply the Poisson density for each amount of progress he could have made by the probability he could catch up from that point.

Converting to C code..

include <math.h>
double AttackerSuccessProbability(double q, int z)
{
    double p = 1.0 - q;
    double lambda = z * (q / p);
    double sum = 1.0;
    int i, k;
    for (k = 0; k <= z; k++)
    {
        double poisson = exp(-lambda);
        for (i = 1; i <= k; i++)
            poisson *= lambda / i;
        sum -= poisson * (1 - pow(q / p, z - k));
    }
    return sum;
}

Running some results, we can see the probability drop off exponentially with z. "

Answer 3

Many people misquote Satoshi paper and assume 6 is some value of significance.

From Satoshi paper to be 99.9% sure that an attacker can't reverse a transaction it would require an increasing number of blocks.

http://bitcoin.org/bitcoin.pdf

P < 0.001
q=0.10   z=5
q=0.15   z=8
q=0.20   z=11
q=0.25   z=15
q=0.30   z=24
q=0.35   z=41
q=0.40   z=89
q=0.45   z=340

p is the chance of attacker eventually getting longer chain and reversing a transaction (0.1% in this case). q is the % of the hashing power the attacker controls. z is the number of blocks to put the risk of a reversal below p (0.1%).

So you can see if the attacker has a small % of the hashing power 6 blocks is sufficient. Remember 10% of the network at the time of writing is ~100GH/s. However if the attacker had greater % of hashing power it would take increasingly longer to be sure a transaction can't be reversed.

If the attacker has q of >50% ("the 51% attack") and unlimited time then the attacker essentially has 100% control over the network because eventually the attacker will have the longer chain.

Answer 4

With more confirmations probability of making a successful double-spend decrease. While it is possible to perform a double-spend with less than 51% of hashing power it requires one to be luckier than the rest of the miners, ie. solve blocks faster than others. This will go on forever (to be correct: it is very unlikely) so the attacker will not be able to fork the whole chain. With pools until very recently controlling 30-40% of total hashing power the 6-confirmation rule would not have been safe if the pool operator had decided to commit a malignant act.