How does Peercoin (or other PoS) prevent timestamp forging effecting hash attempts or random minting?

Question

I understand that every second the timestamp & potential transactions is hashed.

I guess there exists a "start time" on the block chain we can't roll the clock before because transactions with timestamps already exist on the chain. But could we roll back say just a few minutes? Could this gain us anything?

Anyway, even if we can't roll back in time, could we edit the program to try as many hashes as possible every second. For example, suppose we try 100 times to hash instead of once, for a given second, we then broadcast the block. Would other nodes on the network accept the block, even though it will be a little late? Do other nodes on the network use some API to get the actual time? Surely the system must allow a fudge factor to account for the latencies?

Even if they do reject, what about this: time is 5 seconds past six, we then repeatedly try to hash the 10 second timestamp - we get 5 whole seconds to do this. If we succeed and no one else has, we can broadcast the block.

Basically, in the PoW system it's provably impossible to gain an advantage without buying more hardware - a node can tamper with code and clocks as much as they want, they won't get an advantage. It's not clear to me how PoS systems are protected, since they must rely on code integrity & clocks?

Similarly could minting be tricked? If it uses a random number generator, where does this random number come from? Can it be forged?

I'm a technical guy, so happy for fully technical explanations - no holding back! :)

Answer 1

All these possible attacks have been studied in Neucoin (Peercoin fork) white paper available here:

http://www.neucoin.org/en/whitepaper/download

Here is their conclusion on the stake grinding attack (3.3.3):

To conclude this discussion on grinding in proof-of-stake, here is a statistic for the critics who say it is “costless” mini to grind through the blockspace: if an attacker owned 10% of NeuCoin’s staked currency and had access to all of the hash power of the Bitcoin network, his odds of success in a grinding attack would be one out of ∼10⁸⁷. By the way, there are only ∼10⁸⁰ atoms in the observable universe.

These two attacks have also been described on Peercoin forum:

Time-drift: https://www.peercointalk.org/index.php?topic=2976.msg27924#msg27924

Stake-grinding: https://www.peercointalk.org/index.php?topic=2976.msg27789#msg27789

Answer 2

The general problems you are describing are inherent flaws in PoS, but you've caught onto some of the basic principles that are going to impact the security and integrity of the cryptosystem.

Anyway, even if we can't roll back in time, could we edit the program to try as many hashes as possible every second. For example, suppose we try 100 times to hash instead of once, for a given second, we then broadcast the block.

This is known as stake grinding.

The selection of the next signer in the block chain is almost always (this varies by implementation) directly or indirectly deterministic based on the previous block information. As there is nothing inherently preventing a person from resigning previous blocks as much as they like, they can continue until the head of the chain also assigns them to be the next signer of a block as well. Under this attack either one person gains a vastly inflated amount of power over the chain, or if everybody is attempting to stake grind it breaks down to a particularly inefficient proof of work system with badly described properties.

Proof of Stake altcoins generally attempt to solve this by making the signer selection RNG seed come from earlier in the chain, say a thousand blocks prior to the head, with the idea that it is impossible for someone to influence the outcome from that far back in time.

I guess there exists a "start time" on the block chain we can't roll the clock before because transactions with timestamps already exist on the chain. But could we roll back say just a few minutes? Could this gain us anything?

This is known as costless simulation.

The system again falls to the simple fact that there is nothing inherently hard about resigning blocks. Given some coins at the start of the block chain (owned, stolen, "empty" wallets purchased), in a proof of stake system an attacker can simply rebuild the entire chain to the present day with themselves as the only participant. Given the option of two chains (in this case, the attacking and main chain), a client has no way of knowing which if either they should be trusting as real.

Proof of Stake altcoins often attempt to solve this by having centralized "checkpoints" which prevent the chain from deviating, though one could argue against this system being decentralized at all. Others simply have nodes in the network refuse to reorganize to other chains after a certain amount of time, which doesn't protect new users joining the network and being presented with false chains. Ethereum PoS will attempt a "phone a friend" system, where users are prompted to contact other network participants out of band and manually confirm that they are on the same main block chain.

Section 6.4 of A Treatise on Altcoins covers these topics in a little more depth.