Can you get the longest chain by keeping a constant low difficulty?

Question

I'm struggling with this question that should be easy to answer.

If the truth is the longest chain, what if I redo all the work from Block 1 until I have the longest chain by keeping a constant low difficulty? Then I could produce tons of blocks and just modify the timestamps to keep a constant difficulty. I should be able to generate a longer chain than the actual height.

I am aware that I am missing an important point. What protections are in place against this process? Or my math is broken?

I hope I have expressed my thoughts well Thank you in advance for your answers

Answer 1

As Mike and Antoine already explained, we pick the best chain by total accumulated work, not by height, where the work is counted per the blocks' difficulty. However, the original release of Bitcoin did actually use the height to pick the best chain, which was replaced with "most work" after people noticed this attack surface just like you did.

You cannot redo the work from block 1, because Bitcoin Core commits to a series of checkpoints that hard-code specific block hashes at specific heights. The youngest is at height 295,000 which is buried some eight years now. This protects against new nodes falling for extremely low-difficulty fake chains, even though the difficulty is about 5,000× higher today than that of the last checkpoint block.

Further, some years ago, Bitcoin Core introduced header-first synchronization: before Bitcoin Core will request any single block, it'll request the whole header chain from one peer (up to that peer's best chain tip). Since the header is sufficient to determine whether a block passes the difficulty requirement, a new node can use the less than 60 MB header chain to see whether what it's been given passes has more work than a sanity parameter called minChainWork. The node will only start requesting blocks from peers after it has received a header chain whose cumulative work exceeds minChainWork by two weeks worth of work. So, for an attacker to get you to even download a single block, their chain has to exceed a total work within a magnitude of Bitcoin's total work.

Answer 2

What matters is the cumulative work, not the length of the chain. A block solved at a higher difficulty will add more work than a block (or several blocks for that matter) solved at a lower difficulty.

Therefore, you can't create a low difficulty chain from the genesis and get nodes who know about the current chain to reorg to yours.

For more details, see this answer.
Also note that a block only add work based on the current difficulty, not its hash. See this answer for more on this.

Answer 3

Blocks with lower difficulty than the threshold are invalid. Also the “longest” in longest chain doesn’t refer to the number of blocks but to the cumulative difficulty.