Why is 6 is the number of confirmations that is considered secure? I haven't found any mathematical explanation or otherwise that explains why it is 6 and not 5 or 7. Is there a historical reason for 6? Is there a specific way to calculate it so 6 is just a number that was chosen?

  • Well I have a coinbase transfer that's been pending for nearly 24 hours and it has 19 confirmations. Wtf. I could've just used a credit card for all this hassle – user609926 Jan 6 at 9:43

I believe this is addressed in page 8 of Satoshi's Bitcoin paper when showing the probability of an attacker catching up.

The wiki states:

"Only 6 blocks or 1 hour is enough to make reversal computationally impractical."

The key word is "impractical".

The important sentence in Satoshi's paper is:

"Assuming the honest blocks took the average expected time per block, the attacker's potential progress will be a Poisson distribution".

So, it is not that someone couldn't create the worlds first and own a $50 million ASIC farm, so as to have the ability to overtake the blockchain from a fork six blocks prior but that doing so would be a.) a massive undertaking, b.) obvious to all and c.) terrifically unprofitable to the attacker.

  • 33
    It's also noteworthy that it's largely understood to be "6 blocks or 1 hour" whichever is greater. One of the big misconceptions we've spent a long time fighting (especially in the case of alternate blockchains) is the idea that faster confirmations change anything. A network with a one-minute block time would require 60 confirmations to be considered secure, not 6. – David Perry Sep 20 '11 at 22:38
  • 3
    That helps some, but it opens up another question. Why is it that 1 hour is expected to be enough to make reversal computationally impractical? – osmosis Sep 21 '11 at 6:46
  • 3
    There's a lot of math behind it, but in my (limited) understanding the key is the Poisson Distribution bit. The chances of a modestly armed attacker getting "lucky" and successfully double-spending without having at least 51% of the network falls along such a distribution, and 60 minutes of computing time is the point at which it is adequately unlikely that a transaction may be undone (i.e. the point where the "long tail" of the distribution begins). – David Perry Sep 21 '11 at 16:09
  • 10
    David, I'm afraid you're the one who has a misconception. The math parts which relate to the Poisson distribution and such talk about number of blocks, not time. 6 blocks is what guarantees that someone with, say, 10% of the hashrate, has a negligible chance to succeed double-spending. If each block is 1 minute then that's 6 minutes. The time (1 hour) only matters if we assume the attacker can't maintain his high hashrate for that long. – Meni Rosenfeld Nov 3 '11 at 14:30
  • 6
    @Griffin: Have a look at bitcoil.co.il/Doublespend.pdf and judge for yourself. – Meni Rosenfeld Nov 5 '13 at 15:17

Many people misquote Satoshi paper and assume 6 is some value of significance.

Satoshi's paper outlines the number of confirmations necessary to be 99.9% sure (less than 1 in 1000 chance of success) that an attacker couldn't build a longer chain to reverse the transaction.

http://bitcoin.org/bitcoin.pdf

P < 0.001
q=0.10   z=5
q=0.15   z=8
q=0.20   z=11
q=0.25   z=15
q=0.30   z=24
q=0.35   z=41
q=0.40   z=89
q=0.45   z=340

p is the chance of attacker eventually getting longer chain and reversing a transaction (0.1% in this case). q is the % of the hashing power the attacker controls. z is the number of blocks to put the risk of a reversal below p (0.1%).

So you can see if the attacker has a small % of the hashing power 6 blocks is sufficient. Remember 10% of the network at the time of writing is ~100GH/s. However if the attacker had greater % of hashing power it would take increasingly longer to be sure a transaction can't be reversed.

If the attacker has q of >50% ("the 51% attack") then given unlimited time the attacker will inevitably end up with the longest chain.

On edit: to clarify the "unlimited time" the chain with the higher hashrate will inevitably end up the longest however probability still comes into play. We can not say with 100% certainty how long it will take at best we can provide a confidence interval. If the attacker is just barely faster than the good miners (51% vs 49%) then it can take a very long time for an attacker to overcome a deficit of 6 blocks. The more the attacker dominates (i.e. 70% vs 30%) the quicker the shorter the 95% confidence interval is reached.

  • If the attacker has a q >50%, he needs not unlimited time, but only enough time to produce more hashes than those contributed to the "honest" blockchain. – Streblo Oct 16 '12 at 22:36
  • 1
    My point with unlimited time is that we don't know exactly how long it will take for an attacker to pull ahead. Even with >50% of the hashpower the attacker is still affected by luck (good or bad). The most that can be said is with a certain confidence interval. i.e. "With 95% confidence, an attacker with x% of the hashrate will have the longest chain after y blocks". At just above 50% hashrate the amount of time to have a 95% confidence is very long and even that isn't a guarantee. The chain With >50% hashrate will inevitably end up the longest but the time required is probabilistic. – DeathAndTaxes Dec 3 '13 at 17:20
  • Are these based upon test observations or an educated theory? – user5107 Dec 23 '13 at 10:18
  • 1
    It is basic probability, I would call it math more than a theory however one could observe it using a Monte Carlo simulation. – DeathAndTaxes Dec 23 '13 at 16:08
up vote 20 down vote accepted

Here are some of the relevant sections from Satoshi's paper: http://bitcoin.org/bitcoin.pdf

"11. Calculations We consider the scenario of an attacker trying to generate an alternate chain faster than the honest chain. ... The race between the honest chain and an attacker chain can be characterized as a Binomial Random Walk. The success event is the honest chain being extended by one block, increasing its lead by +1, and the failure event is the attacker's chain being extended by one block, reducing the gap by -1. ... The probability of an attacker catching up from a given deficit is analogous to a Gambler's Ruin problem. ...

p = probability an honest node finds the next block q = probability the attacker finds the next block qz = probability the attacker will ever catch up from z blocks behind

equation

Given our assumption that p > q, the probability drops exponentially as the number of blocks the attacker has to catch up with increases. With the odds against him, if he doesn't make a lucky lunge forward early on, his chances become vanishingly small as he falls further behind ... the attacker's potential progress will be a Poisson distribution ... To get the probability the attacker could still catch up now, we multiply the Poisson density for each amount of progress he could have made by the probability he could catch up from that point.

Converting to C code..

include <math.h>
double AttackerSuccessProbability(double q, int z)
{
    double p = 1.0 - q;
    double lambda = z * (q / p);
    double sum = 1.0;
    int i, k;
    for (k = 0; k <= z; k++)
    {
        double poisson = exp(-lambda);
        for (i = 1; i <= k; i++)
            poisson *= lambda / i;
        sum -= poisson * (1 - pow(q / p, z - k));
    }
    return sum;
}

Running some results, we can see the probability drop off exponentially with z. "

  • 6
    Could you summarize the relevant part? – Chris Acheson Sep 21 '11 at 20:41
  • The conclusion is that the probability of someone being able to generate blocks drops off exponentially. We know they can in fact do this if they have 51% of the network. So it seems that if someone had say 10% of the network, they could pull off a double spend sometimes with 0 confirms, and the odds of them getting 2 blocks, or 3, or more...drops off exponentially. This is how I am interpreting this, I don't understand in detail the math he solves for. Im still not seeing any rational for 6 blocks, as opposed to 4 or 8. Perhaps there is non, and this was just a nice number that was picked. – osmosis Sep 23 '11 at 3:35
  • With 30% and 6 blocks the probability of success is much higher than 1/2000, it's closer to 13% (I'm interpolating from Satoshi's results). – Meni Rosenfeld Nov 3 '11 at 20:22
  • 3
    @MeniRosenfeld Crap your right. I looked up wrong value. I am deleting my prior comment because it is factually wrong. – DeathAndTaxes Nov 4 '11 at 0:48

The figure of 6 blocks is completely arbitrary. It is based on the assumptions that the attacker will not amass more than 10% of the network hashrate, and that a negligible chance of 0.1% for successfully double-spending is acceptable.

A more detailed analysis of this is available at Analysis of Hashrate-Based Double-Spending

With more confirmations probability of making a successful double-spend decrease. While it is possible to perform a double-spend with less than 51% of hashing power it requires one to be luckier than the rest of the miners, ie. solve blocks faster than others. This will go on forever (to be correct: it is very unlikely) so the attacker will not be able to fork the whole chain. With pools until very recently controlling 30-40% of total hashing power the 6-confirmation rule would not have been safe if the pool operator had decided to commit a malignant act.

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.