Does every nonce really have an equal chance of winning?

Question

I set out to test the claim: "Every nonce has an equal chance of winning."

Time Evolution

So, I plotted, with gnuplot, the nonce values vs. hashes for all the valid blocks in the blockchain:



^{(Also, in the last plot, you can really visualize the change in the difficulty and even see where the difficulty was decreased.)}

Histograms

It makes sense that the nonces found are skewed toward 0 because this is a selection effect: most everyone starts searching for nonces starting at 0, so the lower nonces are found first, even though there may be also higher nonces that could produce a winning block:

Why are the hashes distributed this way, though?:

2-D histogram of hashes and nonces (logarithmic color scale):

Answer 1

It's not unevenly distributed. The reason it appears that way in the graphs above is because the x-axis is plotted in logarithmic units. Here's what it looks like in linear units:

Answer 2

As you noted, the logarithmic scale skews it right, because the number of nonces within log(10, nonce) > 9 is 3 times larger than log(10, nonce) < 9

The other factor that might skew the nonces on your chart is that a pattern in the nonces on the blockchain doesn't necessarily mean that it's caused by a problem in the mining algorithm. As a trivial example, imagine if I wrote a mining program that never searched odd nonces. This wouldn't affect its mining power, but a person looking at the output might conclude that odd nonces never produced blocks.

As a more realistic example, mining clients spend more time searching low ranges of nonces than high ranges of nonces, simply because they start at 0, and reset every block. This effect becomes less pronounced over time as hashpower per mining client increases.

Answer 3

Whatever non-uniformity you see in the distribution of found nonces is because due to the fact that not every nonce has the same chance of being tried. Every tried hash, however, has exactly the same chance of winning.

Switching to a new proposed block is cheap. For example, if a 3GH/s mining chip increases the timestamp or modifies the extranonce every second, it will only ever find nonces in the range 0-3000000000.

If not every tried hash has the same chance of winning, SHA256 would be utterly broken.