Rewriting the entire blockchain: is it possible to spoof block timestamps of a privately mined chain?

Question

According to fork.lol and Pieter's bitcoin.sipa, it would currently take ~200 days for an attacker with 100% of the current hashpower to rewrite the entire btc blockchain. My question pertains to how an attack like this could actually play out:

Lets assume that 100% of the hashpower is in an attackers hands, and the btc chain has stopped progressing. The attacker points 100% of the hashpower towards mining on the genesis block, so they will generate the first 2016 blocks SUPER fast, and then the difficulty will increase by a factor of 4. This will continue until the difficulty reaches it's current levels, and after ~200 days the attacker's chain will have a higher cumulative difficulty, despite having a much lower block height.

But I don't think that is very interesting, the rest of the network will realize there is a problem well before 200 days have passed, and probably code up a solution of some sort to keep things running smoothly.

So how possible is a more covert attack? Could an attacker with a modest amount of hashpower mine a private chain, and spoof the timestamps to keep the difficulty lower than it should be? Thus allowing the creation of a 'replica' chain with a few txs changed for the attackers benefit?

This could be done while the honest chain is still operating, and the attacker would slowly catch up to the honest chain. The further along the attacker makes it, the more hash power they will need to dedicate to the attack to keep outrunning any honest miners. But if a modest amount of hashpower can privately rewrite a good chunk of the early history, it seems like the current 200 day window might actually be a slight overestimate.

Note: In this scenario, the total time to enact the attack would be longer than 200 days, but some of this time would be spent privately mining with a portion of hash power that 'won't be missed' by the network. So the rest of the network may only be able to notice that an attack is happening inside of the 200-day window.

I do not see this as a real threat, I'm more interested in understanding what is actually possible, particularly in regards to spoofing time stamps on a private chain to keep difficulty targets low.

Answer 1

Yes, an attacker could spoof the timestamps on the block and create a covert alternative history. However, this doesn't make much of a difference in this attack. The reason is that, if the attacker chooses to manipulate timestamps to increase the difficulty, then they will end up producing fewer, in count, high-difficulty blocks. On the other hand, if they choose to manipulate timestamps to lower the difficulty, then they will end up producing more, in count, low-difficulty blocks. In any case, the cumulative difficulty in the adversarial chain will be the same (both in expectation and, due to a Chernoff bound, with high probability, unless they increase difficulty tremendously).

I'm doubtful about your claim that the network will realize there's a problem. The attacker's chain will remain private until they have surpassed the current honest chain in cumulative difficulty. During covert mining, the honest parties are unaware that an attack is taking place (and the honest chain can continue growing, provided there is some non-majority honest power). The attack will only become visible when the attacker reveals the chain, when the honest parties will instantly switch to it. At that point, the attacker can perform a large double spending attack and walk away prior to the honest parties employing a patch.

One thing the attacker has to keep in mind is that the current blockchain is sometimes checkpointed, so if a client has a checkpoint, then the adversary can only reorg the chain up to that checkpoint. Furthermore, especially near the present, the block timestamps have to match the current time of the verifier computers, as this is checked by some clients, at least approximately. Other than that, this attack could work.