Hot answers tagged

39

Disclaimer: I believe this question may be primarily opinion-based and not very appropriate for this site, but there are a number of technical misunderstandings that can be clarified along with it, so I'll give it a shot. There are many nuances involved here, and I fear that a large part of them didn't reach as much of an audience as the exchange announcing ...


27

The distinction is of theoretical importance only. But if the attacker controls exactly 50%, then it's true that the attacker will eventually catch up, but he won't stay caught up: the honest population will eventually overtake his chain, and we'll be in an unstable situation where control of the "best" chain will bounce back and forth between them forever....


24

"TL;DR: Bitcoin mining is virtually immune to someone attacking it with a supercomputer, because the mining market is already flooded with supercomputers custom tailored to the job at the hardware level." (via Cort Ammon in comments) First of all, the difficulty reset happens after 2016 blocks. That's only after about 14 days if the hashrate is stable. When ...


23

The theory It is assumed that in order to forge an ECDSA signature you need to compute the private key for a given public key first (this operation is known as the "discrete logarithm" (DL), and its hardness is the basis for ECDSA's security). In order to do so, you must actually have the public key. Once you have the public key, it is assumed that ...


21

Suppose Alice wants to add a fake transaction where she receives X ammount of BTC. I understand that in order to add that transaction to the blockchain she would have to compete against all the other miners to generate the next block, which makes it improbable to happen as an individual against them. No, that isn't correct. No matter how much mining power ...


18

The issue is that you assume a majority attack is an attack that can be prevented. It is not. It is a fundamental breakdown of the security assumptions. Proof of work (PoW)'s assumption is that the majority of the hashrate will cooperate and converge on a single chain, because it is most financially advantageous thing to do. When that is no longer the case, ...


13

Is is possible that a miner modified a unconfirmed transaction (like changing the output of transaction to the miner himself) and put it into the local block, and after 10 mins the miner luckily solved the PoW, putting the block on the chain and broadcast it to others? No, because the transaction would be invalid. The vast majority of transactions contain ...


13

The Bitcoin Protocol (consensus rules) has two relevant rules for the timestamps in block headers: A node will not accept a block whose timestamp is more than two hours in the future. A node will not accept a block unless it has a timestamp greater than the median of the previous 11 blocks. In Bitcoin, we call this Median-Time-Past (MTP). As you mention ...


12

The thing to consider is, "what does the attacker have to give up in order to attack me?" If the cost of that thing is less than the reward from a successful attack, then attacking is rational from a purely economic standpoint. (Obviously, attacking someone comes with a non-economic moral cost.) A miner who controls more than half of the network hash rate,...


11

There are several groups of people that could have incentives to DDoS mining pools: Owners of other mining pools. Mining pools make profit from the blocks mined by their miners. So it would make perfect sense for them to attack other pools to encourage users to abandon the pool and perhaps find a new home at theirs. People mining at other pools, including ...


10

Yes it is possible. You already answered your own question: "This could dramatically increase the time it takes for transactions to be confirmed, as well as makes it not profitable for other miners. Granted this would only last until the difficulty is readjusted, but perhaps it could be enough to shake public confidence in the network." There are other ...


10

(adding some color) Some discussion I saw suggested that people promoting this believed they only needed to achieve >50% hashpower, which caused them to overestimate the feasibility. Reorging with only slightly over 50% would take weeks-- even months, creating massive disruption if successful, and virtually guaranteeing an effective public initiative to ...


9

The current maximum size of a block is 1 MB. Current block sizes are about half that, so the absolute worse case scenario is that the block chain grows in size twice as fast as it does now. That's not particularly scary. It's easy to create more than 1 MB of transactions every 10 minutes. If anyone does that, some transactions can't be included in blocks. ...


9

Nothing directly prevents it in Bitcoin, and indeed the attack has been demonstrated on testnet3 many times---it's the primary reason that testnet3 currently has almost three times as many blocks as Bitcoin, despite being launched several years after Bitcoin mainnet and with a something similar to[1] Bitcoin's 10-minute average block interval. Indirectly, ...


8

How to Double Spend You can double spend using Electrum quite easily. Even without duplicating your wallet, be it on the same or on 2 different machines. Btw.: Duplicating wallets is super easy with Electrum. Just go to Tools → Preferences → Transactions and check View transaction before signing. Close the settings, go to the "Send" tab, and enter the ...


8

It's not done every 14 days - it's done every 2016 blocks, which will happen in 14 days if hashpower stays the same. If hashpower goes up, then the retarget happens sooner.


7

The victim could send any "shady" or unauthorized donation back to the originating address, and the refund would be just as public as the initial donation. The process could also be automated with a custom wallet software, so that, for example, all donations above a certain amount which are not explicitly approved are automatically refunded after x days.


7

Such transactions will be subject to fees. You can read about the fee schedule here. The fees apply if the transactions send a small amount of coins, or send the same coins over and over (giving the transactions a low priority score). The fee is set at BTC 0.0001 per 1000 bytes. Thus someone who wants to spam the block chain with 10 MB will have to pay ...


7

First of all, there is no "The mempool". Every full node has an individual mempool, and as these contain no transactions that are already in blocks (confirmed transactions), by definition nodes cannot be guaranteed to have agreement about it. So, what you're looking at it blockchain.info's mempool, which may or may not be similar to that of other nodes. ...


6

Ok, I'm spoiling the fun of you working it out yourself, but I had too much fun working it out myself to not post. In order to have as many target addresses as possible, let's suppose every satoshi that will ever exist (21e6 * 100e6 = 2.1e15 or 2.1 quadrillion) were in a different address. And let's suppose someone developed an ASIC that, at the same rate ...


6

The behaviour of the mempool or orphan tx pool should not influence the validity of blocks at all. When a block comes in: main.cpp:ProcessMessage deals with processing messages, and dispatches to: main.cpp:ProcessNewBlock deals with specifically processing block messages, which stores it on disk using AcceptBlock and then calls: main.cpp:ActivateBestChain ...


6

Every valid bitcoin transaction can only be created if you have the sender's private key, public key, and the receiver's public key. You can check that the transaction is valid without having the private key, but to modify it you would need to recreate the transaction from scratch, which would only be possible if you had the sender's private key. So no, it ...


6

This is to impart the need for a higher hash rate than the rest of the (honest) miners. Mining success is probabilistic, however, so this 50% or 51% is an indication of the expected behaviour given an infinite number of attempts. Using the scenario where an attacker tries to build their own chain to eventually replace the original one: If the attacker has ...


6

Is there a specific attack or bug which asymmetric cryptography prevents during bitcoin transactions? asymmetric cryptography is not really something that was added on top of Bitcoin in order to prevent some specific attack or fix some specific bug. asymmetric cryptography is one of two fundamental foundation stones, one of the two primary building blocks ...


5

In essence, you've replicated the argument that nobody needs to worry about this problem, which we now know is false. It's because of that very belief that we have the mess we have now. One crucial detail you missed is that when spending the outputs of a prior transaction, you must specify its transaction ID in your new transaction. So there are many other ...


5

Well, the answer is two-fold: what's the chance of a 51%-attack to happen and what are the consequences if it does. What's the chance of it happening? You mention correctly that the major parties via which such an attack can be achieved, are miners. The chance that a 51%-attack is performed by a 3th party is neglectable, since the cost to achieve a mining ...


5

Block headers include a field called bits, which can be used to calculate the difficulty and hence the amount of proof-of-work in the chain. There's probably a shortcut to being able to eliminate a 100,000 longer chain, but all core does is calculate the proof-of-work present in both chains and take the one with more. Note that block headers are only 80 ...


5

I think this would be considered a time warp attack. What prevents this strategy from working is actually quite simple, as explained in https://bitcoin.stackexchange.com/a/37960/26673: Bitcoin nodes do not compare chains by their height. (Although they used to do this.) They calculate the total work in each chain (nChainWork), and compare by that. This ...


5

There are significantly more than 10k full nodes on the network. The 10k figure is simply the number of reachable nodes which listen publicly for new connections. There are many more times that amount which do not have open ports. Luke-jr publishes information about nodes his own knows about[1], suggesting there are in the order of 100k nodes. It only takes ...


5

Without asymetric cryptography, there wouldn't be information asymmetry: in other words, everyone knows exactly as much as everyone else. If everyone knows equally much, there is no way to distinguish a legitimate sender from a malicious one. More specifically, if a symmetric construction like an HMAC was used to authenticate a transaction, miners would ...


Only top voted, non community-wiki answers of a minimum length are eligible