<div dir="ltr"><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 18, 2016 at 1:44 PM, Peter Todd <span dir="ltr"><<a href="mailto:pete@petertodd.org" target="_blank">pete@petertodd.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Thu, Aug 18, 2016 at 01:29:11AM -0400, Jerry Leichter wrote:<br>
> There are plenty of useless (both to theory and to practice) theoretical results; in fact, the vast majority of published theory papers probably include just such results! And there are plenty of useful but not very deep practical results. But trying to argue that Bitcoin "solved this problem the theory people couldn't solve" is just silly.<br>
> -- Jerry<br>
<br>
</span>Note that Bitcoin - specifically proof-of-work - does solve a problem that<br>
signature-based approaches can't: even if the people building consensus in<br>
Bitcoin (miners) all conspire to change history, it's provably expensive for<br>
them to rewrite history because they have to re-do all the proof-of-work.<br>
That's not true in signature based consensus, as forging a signature is free.<br>
<div class="HOEnZb"><div class="h5"><br></div></div></blockquote><div><br></div><div><div class="gmail_default" style="font-size:small;display:inline">I disagree. What gives robustness to the blockchain is the use of linked timestamps, not the proof of work part.</div></div><div><div class="gmail_default" style="font-size:small;display:inline"><br></div></div><div><div class="gmail_default" style="font-size:small;display:inline">Whenever dealing with claims about blockchain, we have to analyze two separate systems:</div></div><div><div class="gmail_default" style="font-size:small;display:inline"><br></div></div><div><div class="gmail_default" style="font-size:small;display:inline">1) The ideal blockchain deployment that gives perfect security</div></div><div><div class="gmail_default" style="font-size:small;display:inline">2) The actually deployed blockchain that has any number of kludges to make it work.</div></div><div><div class="gmail_default" style="font-size:small;display:inline"><br></div></div><div><div class="gmail_default" style="font-size:small">Yes, in theory the blockchain is determined by the longest chain. In practice, it is not. There is a consensus among the users that once the blockchain has advanced n blocks it is not going to be rewritten. And that consensus is in fact essential to making BitCoin marginally practical as a value transfer scheme.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Of course, I can't propose a scheme that is more robust than the ideal Bitcoin deployment in which all operational practicalities are ignored. But I have built real world PKIs that have endured a lot longer than BitCoin and I am pretty sure that I can provide a scheme that at least matches BitCoin for security without proof of work.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Let us say for the sake of argument that in the near future there will be 100 OpenPGP KeyServers that operate in a manner similar to today's servers based on Brian LaMachias' MIT server with two changes:</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">1) Every key server maintains a link timestamp of all data submitted (keys, signatures, etc.)</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">2) Every hour, each server cross-timestamps their current timestamp value with at least ten other servers chosen at random</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Let us further assume that I can establish a userbase of a million users. Which I think is actually quite plausible if I can persuade the S/MIME folk to use the infrastructure as well as the OpenPGP folk.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">To verify a timestamp value, a verifier checks the timestamp chain of five or so randomly chosen servers.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div></div></div><div class="gmail_default" style="font-size:small">The metric I use for evaluating the security of a PKI is a time based work factor priced in dollars. Obtaining bogus Domain Validated certificates in quantity in the WebPKI has a certain cost, lets say $500, an EV certificate has a much higher cost, about $5000. The cost values here are not just the price of acquiring the cert, they are also the cost of covering their tracks. The out of pocket cost of obtaining a single bogus cert is much lower because it is very unlikely that is going to be detected. But obtaining large numbers without establishing a pattern is hard.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">So how does BitCoin fare? well the cost of mining 24 hours of bitcoins is large but its less than a million dollars. </div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">The work factor of my scheme is rather higher because in order to backdate the timestamp by one hour without detection, the attacker has to compromise ten servers and every user that has recorded the timestamp values. To go back 6 hours without detection, the attacker has to compromise all the servers. To have a chance of fooling someone in a detectable fashion it is necessary to compromise more than half.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">While it is certainly conceivable that someone might be able to compromise 100 independently operated servers at the same time, the cost of doing so is a heck of a lot more than mining 6 hours worth of bitcoin.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">This approach is not theoretical either, it is my design for phase 2 of the Mathematical Mesh, the Meta-Mesh. I have to finish part 1 first of course though.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Ben Laurie has proposed similar ideas in his critique of BitCoin but I think I came to this independently.</div></div></div>