<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 19, 2016 at 12:05 PM, Phillip Hallam-Baker <span dir="ltr"><<a href="mailto:phill@hallambaker.com" target="_blank">phill@hallambaker.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div style="font-size:small"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 18, 2016 at 1:44 PM, Peter Todd <span dir="ltr"><<a href="mailto:pete@petertodd.org" target="_blank">pete@petertodd.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span>On Thu, Aug 18, 2016 at 01:29:11AM -0400, Jerry Leichter wrote:<br>
> There are plenty of useless (both to theory and to practice) theoretical results; in fact, the vast majority of published theory papers probably include just such results! And there are plenty of useful but not very deep practical results. But trying to argue that Bitcoin "solved this problem the theory people couldn't solve" is just silly.<br>
> -- Jerry<br>
<br>
</span>Note that Bitcoin - specifically proof-of-work - does solve a problem that<br>
signature-based approaches can't: even if the people building consensus in<br>
Bitcoin (miners) all conspire to change history, it's provably expensive for<br>
them to rewrite history because they have to re-do all the proof-of-work.<br>
That's not true in signature based consensus, as forging a signature is free.<br>
<div><div><br></div></div></blockquote><div><br></div><div><div style="font-size:small;display:inline">I disagree. What gives robustness to the blockchain is the use of linked timestamps, not the proof of work part.</div></div><div><div style="font-size:small;display:inline"><br></div></div></div></div></div></blockquote><div>Proof of work is kind of important for deterring denial of service and sybil attacks.<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><div style="font-size:small;display:inline"></div></div><div><div style="font-size:small;display:inline">Whenever dealing with claims about blockchain, we have to analyze two separate systems:</div></div><div><div style="font-size:small;display:inline"><br></div></div><div><div style="font-size:small;display:inline">1) The ideal blockchain deployment that gives perfect security</div></div><div><div style="font-size:small;display:inline">2) The actually deployed blockchain that has any number of kludges to make it work.</div></div><div><div style="font-size:small;display:inline"><br></div></div><div><div style="font-size:small">Yes, in theory the blockchain is determined by the longest chain. In practice, it is not. There is a consensus among the users that once the blockchain has advanced n blocks it is not going to be rewritten. And that consensus is in fact essential to making BitCoin marginally practical as a value transfer scheme.</div></div></div></div></div></blockquote><div><br></div><div>Kind of; the longest blockchain isn't important - the blockchain with the most cumulative proof of work is considered the correct chain. FYI, the "c" in "Bitcoin" is never capitalized.<br> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><div style="font-size:small"><br></div><div style="font-size:small">Of course, I can't propose a scheme that is more robust than the ideal Bitcoin deployment in which all operational practicalities are ignored. But I have built real world PKIs that have endured a lot longer than BitCoin and I am pretty sure that I can provide a scheme that at least matches BitCoin for security without proof of work.</div><div style="font-size:small"><br></div><div style="font-size:small">Let us say for the sake of argument that in the near future there will be 100 OpenPGP KeyServers that operate in a manner similar to today's servers based on Brian LaMachias' MIT server with two changes:</div><div style="font-size:small"><br></div><div style="font-size:small">1) Every key server maintains a link timestamp of all data submitted (keys, signatures, etc.)</div><div style="font-size:small"><br></div><div style="font-size:small">2) Every hour, each server cross-timestamps their current timestamp value with at least ten other servers chosen at random</div><div style="font-size:small"><br></div><div style="font-size:small">Let us further assume that I can establish a userbase of a million users. Which I think is actually quite plausible if I can persuade the S/MIME folk to use the infrastructure as well as the OpenPGP folk.</div><div style="font-size:small"><br></div><div style="font-size:small">To verify a timestamp value, a verifier checks the timestamp chain of five or so randomly chosen servers.</div></div></div></div></div></blockquote><div><br></div><div>Sure; let's say for the sake of argument that I decide to run 10,000 OpenPGP KeyServers and sybil attack your network. It sounds like I'd be able to falsify data with a high rate of success. The numbers you choose are likely irrelevant; I suspect that any such system would inevitably turn into a form of "proof of work" as described by Paul Sztorc: <span style="font-weight:400"><a href="http://www.truthcoin.info/blog/pow-cheapest/">http://www.truthcoin.info/blog/pow-cheapest/</a><br></span><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><div style="font-size:small"><br></div><div style="font-size:small"><br></div></div></div><div style="font-size:small">The metric I use for evaluating the security of a PKI is a time based work factor priced in dollars. Obtaining bogus Domain Validated certificates in quantity in the WebPKI has a certain cost, lets say $500, an EV certificate has a much higher cost, about $5000. The cost values here are not just the price of acquiring the cert, they are also the cost of covering their tracks. The out of pocket cost of obtaining a single bogus cert is much lower because it is very unlikely that is going to be detected. But obtaining large numbers without establishing a pattern is hard.</div><div style="font-size:small"><br></div><div style="font-size:small">So how does BitCoin fare? well the cost of mining 24 hours of bitcoins is large but its less than a million dollars. </div></div></div></blockquote><div><br></div><div>From one perspective, I suppose, though on the other hand you can't just take a million dollars and buy a day's worth of hashing power - most of the existing hashpower isn't for sale. <span style="font-weight:400">To purchase enough new hashing power to own 50% of the Bitcoin network (</span><span style="font-weight:400">1,487,398</span><span style="font-weight:400"> TH/S) would cost approximately </span><span style="font-weight:400">114,415 Antminer S9 (13 TH/S) units at $2,500, or </span><strong>$286m</strong><span style="font-weight:400"><strong> in hardware costs </strong>and </span><span style="font-weight:400">1.4 KW * 114,415 * $0.08 KW/H, or </span><b>$12,815</b><span style="font-weight:400"><span style="font-weight:400"><strong> an hour in electricity costs</strong>. Except for the small fact that there aren't that many S9 units available for purchase either...<br></span></span></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div style="font-size:small"><br></div><div style="font-size:small">The work factor of my scheme is rather higher because in order to backdate the timestamp by one hour without detection, the attacker has to compromise ten servers and every user that has recorded the timestamp values. To go back 6 hours without detection, the attacker has to compromise all the servers. To have a chance of fooling someone in a detectable fashion it is necessary to compromise more than half.</div><div style="font-size:small"><br></div><div style="font-size:small">While it is certainly conceivable that someone might be able to compromise 100 independently operated servers at the same time, the cost of doing so is a heck of a lot more than mining 6 hours worth of bitcoin.</div><div style="font-size:small"><br></div></div></div></blockquote><div> </div><div>It's unclear if you're talking about a permissionless network where anyone can run a validator or a permissioned network with a predetermined trusted federation of validators. If it's the latter then we're talking about a completely different security model than Bitcoin.<br> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div style="font-size:small"></div><div style="font-size:small"><br></div><div style="font-size:small">This approach is not theoretical either, it is my design for phase 2 of the Mathematical Mesh, the Meta-Mesh. I have to finish part 1 first of course though.</div><div style="font-size:small"><br></div><div style="font-size:small">Ben Laurie has proposed similar ideas in his critique of BitCoin but I think I came to this independently.</div></div></div>
<br>______________________________<wbr>_________________<br>
The cryptography mailing list<br>
<a href="mailto:cryptography@metzdowd.com">cryptography@metzdowd.com</a><br>
<a href="http://www.metzdowd.com/mailman/listinfo/cryptography" rel="noreferrer" target="_blank">http://www.metzdowd.com/<wbr>mailman/listinfo/cryptography</a><br></blockquote></div><br></div></div>