[Cryptography] Standards Trolls: Re: Bitcoin is a disaster.

[Jerry Leichter]

> 
>> I'm not sure how I can be more clear - if a system has no central control (distributed, federated or otherwise), then there is nothing that can stop it from having two or more partitions that stay partitioned forever.
> 
> Parts of the system connected with other parts can share lists of connected parts, and authorise them - if you don't get an authorisation including xyz then you know the system has been partitioned.
But how would abc know that xyz is "supposed to be part of the system"?  Because "everyone agreed"?  But of course if the system was partitioned before xyz joined one partition, everyone in the other would agree that xyz was not in - so would not miss it.

> If the system is densely connected then it can be impossible to partition part of the system and not have a part of it say "hey the system was 200 nodes big yesterday, how come it's only 10 nodes today?"

Or maybe that's legitimate - a whole bunch of nodes dropped out?

If shrinking from 200 to 10 seems unlikely - how about 200 to 100?  If you allow the system to proceed, you now could have two 100-member partitions.  If you decide to block because the drop is "too large," both partitions - the entire system - are/is down until the two reconnect.

Any algorithm that depends on agreement needs to know ahead of time who counts as part of the agreement.  You can come up with ad hoc principles - "a group is legitimate only if node N is part of it"; "a group is legitimate only if it contains at least 51% of the members who were part of it the last time we had an agreement" - but all of these either allow partitioned operation in some cases, or fail to allow anyone to proceed in others.

BTW, the "node N must be part of any legitimate group" does not really imply centralization - and was used in the original VAXcluster mechanism.  The VAXcluster mechanism require more than half of all nodes that had ever been part of a cluster and had not explicitly announced they were exiting from the set to be present.  This obviously prevent "split brain" partitioned operation; and it obviously could lead to cases in which no cluster could be formed if either enough nodes were down or the partitioning was into multiple too-small partitions.  But an interesting case occurred for a two-node cluster.  If either node was down, the other was blocked, since it alone wasn't a majority.  So there was a hack:  A VAXcluster had access to shared disks.  You could choose a disk to be a "virtual member" of the cluster.  That just meant that when there was an active cluster, a node trying to form a cluster tried to record its identity in a file on the disk.  If it succeeded, it counted as a member of the cluster, giving the node connected a majority.

                                                        -- Jerry