Date: Mon, 09 Sep 2019 04:14:07 +0000
To: Ruben Somsen <rsomsen@gmail.com>,
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <uVQNn9hhpqlQuS-RzrUkpClVtegMRUoyIL6ITaYfNkjd_XYyu9Fh9vdAeLguzOyOrNx5FtuHk7yyZAdivqCVR2PKzF_PsoWJlsSY9oJTF7s=@protonmail.com>
In-Reply-To: <CAPv7TjaE1wF-25R=LaOES33A78ovDAp9-waiC7n5YLJnMmNs9A@mail.gmail.com>
References: <CAPv7TjaE1wF-25R=LaOES33A78ovDAp9-waiC7n5YLJnMmNs9A@mail.gmail.com>
Feedback-ID: el4j0RWPRERue64lIQeq9Y2FP-mdB86tFqjmrJyEPR9VAtMovPEo9tvgA0CrTsSHJeeyPXqnoAu6DN-R04uJUg==:Ext:ProtonMail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] PoW fraud proofs without a soft fork
Precedence: list

Good morning Ruben,


>     One might intuitively feel that the lack of a commitment is unsafe,
>     but there seems to be no impact on security (only bandwidth). The onl=
y
>     way you can be fooled is if all peers lie to you (Sybil), causing you
>     to follow a malicious minority chain. But even full nodes (or the
>     committed version of PoW fraud proofs) can be fooled in this way if
>     they are denied access to the valid most PoW chain. If there are
>     additional security concerns I overlooked, I=E2=80=99d love to hear t=
hem.


I think it would be better to more precisely say that:

1.  In event of a sybil attack, a fullnode will stall and think the blockch=
ain has no more miners.
2.  In event of a sybil attack, an SPV, even using this style, will follow =
the false blockchain.

This has some differences when considering automated systems.

Onchain automated payment processing systems, which use a fullnode, will re=
fuse to acknowledge any incoming payments.
This will lead to noisy complaints from clients of the automated payment pr=
ocessor, but this is a good thing since it warns the automated payment proc=
essor of the possibility of this attack occurring on them.
The use of a timeout wherein if the fullnode is unable to see a new block f=
or, say, 6 hours, could be done, to warn higher-layer management systems to=
 pay attention.
While it is sometimes the case that the real network will be unable to find=
 a new block for hours at a time, this warning can be used to confirm if su=
ch an event is occurring, rather than a sybil attack targeting that fullnod=
e.

On the other hand, such a payment processing system, which uses an SPV with=
 PoW fraud proofs, will be able to at least see incoming payments, and cont=
inue to release product in exchange for payment.
Yet this is precisely a point of attack, where the automated payment proces=
sing system is sybilled and then false payments are given to the payment pr=
ocessor on the attack chain, which are double-spent on the global consensus=
 chain.
And the automated system may very well not be able to notice this.

Regards,
ZmnSCPxj