MIME-Version: 1.0
References: <42cd5ffd-63e8-b738-c4ea-13d0699b1268@purse.io>
	<CAE-z3OV_LL+Jww3e=gO6t=02VW7m9PK+8EaYoEVLy9NKNMiSaQ@mail.gmail.com>
	<e9c5e519-ea8a-f0e2-d8fb-c955b5c2de40@purse.io>
	<CAE-z3OXyTc0aoJJVNLS5MReE7+Nhckyrjf22+yCSjXF8=bNbXQ@mail.gmail.com>
	<H_Yq1W3SffFweLPPXiUiA4EeU2yU7c8LVcqw5AbajovWTWMt5hKQARKglEQwCjPpXvjiBfvmTnaXJwivkGkT8BDha8k303DNbFB-ECes0d4=@protonmail.com>
In-Reply-To: <H_Yq1W3SffFweLPPXiUiA4EeU2yU7c8LVcqw5AbajovWTWMt5hKQARKglEQwCjPpXvjiBfvmTnaXJwivkGkT8BDha8k303DNbFB-ECes0d4=@protonmail.com>
From: Tier Nolan <tier.nolan@gmail.com>
Date: Sat, 12 Oct 2019 21:46:40 +0100
Message-ID: <CAE-z3OVqU5n8H9vKj9Pn7k80guMTsxt_CkN9qwpfCK8HB4PDgQ@mail.gmail.com>
To: =?UTF-8?Q?Joachim_Str=C3=B6mbergson?= <joachimstr@protonmail.com>
Content-Type: multipart/alternative; boundary="00000000000074b94b0594bcbd70"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Chain width expansion
Precedence: list

--00000000000074b94b0594bcbd70
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sat, Oct 12, 2019 at 6:56 PM Joachim Str=C3=B6mbergson <
joachimstr@protonmail.com> wrote:

> I like the backwards syncing idea. First you provide proof of your best
> block height via coinbase, then sync backwards. It solves lots of related
> problems. You know how much you can expect from the given peer.
>

It shows you which nodes are on the same chain too.

If you have 8 peers and you ask the 8 of them for their 8 best, then they
should all agree on most of them.

You can then ask each of the 8 to start sending you headers backwards from
one of the 8 seeds.

They will all roughly split the chain into 8 equal pieces, though the split
will be based on work rather than header height.

If there is disagreement, you can give priority to the node(s) with the
lowest headers until they have completed their download.

It requires a network protocol change to allow reverse block downloads
though (and messages to indicate lowest headers etc.)

On different note, one of the problems that I haven't seen mentioned here
> yet is the timewarp attack. It is relevant to some of the proposed
> solutions. It should be possible, IIRC, for a malicious node to generate
> much longer chain with superslow timestamp increase (~5 blocks in 1 secon=
d)
> without increasing difficulty (i.e. staying at min. diff.). This could
> produce chain that is ~2500 times longer than main chain without having
> multiple branches.
>

That is a good point.  It answers my question about formula for maximum
number of blocks.

5 * 60 * 60 * 24 * 365 =3D 157,680,000

That's around 150 million blocks per year at that rate.

I assume the 5 per second limit is that it is greater that the median of
the last 11 rather than greater or equal?

The timewarp bug can be fixed by a basic soft fork.  You just need to limit
the maximum difference between the timestamp for the first header in a
period and the last header in the previous period.

An alternative would be to soft fork in a maximum block rate.  In addition
to the current rules, you could limit it to a maximum of 1 block every 2
mins.  That rule shouldn't activate normally.

   block.height <=3D (block.timestamp - genesis.timestamp) / (2 mins)

It could have some weird incentives if it actually activated though.
Miners would have to shutdown mining if they were finding blocks to fast.

--00000000000074b94b0594bcbd70
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail=
_attr">On Sat, Oct 12, 2019 at 6:56 PM Joachim Str=C3=B6mbergson &lt;<a hre=
f=3D"mailto:joachimstr@protonmail.com">joachimstr@protonmail.com</a>&gt; wr=
ote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px=
 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>I like=
 the backwards syncing idea. First you provide proof of your best block hei=
ght via coinbase, then sync backwards. It solves lots of related problems. =
You know how much you can expect from the given peer.<br></div></blockquote=
><div><br></div><div>It shows you which nodes are on the same chain too.</d=
iv><div><br></div><div>If you have 8 peers and you ask the 8 of them for th=
eir 8 best, then they should all agree on most of them.</div><div><br></div=
><div>You can then ask each of the 8 to start sending you headers backwards=
 from one of the 8 seeds.</div><div><br></div><div>They will all roughly sp=
lit the chain into 8 equal pieces, though the split will be based on work r=
ather than header height.</div><div><br></div><div>If there is disagreement=
, you can give priority to the node(s) with the lowest headers until they h=
ave completed their download.</div><div><br></div><div>It requires a networ=
k protocol change to allow reverse block downloads though (and messages to =
indicate lowest headers etc.)<br></div><div><br></div><blockquote class=3D"=
gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(20=
4,204,204);padding-left:1ex"><div>On different note, one of the problems th=
at I haven&#39;t seen mentioned here yet is the timewarp attack. It is rele=
vant to some of the proposed solutions. It should be possible, IIRC, for a =
malicious node to generate much longer chain with superslow timestamp incre=
ase (~5 blocks in 1 second) without increasing difficulty (i.e. staying at =
min. diff.). This could produce chain that is ~2500 times longer than main =
chain without having multiple branches. <br></div></blockquote><div><br></d=
iv><div>That is a good point.=C2=A0 It answers my question about formula fo=
r maximum number of blocks.</div><div><br></div><div>5 * 60 * 60 * 24 * 365=
 =3D 157,680,000</div><div><br></div><div>That&#39;s around 150 million blo=
cks per year at that rate.</div><div><br></div><div>I assume the 5 per seco=
nd limit is that it is greater that the median of the last 11 rather than g=
reater or equal?</div><div><br></div><div>The timewarp bug can be fixed by =
a basic soft fork.=C2=A0 You just need to limit the maximum difference betw=
een the timestamp for the first header in a period and the last header in t=
he previous period.</div><div><br></div><div>An alternative would be to sof=
t fork in a maximum block rate.=C2=A0 In addition to the current rules, you=
 could limit it to a maximum of 1 block every 2 mins.=C2=A0 That rule shoul=
dn&#39;t activate normally.<br></div><div><br></div><div>=C2=A0=C2=A0 block=
.height &lt;=3D (block.timestamp - genesis.timestamp) / (2 mins) <br></div>=
<div><br></div><div>It could have some weird incentives if it actually acti=
vated though.=C2=A0 Miners would have to shutdown mining if they were findi=
ng blocks to fast.<br></div></div></div>

--00000000000074b94b0594bcbd70--