summaryrefslogtreecommitdiff
path: root/07/f6c00e5e60ad5974a8bda53a98fbdaa6d887fc
blob: 4e34b19de4fbbbfa2eda206ce02b07f95023e102 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
Return-Path: <jannes.faber@gmail.com>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
	[172.17.192.35])
	by mail.linuxfoundation.org (Postfix) with ESMTPS id A9535D01
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Mon, 21 Dec 2015 11:40:05 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.7.6
Received: from mail-lf0-f52.google.com (mail-lf0-f52.google.com
	[209.85.215.52])
	by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 14E51EC
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Mon, 21 Dec 2015 11:40:04 +0000 (UTC)
Received: by mail-lf0-f52.google.com with SMTP id y184so109069513lfc.1
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Mon, 21 Dec 2015 03:40:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
	h=mime-version:in-reply-to:references:from:date:message-id:subject:to
	:content-type; bh=5rBMOj9iiqcoU9lzbGkw93FSFvTJPyMHmGUMKMy4p6U=;
	b=HDz9qm/PwzUHqU6aR90fXCf4gkru1OLPpRDc7zTWWDFaKUjm/jbkjgug178L7G7HnZ
	+E+39r49XnfKma9M4cdKmNqQwWkdVps2NLcIlB9y/nxFQjd/p2xzv4j7I8EEOMnElt8O
	HDAnGQjrTsIAmLlpGLrsd03P6FYV4p3mILHsWZ+eukGA+iqomxrGVhJvW367Aq1mzv1E
	xeJ7q82VXHUfhW7K8t5luxtK77exeiOLX+I7CkZcNBUq4wsZ2VNAGHUcC2oh6lm3WD0I
	YcwU9JPVyJ+YaWgNpsf2w/jcPIXs4bDu5AvkGlqbqug6eQNTlTrZTccpVKi7dS6RycPJ
	pr0w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=1e100.net; s=20130820;
	h=x-gm-message-state:mime-version:in-reply-to:references:from:date
	:message-id:subject:to:content-type;
	bh=5rBMOj9iiqcoU9lzbGkw93FSFvTJPyMHmGUMKMy4p6U=;
	b=DEXXGOTDrDein9fiArRdUbET54tTnujUDR8Ov03M2P7etpz7iz+IftBdc3qC/BUOqi
	IGKrJ0Na8I8ui4vqV8BaV84iXC5oWiqcMGkbchnIAgw/z+CD2uZjr2Qpcn/zISVHusOj
	leLMCTNiMeG+Es1hMfy4LSnCuj4WpgtD8zXo8KPkfUhOv7gSOC0itgGsDXxYcx4rz0vo
	6qUVG9/eTDUyJhfS2lsqqJApZ3gad9wgv0cE+tDQtvbSd4j9Z50hogIFvQBe0nhXgeRM
	2ZJRbx25jJXEHBrP0xgehMhCqO+VEXOVo6R933dUZd4UKoT9fr1A5TuTaqoqtqIdCbDu
	GJGg==
X-Received: by 10.25.5.205 with SMTP id 196mr1426249lff.143.1450698001839;
	Mon, 21 Dec 2015 03:40:01 -0800 (PST)
Received: from mail-lb0-f175.google.com (mail-lb0-f175.google.com.
	[209.85.217.175]) by smtp.gmail.com with ESMTPSA id
	a18sm4953613lfb.37.2015.12.21.03.40.00
	for <bitcoin-dev@lists.linuxfoundation.org>
	(version=TLSv1/SSLv3 cipher=OTHER);
	Mon, 21 Dec 2015 03:40:00 -0800 (PST)
Received: by mail-lb0-f175.google.com with SMTP id oh2so13561211lbb.3
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Mon, 21 Dec 2015 03:40:00 -0800 (PST)
X-Gm-Message-State: ALoCoQnRGQWHj1WiUHDt2r+7dPp6v+AoF1YgqwLgvnE2PCb60j3Y7dRub2F2F/tReZ/TWnEloNjPY7JLPD4bAQgLfvny+1BL3g==
X-Received: by 10.112.134.66 with SMTP id pi2mr6073722lbb.83.1450698000431;
	Mon, 21 Dec 2015 03:40:00 -0800 (PST)
MIME-Version: 1.0
Received: by 10.112.157.199 with HTTP; Mon, 21 Dec 2015 03:39:40 -0800 (PST)
In-Reply-To: <CAPkFh0t-+WhZYVLyT_auLa87zAATNOH=CpU4S5H=n6S1wmZ-oQ@mail.gmail.com>
References: <20151219184240.GB12893@muck>
	<CAAcC9yvh2ma2dFhNDEKs7vfXyQF9L+T0YtRvOsJ15AbfVti=cw@mail.gmail.com>
	<219f125cee6ca68fd27016642e38fdf1@xbt.hk>
	<CAAcC9ys_t7X0WpQ8W3577M8GLiA5sPV2F1BJ9qZbnMkE-1j3+Q@mail.gmail.com>
	<aff8da46a69bdd7ef92ca87725866a5c@xbt.hk>
	<CAPkFh0vNECi1OmBwki+8NNAQbe6EG2FEE4RR5z=kYVLLDFHUXg@mail.gmail.com>
	<20151220132842.GA25481@muck>
	<CAPkFh0t-+WhZYVLyT_auLa87zAATNOH=CpU4S5H=n6S1wmZ-oQ@mail.gmail.com>
From: Jannes Faber <jannes.faber@gmail.com>
Date: Mon, 21 Dec 2015 12:39:40 +0100
X-Gmail-Original-Message-ID: <CABeL=0jgv3G8qx6wM+ZfwN154qhQY-GJdXnABc-iWL=YDNmhag@mail.gmail.com>
Message-ID: <CABeL=0jgv3G8qx6wM+ZfwN154qhQY-GJdXnABc-iWL=YDNmhag@mail.gmail.com>
To: Bitcoin Dev <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary=047d7b3a8bf0fe1c57052766f2db
X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_LOW
	autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
	smtp1.linux-foundation.org
X-Mailman-Approved-At: Mon, 21 Dec 2015 13:41:41 +0000
Subject: Re: [bitcoin-dev] We need to fix the block withholding attack
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Development Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Dec 2015 11:40:05 -0000

--047d7b3a8bf0fe1c57052766f2db
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

If you're saying a block withholding attack is a nice weapon to have to
dissuade large pools, isn't that easily defeated by large pools simply
masquerading as multiple small pools? As, for all we know, ghash may have
done?

If you don't know who to attack there's no point in having the weapon.
While that weapon is still dangerous in the hands of others that are
indiscriminate, like the solo miners example of Peter Todd.

Sorry if i misunderstood your point.

--
Jannes

On 20 December 2015 at 18:00, Emin G=C3=BCn Sirer <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> On Sun, Dec 20, 2015 at 8:28 AM, Peter Todd <pete@petertodd.org> wrote:
>
>> There are a number of techniques that can be used to detect block
>> withholding attacks that you are not aware of. These techniques usually
>> have the characteristic that if known they can be avoided, so obviously
>> those who know about them are highly reluctant to reveal what exactly
>> they are. I personally know about some of them and have been asked to
>> keep that information secret, which I will.
>>
>
> Indeed, there are lots of weak measures that one could employ against
> an uninformed attacker. As I mentioned before, these are unlikely to be
> effective against a savvy attacker, and this is a good thing.
>
>
>> In the context of KYC, this techniques would likely hold up in court,
>> which means that if this stuff becomes a more serious problem it's
>> perfectly viable for large, well-resourced, pools to prevent block
>> withholding attacks, in part by removing anonymity of hashing power.
>> This would not be a positive development for the ecosystem.
>>
>
> KYC has a particular financial-regulation connotation in Bitcoin circles,
> of which I'm sure you're aware, and which you're using as a spectre.
> You don't mean government-regulated-KYC a la FINCEN and Bitcoin
> exchanges like Coinbase, you are just referring to a pool operator
> demanding to know that its customer is not coming from its competitors'
> data centers.
>
> And your prediction doesn't seem well-motivated or properly justified.
> There are tons of conditionals in your prediction, starting with the
> premise
> that every single open pool would implement some notion of identity
> checking. I don't believe that will happen. Instead, we will have the
> bigger
> pools become more suspicious of signing up new hash power, which is a
> good thing. And we will have small groups of people who have some reason
> for trusting each other (e.g. they know each other from IRC, conferences,
> etc) band together into small pools. These are fantastic outcomes for
> decentralization.
>
> Secondly, DRM tech can also easily be used to prevent block withholding
>> attacks by attesting to the honest of the hashing power. This is being
>> discussed in the industry, and again, this isn't a positive development
>> for the ecosystem.
>>
>
> DRM is a terrible application. Once again, I see that you're trying to us=
e
> those
> three letters as a spectre as well, knowing that most people hate DRM, bu=
t
> keep in mind that DRM is just an application -- it's like pointing to
> Adobe Flash
> to taint all browser plugins.
>
> The tech behind DRM is called "attestation," and it provides a technical
> capability not possible by any other means. In essence, attestation can
> ensure that
> a remote node is indeed running the code that it purports to be running.
> Since
> most problems in computer security and distributed systems stem from not
> knowing what protocol the attacker is going to follow, attestation is the
> only
> technology we have that lets us step around this limitation.
>
> It can ensure, for instance,
>   - that a node purporting to be Bitcoin Core (vLatest) is indeed running
> an
> unadulterated, latest version of Bitcoin Core
>   - that a node claiming that it does not harvest IP addresses from SPV
> clients indeed does not harvest IP addresses.
>   - that a cloud hashing outfit that rented out X terahashes to a user di=
d
> indeed rent out X terahashes to that particular user,
>   - that a miner operating on behalf of some pool P will not misbehave an=
d
> discard perfectly good blocks
> and so forth. All of these would be great for the ecosystem. Just getting
> rid
> of the cloudhashing scams would put an end to a lot of heartache.
>
> > Keep in mind that when an open pool gets big, like GHash did and
>> > two other pools did before them, the only thing at our disposal used
>> > to be to yell at people about centralization until they left the big
>> > pools and reformed into smaller groups. Not only was such yelling
>> > kind of desperate looking, it wasn't incredibly effective, either.
>> > We had no protocol mechanisms that put pressure on big pools to
>> > stop signing up people. Ittay's discovery changed that: pools that
>> > get to be very big by indiscriminately signing up miners are likely to
>> > be infiltrated and their profitability will drop. And Peter's post is
>> > evidence that this is, indeed, happening as predicted. This is a
>> > good outcome, it puts pressure on the big pools to not grow.
>>
>> GHash.io was not a pure pool - they owned and operated a significant
>> amount of physical hashing power, and it's not at all clear that their %
>> of the network actually went down following that 51% debacle.
>>
>
> Right, it's not clear at all that yelling at people has much effect. As
> much
> fun as I had going to that meeting with GHash in London to ask them to
> back down off of the 51% boundary, I am pretty sure that yelling at large
> open pools will not scale. We needed better mechanisms for keeping pools
> in check.
>
> And Miner's Dilemma (MD) attacks are clearly quite effective. This is a
> time when we should count our blessings, not work actively to render
> them inoperable.
>
> Currently a significant % of the hashing power - possibly a majority -
>> is in the form of large hashing installations whose owners individually,
>> and definitely in trusting groups, have enough hashing power to solo
>> mine. Eyal's results indicate those miners have incentives to attack
>> pools, and additionally they have the incentive of killing off pools to
>> make it difficult for new competition to get established, yet they
>> themselves are not vulnerable to that attack.
>>
>
> There are indeed solo miners out there who can attack the big open
> pools. The loss of the biggest open pools would not be a bad outcome.
> Pools >25% pose a danger, and the home miner doesn't need a pool
> >25% for protection against variance.
>
> > Peter, you allude to a specific suggestion from Luke-Jr. Can you
>> > please describe what it is?
>>
>> Basically you have the pool pick a secret k for each share, and commit
>> to H(k) in the share. Additionally the share commits to a target divider
>> D. The PoW validity rule is then changed from H(block header) < T, to be
>> H(block header) < T * D && H(H(block header) + k) < max_int / D
>>
>
> Thanks, this requires a change to the Bitcoin PoW. Good luck with that!
>
> Once again, this suggestion would make the GHash-at-51% situation
> possible again. Working extra hard to re-enable those painful days
> sounds like a terrible idea.
>
> - egs
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>

--047d7b3a8bf0fe1c57052766f2db
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><p dir=3D"ltr">If you&#39;re saying a block withholding at=
tack is a nice=20
weapon to have to dissuade large pools, isn&#39;t that easily defeated by=
=20
large pools simply masquerading as multiple small pools? As, for all we=20
know, ghash may have done?</p>
<p dir=3D"ltr">If you don&#39;t know who to attack there&#39;s no point in =
having=20
the weapon. While that weapon is still dangerous in the hands of others=20
that are indiscriminate, like the solo miners example of Peter Todd.</p>
<p dir=3D"ltr">Sorry if i misunderstood your point.</p></div><div class=3D"=
gmail_extra"><br clear=3D"all"><div><div class=3D"gmail_signature">--<br>Ja=
nnes</div></div>
<br><div class=3D"gmail_quote">On 20 December 2015 at 18:00, Emin G=C3=BCn =
Sirer <span dir=3D"ltr">&lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfounda=
tion.org" target=3D"_blank">bitcoin-dev@lists.linuxfoundation.org</a>&gt;</=
span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8e=
x;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div class=
=3D"gmail_extra"><div class=3D"gmail_quote"><span class=3D"">On Sun, Dec 20=
, 2015 at 8:28 AM, Peter Todd <span dir=3D"ltr">&lt;<a href=3D"mailto:pete@=
petertodd.org" target=3D"_blank">pete@petertodd.org</a>&gt;</span> wrote:<b=
r><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:=
1px #ccc solid;padding-left:1ex">There are a number of techniques that can =
be used to detect block<br>
withholding attacks that you are not aware of. These techniques usually<br>
have the characteristic that if known they can be avoided, so obviously<br>
those who know about them are highly reluctant to reveal what exactly<br>
they are. I personally know about some of them and have been asked to<br>
keep that information secret, which I will.<br></blockquote><div><br></div>=
</span><div>Indeed, there are lots of weak measures that one could employ a=
gainst=C2=A0</div><div>an uninformed attacker. As I mentioned before, these=
 are unlikely to be</div><div>effective against a savvy attacker, and this =
is a good thing.</div><span class=3D""><div>=C2=A0</div><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex">
In the context of KYC, this techniques would likely hold up in court,<br>
which means that if this stuff becomes a more serious problem it&#39;s<br>
perfectly viable for large, well-resourced, pools to prevent block<br>
withholding attacks, in part by removing anonymity of hashing power.<br>
This would not be a positive development for the ecosystem.<br></blockquote=
><div><br></div></span><div>KYC has a particular financial-regulation conno=
tation in Bitcoin circles,=C2=A0</div><div>of which I&#39;m sure you&#39;re=
 aware, and which you&#39;re using as a spectre.=C2=A0</div><div>You don&#3=
9;t mean government-regulated-KYC a la FINCEN and Bitcoin</div><div>exchang=
es like Coinbase, you are just referring to a pool operator</div><div>deman=
ding to know that its customer is not coming from its competitors&#39;</div=
><div>data centers.</div><div><br></div><div>And your prediction doesn&#39;=
t seem well-motivated or properly justified.=C2=A0</div><div>There are tons=
 of conditionals in your prediction, starting with the premise<br></div><di=
v>that every single open pool would implement some notion of identity=C2=A0=
</div><div>checking. I don&#39;t believe that will happen. Instead, we will=
 have the bigger</div><div>pools become more suspicious of signing up new h=
ash power, which is a</div><div>good thing. And we will have small groups o=
f people who have some reason</div><div>for trusting each other (e.g. they =
know each other from IRC, conferences,=C2=A0</div><div>etc) band together i=
nto small pools. These are fantastic outcomes for</div><div>decentralizatio=
n.</div><span class=3D""><div><br></div><blockquote class=3D"gmail_quote" s=
tyle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Seco=
ndly, DRM tech can also easily be used to prevent block withholding<br>
attacks by attesting to the honest of the hashing power. This is being<br>
discussed in the industry, and again, this isn&#39;t a positive development=
<br>
for the ecosystem.<br></blockquote><div><br></div></span><div>DRM is a terr=
ible application. Once again, I see that you&#39;re trying to use those</di=
v><div>three letters as a spectre as well, knowing that most people hate DR=
M, but=C2=A0</div><div>keep in mind that DRM is just an application -- it&#=
39;s like pointing to Adobe Flash</div><div>to taint all browser plugins.</=
div><div><br></div><div>The tech behind DRM is called &quot;attestation,&qu=
ot; and it provides a technical=C2=A0</div><div>capability not possible by =
any other means. In essence, attestation can ensure that</div><div>a remote=
 node is indeed running the code that it purports to be running. Since=C2=
=A0</div><div>most problems in computer security and distributed systems st=
em from not</div><div>knowing what protocol the attacker is going to follow=
, attestation is the only=C2=A0</div><div>technology we have that lets us s=
tep around this limitation.=C2=A0</div><div><br></div><div>It can ensure, f=
or instance,=C2=A0</div><div>=C2=A0 - that a node purporting to be Bitcoin =
Core (vLatest) is indeed running an</div><div>unadulterated, latest version=
 of Bitcoin Core=C2=A0</div><div>=C2=A0 - that a node claiming that it does=
 not harvest IP addresses from SPV=C2=A0</div><div>clients indeed does not =
harvest IP addresses.</div><div>=C2=A0 - that a cloud hashing outfit that r=
ented out X terahashes to a user did=C2=A0<br></div><div>indeed rent out X =
terahashes to that particular user,=C2=A0</div><div>=C2=A0 - that a miner o=
perating on behalf of some pool P will not misbehave and</div><div>discard =
perfectly good blocks</div><div>and so forth. All of these would be great f=
or the ecosystem. Just getting rid</div><div>of the cloudhashing scams woul=
d put an end to a lot of heartache.</div><span class=3D""><div><br></div><b=
lockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px =
#ccc solid;padding-left:1ex"><span>
&gt; Keep in mind that when an open pool gets big, like GHash did and<br>
&gt; two other pools did before them, the only thing at our disposal used<b=
r>
&gt; to be to yell at people about centralization until they left the big<b=
r>
&gt; pools and reformed into smaller groups. Not only was such yelling<br>
&gt; kind of desperate looking, it wasn&#39;t incredibly effective, either.=
<br>
&gt; We had no protocol mechanisms that put pressure on big pools to<br>
&gt; stop signing up people. Ittay&#39;s discovery changed that: pools that=
<br>
&gt; get to be very big by indiscriminately signing up miners are likely to=
<br>
&gt; be infiltrated and their profitability will drop. And Peter&#39;s post=
 is<br>
&gt; evidence that this is, indeed, happening as predicted. This is a<br>
&gt; good outcome, it puts pressure on the big pools to not grow.<br>
<br>
</span>GHash.io was not a pure pool - they owned and operated a significant=
<br>
amount of physical hashing power, and it&#39;s not at all clear that their =
%<br>
of the network actually went down following that 51% debacle.<br></blockquo=
te><div><br></div></span><div>Right, it&#39;s not clear at all that yelling=
 at people has much effect. As much</div><div>fun as I had going to that me=
eting with GHash in London to ask them to</div><div>back down off of the 51=
% boundary, I am pretty sure that yelling at large</div><div>open pools wil=
l not scale. We needed better mechanisms for keeping pools</div><div>in che=
ck.</div><div><br></div><div>And Miner&#39;s Dilemma (MD) attacks are clear=
ly quite effective. This is a</div><div>time when we should count our bless=
ings, not work actively to render</div><div>them inoperable.</div><span cla=
ss=3D""><div><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 =
0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Currently a significant % of the hashing power - possibly a majority -<br>
is in the form of large hashing installations whose owners individually,<br=
>
and definitely in trusting groups, have enough hashing power to solo<br>
mine. Eyal&#39;s results indicate those miners have incentives to attack<br=
>
pools, and additionally they have the incentive of killing off pools to<br>
make it difficult for new competition to get established, yet they<br>
themselves are not vulnerable to that attack.<br></blockquote><div><br></di=
v></span><div>There are indeed solo miners out there who can attack the big=
 open</div><div>pools. The loss of the biggest open pools would not be a ba=
d outcome.</div><div>Pools &gt;25% pose a danger, and the home miner doesn&=
#39;t need a pool=C2=A0</div><div>&gt;25% for protection against variance.=
=C2=A0</div><span class=3D""><div><br></div><blockquote class=3D"gmail_quot=
e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">=
<span>
&gt; Peter, you allude to a specific suggestion from Luke-Jr. Can you<br>
&gt; please describe what it is?<br>
<br>
</span>Basically you have the pool pick a secret k for each share, and comm=
it<br>
to H(k) in the share. Additionally the share commits to a target divider<br=
>
D. The PoW validity rule is then changed from H(block header) &lt; T, to be=
<br>
H(block header) &lt; T * D &amp;&amp; H(H(block header) + k) &lt; max_int /=
 D<br></blockquote><div><br></div></span><div>Thanks, this requires a chang=
e to the Bitcoin PoW. Good luck with that!=C2=A0</div><div><br></div><div>O=
nce again, this suggestion would make the GHash-at-51% situation=C2=A0</div=
><div>possible again. Working extra hard to re-enable those painful days=C2=
=A0</div><div>sounds like a terrible idea.=C2=A0</div><div><br></div><div>-=
 egs</div><div><br></div></div></div></div>
<br>_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.=
linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
<br></blockquote></div><br></div>

--047d7b3a8bf0fe1c57052766f2db--