Sure. Assume the distributed consensus protocol works as intended. This paper asks whether a global Proof-of-Work system with a fixed budget could withstand three attack scenarios. The budget is based on an estimate of the current costs of our global digital transaction networks (e.g., debit cards): $283 billion per year.
If we take our results at face value, they indicate that a PoW network as costly as today’s electronic payment systems could easily withstand attacks by a single supercomputer, and most likely defend against a very successful botnet or a social disobedience attack.
So Bitcoin would defeat all three attacks, and
under budget, too!
However, the attack model isn’t too compelling.
The only threat we consider is that it is designed to defend against: a single party gaining control over 50% of the total computation power.
No, Bitcoin is designed to withstand disruptive behavior from a minority of the network. Against a sustained majority attack, Bitcoin’s only hope is to be an unappealing target. Zooko already asked
"What Would You Do With >50% of the World's Bitcoin Mining Power?" It turns out that the sort of maneuvers that become available at this level (e.g., stubbornly blacklisting addresses) aren’t directly profitable.
Although the attacks considered in this paper are not required to be profitable, neither are they “worst-case scenarios” for Bitcoin. Hash-power alone can not harm the network, although it can penetrate our shields. To actually inflict damage on Bitcoin’s users, the attacker should use the hash-power to deliver a payload containing massive double-spends.
Here are two components I recommend for a more realistic attack model:
(Computationally Bounded Adversary): The attacker has a budget, B, for a total amount of work (i.e., hashes, hash-energy, rather than hash-power). This is the expected number of hashes needed to build a fork B blocks long. The attacker can use these hashes all at once, or spread over any amount of time.
The bounded (rather than sustained) versions of the attacks from this paper are immediately more realistic. The sentient supercomputer that mines uncooperatively eventually gets reprogrammed. After a few weeks, most of “Occupy Bitcoin” have packed up their tents and gone home. The sharks with frickin’ GPUs attached to their heads will overheat and die.
(Mining as a commodity): Think of mining as something to
purchase, rather than something to
do. For example, you could hire a mercenary mining provider to work on a header containing the transactions of your choice. You could evaluate quality-of-service by asking the mining-provider to show you blocks-that-didn’t-quite-win, in addition to the winning blocks - similar to shares in p2pool.
The point of these two assumptions is that an attacker can purchase a quick “burst” of B blocks worth of hash-energy for the same price it would cost a miner at the normal rate. In this model, the attacker might temporarily wield much more hash-power than the rest of the network. Using the same $283 billion annual mining budget from the paper, a 7-block attack would cost an expected $30 million.
What would you do if you could summon a 7-block fork on demand? Well, MtGox (and pretty much everyone else) waits for 6-blocks of confirmation before making an irreversible decision. A profitable attack target might be to deposit $33 million worth of bitcoin into MtGox, withdraw it after 6 blocks, then rewind the network and double-spend the original $30 million back out. Expected profit: $3 million (%10 return). Since the attacker has a finite budget, then any attempt at producing a fixed number of blocks has a chance of failure. Potential downside: -$B if the attacker spends the entire budget without finding a 7th block. Potential upside: up to $33 million if the 7-blocks are found much faster than expected. This is the model of “gambler’s ruin”. Attacks of this nature might be profitable in the long run, but a losing streak leads to bankruptcy.
Here’s a different worst-case scenario. Dr. Evil announces that Dec 21, 2012 shall be “Double-Spend Doomsday.” He calls upon the entire population (e.g., 10% of Facebook users?) to participate by buying gold and cash with Bitcoins and sending a message with a double-spend to Dr. Evil’s email address. At 11:59pm, he will unleash a One Billion Dollar fork (about a day’s worth of transactions) containing all the double-spends he receives - harnessing the world’s collective greed to wreak havoc. If the threat is plausible, then perhaps business will grind to a halt for that day. Mutual suspicion combined with a loss of trust in the effectiveness of the PoW shield could result in economic damage, even if the attack is not realized.
ConclusionThis paper is peculiar, since its title and stated goals are completely mismatched to the actual analysis.
The main goal of this research is to scrutinize the claim of Bitcoin proponents that a decentralized PoW-based currency charges society fewer transaction costs than a centralized electronic payment systems.
I agree with you: cutting costs is
not the main reason to use a proof-of-work system. The main reasons are to reduce risk by eliminating central points of failure and providing transparent, objective security claims.
Although this paper begrudgingly acknowledges that Bitcoin may achieve these goals, the attack models should be improved. I suggest a variation that involves bounded (rather than sustained) attacks, equal cost per block for both miners and attackers (though the attackers get their blocks as rapidly as they like), and estimating the damages caused by reordered transactions.
What’s next? At the microeconomic level, I would like to have a risk analysis model for Bitcoin transactions. What’s the optimal number of blocks to wait before giving you an ounce of gold? At the macro level, we should ask whether an attack on Bitcoin would inflict more economic damage than a similar-sized attack on an alternate system like debit cards. I’d expect these to be related, since user behavior will determine the potential damages for a given attack.
Finally, I’m glad these authors mentioned that Bitcoin may replace other systems besides (or in addition to) consumer card transactions. They omitted large transactions between governments and corporations from their model - but those seem like an ideal kind of transaction to
require Bitcoin in order to take advantage of public transparency. Bitcoin could replace the postal service for official legal correspondence - instead of a registered mailing address, you could receive subpoenas to a Bitcoin address. The mining budget grows with the more roles Bitcoin can serve. I don’t know how the attacks and risks would be affected.
