Alan Reiner | 2 Jun 2012 17:40
Picon

Full Clients in the future - Blockchain management

Devs,

I have decided to upgrade Armory's blockchain utilities, partly out of necessity due to a poor code decision I made before I even decided I was making a client.  In an effort to avoid such mistakes again, I want to do it "right" this time around, and realize that this is a good discussion for all the devs that will have to deal with this eventually...

The part I'm having difficulty with, is the idea that in a few years from now, it just may not be feasible to hold transactions file-pointers in RAM, because even that would overwhelm standard RAM sizes.  Without any degree of blockchain compression, I see that the most general, scalable solution is probably a complicated one.

On the other hand, where this fails may be where we have already predicted that the network will have to split into "super-nodes" and "lite nodes."  In which case, this discussion is still a good one, but just directed more towards the super-nodes.  But, there may still be a point at which super-nodes don't have enough RAM to hold this data...

(1)  As for how small you can get the data:  my original idea was that the entire blockchain is stored on disk as blkXXXX.dat files.  I store all transactions as 10-byte "file-references."  10 bytes would be

    -- X in blkX.dat (2 bytes)
    -- Tx start byte (4 bytes)
    -- Tx size bytes (4 bytes)

The file-refs would be stored in a multimap indexed by the first 6 bytes of the tx-hash.  In this way, when I search the multimap, I potentially get a list of file-refs, and I might have to retrieve a couple of tx from disk before finding the right one, but it would be a good trade-off compared to storing all 32 bytes (that's assuming that multimap nodes don't have too much overhead).

But even with this, if there are 1,000,000,000 transactions in the blockchain, each node is probably 48 bytes  (16 bytes + map/container overhead), then you're talking about 48 GB to track all the data in RAM.  mmap() may help here, but I'm not sure it's the right solution

(2) What other ways are there, besides some kind of blockchain compression, to maintain a multi-terabyte blockchain, assuming that storing references to each tx would overwhelm available RAM?   Maybe that assumption isn't necessary, but I think it prepares for the worst.

Or maybe I'm too narrow in my focus.  How do other people envision this will be handled in the future.  I've heard so many vague notions of "well we could do this or that, or it wouldn't be hard to do that" but I haven't heard any serious proposals for it.  And while I believe that blockchain compression will become ubiquitous in the future, not everyone believes that, and there will undoubtedly be users/devs that want to maintain everything under all circumstances.

-Alan
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Bitcoin-development mailing list
Bitcoin-development <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bitcoin-development
Alan Reiner | 2 Jun 2012 19:15
Picon

Fwd: Re: Full Clients in the future - Blockchain management

(response from Doug forwarded below)

It's a very good point.  I have no experience with database engines.  I had assumed that in most cases, data could always be indexed in RAM, and wanted to know where to go when that's not the case.  I will look into that solution, further. 

I am very interested to solve the blockchain compression problem, and think I've got a great way that will not just compress the blockchain, but improve the network for lightweight clients.  But the idea is not fully formed yet, so I was holding off...



-------- Original Message -------- Subject: Date: From: To:
Re: [Bitcoin-development] Full Clients in the future - Blockchain management
Sat, 2 Jun 2012 12:07:44 -0500
Douglas Huff <mith <at> jrbobdobbs.org>
Alan Reiner <etotheipi <at> gmail.com>


I think you're trying to solve something a little out of scope, really. Most of the issues aren't really issues for other clients using established storage mechanisms (bdb,SQLite,etc) and they're using them precisely because this is a problem that people have been working on for decades and a poor candidate for reinvention.

If you really look at what you're proposing it's fundamentally how bdb operates except your indexing format is usage domain specific and you're in charge of all the resource management semantics. While at the same time you'll be missing many of the newer features that make working with/recovering/diagnosing issues in the storage layer easier. 

If you're really wanting to talk about pruning methods to prevent the massive amount of duplicated; but no longer pertinent, data that's a different story and please continue. :)

-- 
Douglas Huff

On Jun 2, 2012, at 10:40, Alan Reiner <etotheipi <at> gmail.com> wrote:

Devs,

I have decided to upgrade Armory's blockchain utilities, partly out of necessity due to a poor code decision I made before I even decided I was making a client.  In an effort to avoid such mistakes again, I want to do it "right" this time around, and realize that this is a good discussion for all the devs that will have to deal with this eventually...

The part I'm having difficulty with, is the idea that in a few years from now, it just may not be feasible to hold transactions file-pointers in RAM, because even that would overwhelm standard RAM sizes.  Without any degree of blockchain compression, I see that the most general, scalable solution is probably a complicated one.

On the other hand, where this fails may be where we have already predicted that the network will have to split into "super-nodes" and "lite nodes."  In which case, this discussion is still a good one, but just directed more towards the super-nodes.  But, there may still be a point at which super-nodes don't have enough RAM to hold this data...

(1)  As for how small you can get the data:  my original idea was that the entire blockchain is stored on disk as blkXXXX.dat files.  I store all transactions as 10-byte "file-references."  10 bytes would be

    -- X in blkX.dat (2 bytes)
    -- Tx start byte (4 bytes)
    -- Tx size bytes (4 bytes)

The file-refs would be stored in a multimap indexed by the first 6 bytes of the tx-hash.  In this way, when I search the multimap, I potentially get a list of file-refs, and I might have to retrieve a couple of tx from disk before finding the right one, but it would be a good trade-off compared to storing all 32 bytes (that's assuming that multimap nodes don't have too much overhead).

But even with this, if there are 1,000,000,000 transactions in the blockchain, each node is probably 48 bytes  (16 bytes + map/container overhead), then you're talking about 48 GB to track all the data in RAM.  mmap() may help here, but I'm not sure it's the right solution

(2) What other ways are there, besides some kind of blockchain compression, to maintain a multi-terabyte blockchain, assuming that storing references to each tx would overwhelm available RAM?   Maybe that assumption isn't necessary, but I think it prepares for the worst.

Or maybe I'm too narrow in my focus.  How do other people envision this will be handled in the future.  I've heard so many vague notions of "well we could do this or that, or it wouldn't be hard to do that" but I haven't heard any serious proposals for it.  And while I believe that blockchain compression will become ubiquitous in the future, not everyone believes that, and there will undoubtedly be users/devs that want to maintain everything under all circumstances.

-Alan
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Bitcoin-development mailing list
Bitcoin-development <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bitcoin-development
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Bitcoin-development mailing list
Bitcoin-development <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bitcoin-development
Luke-Jr | 3 Jun 2012 02:52

Defeating the block withholding attack

Analysis, comments, constructive criticism, etc welcome for the following:

==Background==
At present, an attacker can harm a pool by intentionally NOT submitting shares 
that are also valid blocks. All pools are vulnerable to this attack, whether 
centralized or decentralized and regardless of reward system used. The 
attack's effectiveness is proportional to ratio of the attacker's hashrate to 
the rest of the pool.

There are obvious solutions that can be used to defeat this attack on 
centralized pools. For example, including a secret in the coinbase transaction 
that is accepted by the network as a partial preimage proof-of-work. All these 
solutions require changes to Bitcoin's proof-of-work acceptance terms, and 
since centralized pools can be harmful to the network's security, these rule 
changes are not likely to gain enough acceptance among the greater Bitcoin 
community.

==Proposed Solution==
Please comment on the viability of this new proof-of-work algorithm, which I 
think should be viable for even decentralized pools:

Blocks are accepted at a lower difficulty N (choosable by the pool; eg, the 
share difficulty) iff they are submitted with a candidate for the next block 
and SHA256(SHA256(NewBlockHash + NextBlockCandidateHash)) meets difficulty M.
The relationship between M and N must be comparable to the normal network 
difficulty; details on the specifics of this can be figured out later, ideally 
by someone more qualified than me. M and N must be chosen prior to searching 
for the block: it should be safe to steal some always-zero bytes from the 
prevblock header for this.

This algorithm should guarantee that every share has an equal chance of being 
a valid block at the time it is found, and that which ones are actually blocks 
cannot be known until the subsequent block is found. Thus, attackers have no 
way to identify which shares to withhold even while they have full knowledge 
of the shares/blocks themselves.

==Backward Compatibility==
Obviously, this change creates a hard-fork in the blockchain. I propose that 
if it solves the block withholding risk, the gain is sufficient that the 
community may approve a hard-fork to take place 1-2 years from consensus.

Since mining continues to use a double-SHA256 on a fixed 80 byte header, 
existing miners, FPGAs, etc should work unmodified. Poolservers will need to 
adapt significantly.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
Watson Ladd | 3 Jun 2012 05:40
Favicon

Fwd: Defeating the block withholding attack

On Sat, Jun 2, 2012 at 7:52 PM, Luke-Jr <luke <at> dashjr.org> wrote:
> Analysis, comments, constructive criticism, etc welcome for the following:
>
> ==Background==
> At present, an attacker can harm a pool by intentionally NOT submitting shares
> that are also valid blocks. All pools are vulnerable to this attack, whether
> centralized or decentralized and regardless of reward system used. The
> attack's effectiveness is proportional to ratio of the attacker's hashrate to
> the rest of the pool.
This attack has an obvious signature: getting outworked on the same
block as the pool was trying to verify, and always by the same person.
>
> There are obvious solutions that can be used to defeat this attack on
> centralized pools. For example, including a secret in the coinbase transaction
> that is accepted by the network as a partial preimage proof-of-work. All these
> solutions require changes to Bitcoin's proof-of-work acceptance terms, and
> since centralized pools can be harmful to the network's security, these rule
> changes are not likely to gain enough acceptance among the greater Bitcoin
> community.
>
> ==Proposed Solution==
> Please comment on the viability of this new proof-of-work algorithm, which I
> think should be viable for even decentralized pools:
>
> Blocks are accepted at a lower difficulty N (choosable by the pool; eg, the
> share difficulty) iff they are submitted with a candidate for the next block
> and SHA256(SHA256(NewBlockHash + NextBlockCandidateHash)) meets difficulty M.
> The relationship between M and N must be comparable to the normal network
> difficulty; details on the specifics of this can be figured out later, ideally
> by someone more qualified than me. M and N must be chosen prior to searching
> for the block: it should be safe to steal some always-zero bytes from the
> prevblock header for this.
So the goal is to prevent the attacker double-dipping by submitting
cycles to the pool, which if he
found a correct answer he could submit himself. I don't see how this
does that: if he finds a valid
block he finds a valid block. Only if the operator has a secret is
this prevented.
>
> This algorithm should guarantee that every share has an equal chance of being
> a valid block at the time it is found, and that which ones are actually blocks
> cannot be known until the subsequent block is found. Thus, attackers have no
> way to identify which shares to withhold even while they have full knowledge
> of the shares/blocks themselves.
This further delays the finalization of a transaction. That's not a good thing.
>
> ==Backward Compatibility==
> Obviously, this change creates a hard-fork in the blockchain. I propose that
> if it solves the block withholding risk, the gain is sufficient that the
> community may approve a hard-fork to take place 1-2 years from consensus.
>
> Since mining continues to use a double-SHA256 on a fixed 80 byte header,
> existing miners, FPGAs, etc should work unmodified. Poolservers will need to
> adapt significantly.
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development <at> lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development

--
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neitherĀ  Liberty nor Safety."
-- Benjamin Franklin

--

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neitherĀ  Liberty nor Safety."
-- Benjamin Franklin

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Bitcoin-development mailing list
Bitcoin-development <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bitcoin-development
Mike Hearn | 3 Jun 2012 16:17
Gravatar

Re: Full Clients in the future - Blockchain management

Yeah, for actually storing transactions the approach Satoshi uses of relying on a database engine makes sense and is what the code already does, so I'm not sure why this is a problem.


The real problem with Satoshis code for scaling down to smaller devices (and one day desktops too) is the need to store all the chain headers in RAM. BitcoinJ avoids this but just creates more problems for itself in other places, partly because we also try to avoid a database engine (read/write traffic on phones can be insanely expensive, especially on older ones, and so sqlite is known to be a serious cause of performance pain on android apps).
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Bitcoin-development mailing list
Bitcoin-development <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bitcoin-development
Peter Vessenes | 4 Jun 2012 03:43
Favicon
Gravatar

Re: Defeating the block withholding attack



On Sat, Jun 2, 2012 at 8:52 PM, Luke-Jr <luke <at> dashjr.org> wrote:
Analysis, comments, constructive criticism, etc welcome for the following:

==Background==
At present, an attacker can harm a pool by intentionally NOT submitting shares
that are also valid blocks. All pools are vulnerable to this attack, whether
centralized or decentralized and regardless of reward system used. The
attack's effectiveness is proportional to ratio of the attacker's hashrate to
the rest of the pool.


I'm unclear on the economics of this attack; we spent a bit of time talking about it a few months ago at CoinLab and decided not to worry about it for right now.

Does it have asymmetric payoff for an attacker, that is, over time does it pay them more to spend their hashes attacking than just mining? 

My gut is that it pays less well than mining, meaning I think this is likely a small problem in the aggregate, and certainly not something we should try and fork the blockchain for until there's real pain.

Consider, for instance, whether it pays better than just mining bitcoins and spending those on 'bonuses' for getting users to switch from a pool you hate.
 
Watson, I don't believe the attack signature you mention is a factor here, since the pool controls the merkle, only that pool will benefit from block submission. The nonce / coinbase combo is worthless otherwise, and so this attack is just in brief "get lucky, but don't submit."

So, can anyone enlighten me as to some actual estimates of badness for this attack?

Peter
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Bitcoin-development mailing list
Bitcoin-development <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bitcoin-development
Luke-Jr | 4 Jun 2012 04:04

Re: Defeating the block withholding attack

On Monday, June 04, 2012 1:43:42 AM Peter Vessenes wrote:
> Does it have asymmetric payoff for an attacker, that is, over time does it
> pay them more to spend their hashes attacking than just mining?

That depends on the pool's reward scheme. Some complicated forms are capable 
of getting "bonus" earnings out of the pool. Under all systems, the attacker 
at least gains the "hurt the pool" benefit. Given the frequency of DDoS 
attacks on pools, it is clear there are people who will even pay for attacks 
that provide no other benefit than harming pools. Under all systems, the 
attacker doesn't lose out in any significant way.

> My gut is that it pays less well than mining, meaning I think this is
> likely a small problem in the aggregate, and certainly not something we
> should try and fork the blockchain for until there's real pain.

If we wait until there's real pain, it will be a painful fork. If we plan it 
1-2 years out, people have time to upgrade on their own before it breaks.

> Consider, for instance, whether it pays better than just mining bitcoins
> and spending those on 'bonuses' for getting users to switch from a pool you
> hate.

With this attack, attackers can hurt the pool's "luck factor" *and* spend the 
bitcoins they earn to bribe users away.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
Luke-Jr | 4 Jun 2012 23:05

Re: Defeating the block withholding attack

On Monday, June 04, 2012 8:49:48 PM Mike Koss wrote:
> As I understand the attack, the attacker gets compensated for the shares
> they earn, but the pool will be denied any valid blocks found.  The
> attacker DOES NOT have access to the Bitcoins earned in the unreported
> block (only the mining pool has access to the Coinbase address and
> transactions in the block).

With decentralized pools, the attacker does have access to the block, and can 
potentially submit it to the Bitcoin network directly bypassing the pool if it 
benefits them to do so.

> So it's a zero-net-cost attack for the attacker (but no chance of making a
> profit) to hurt the pool operator. 

Because of the above, there is a possibility an attacker can make a profit.

> The only way to detect such an attack now is to look for "unlucky" miners;
> at the current difficulty, you can't detect this cheat until many millions
> of shares have been earned w/o a qualifying block.  Since an attacker can
> also create many fake identities, they can avoid detection indefinitely by
> abandoning each account after a million earned shares.

There are other modes of detection, but nobody has bothered to implement them 
since attackers can easily do a simple workaround in an arms race.

> I don't understand your proposal for fixing this.  You would have to come
> up with a scheme where:
> 
> - The miner can detect a qualifying hash to earn a share.
> - Not be able to tell if the hash is for a valid block.

With my proposal, miners can find shares, but won't know if it's a valid block 
until the subsequent block is also found (that subsequent block might not end 
up being a real block in the big picture).

> The way I would do this is to have a secret part (not shared with the
> miners) of a block that is part of the merkle hash, which is also used in a
> secondary hash.  Difficulty is then divide into two parts: the first,
> solved by the miner (earning a "share" - e.g., 1 in 4 Billion hashes).  And
> a second, solved by the pool (1 in Difficulty shares).  A valid block would
> have to exhibit a valid Share Hash AND a valid Pool Hash in order to be
> accepted.

This only works for centralized pools, which are contrary to the health of the 
Bitcoin network. Decentralized pools cannot have a secret.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
Mike Koss | 4 Jun 2012 22:49
Favicon
Gravatar

Re: Defeating the block withholding attack

As I understand the attack, the attacker gets compensated for the shares they earn, but the pool will be denied any valid blocks found.  The attacker DOES NOT have access to the Bitcoins earned in the unreported block (only the mining pool has access to the Coinbase address and transactions in the block).


So it's a zero-net-cost attack for the attacker (but no chance of making a profit) to hurt the pool operator.  The only way to detect such an attack now is to look for "unlucky" miners; at the current difficulty, you can't detect this cheat until many millions of shares have been earned w/o a qualifying block.  Since an attacker can also create many fake identities, they can avoid detection indefinitely by abandoning each account after a million earned shares.

I don't understand your proposal for fixing this.  You would have to come up with a scheme where:

- The miner can detect a qualifying hash to earn a share.
- Not be able to tell if the hash is for a valid block.

The way I would do this is to have a secret part (not shared with the miners) of a block that is part of the merkle hash, which is also used in a secondary hash.  Difficulty is then divide into two parts: the first, solved by the miner (earning a "share" - e.g., 1 in 4 Billion hashes).  And a second, solved by the pool (1 in Difficulty shares).  A valid block would have to exhibit a valid Share Hash AND a valid Pool Hash in order to be accepted.

This would be a very major change to the Block structure.  Given that attackers do not have direct monetary gain from this attack, I'm not sure we can justify it at this point.

On Sun, Jun 3, 2012 at 7:04 PM, Luke-Jr <luke <at> dashjr.org> wrote:
On Monday, June 04, 2012 1:43:42 AM Peter Vessenes wrote:
> Does it have asymmetric payoff for an attacker, that is, over time does it
> pay them more to spend their hashes attacking than just mining?

That depends on the pool's reward scheme. Some complicated forms are capable
of getting "bonus" earnings out of the pool. Under all systems, the attacker
at least gains the "hurt the pool" benefit. Given the frequency of DDoS
attacks on pools, it is clear there are people who will even pay for attacks
that provide no other benefit than harming pools. Under all systems, the
attacker doesn't lose out in any significant way.

> My gut is that it pays less well than mining, meaning I think this is
> likely a small problem in the aggregate, and certainly not something we
> should try and fork the blockchain for until there's real pain.

If we wait until there's real pain, it will be a painful fork. If we plan it
1-2 years out, people have time to upgrade on their own before it breaks.

> Consider, for instance, whether it pays better than just mining bitcoins
> and spending those on 'bonuses' for getting users to switch from a pool you
> hate.

With this attack, attackers can hurt the pool's "luck factor" *and* spend the
bitcoins they earn to bribe users away.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Bitcoin-development mailing list
Bitcoin-development <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bitcoin-development



--
Mike Koss
CTO, CoinLab
(425) 246-7701 (m)

A Bitcoin Primer - What you need to know about Bitcoins.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Bitcoin-development mailing list
Bitcoin-development <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bitcoin-development
Mike Koss | 5 Jun 2012 02:00
Favicon
Gravatar

Re: Defeating the block withholding attack

I don't understand how your proposal will work for decentralized pools - can you explain it more concretely?


What would the new block header look like?

What is required for a share to to be earned?

What is required for a block to be valid (added to Block Chain)?

I don't think I understand what you mean by NextBlockCandidate.  Perhaps a concrete example using difficulty 1.7 million would be instructive.

On Mon, Jun 4, 2012 at 2:05 PM, Luke-Jr <luke <at> dashjr.org> wrote:
On Monday, June 04, 2012 8:49:48 PM Mike Koss wrote:
> As I understand the attack, the attacker gets compensated for the shares
> they earn, but the pool will be denied any valid blocks found.  The
> attacker DOES NOT have access to the Bitcoins earned in the unreported
> block (only the mining pool has access to the Coinbase address and
> transactions in the block).

With decentralized pools, the attacker does have access to the block, and can
potentially submit it to the Bitcoin network directly bypassing the pool if it
benefits them to do so.

> So it's a zero-net-cost attack for the attacker (but no chance of making a
> profit) to hurt the pool operator.

Because of the above, there is a possibility an attacker can make a profit.

> The only way to detect such an attack now is to look for "unlucky" miners;
> at the current difficulty, you can't detect this cheat until many millions
> of shares have been earned w/o a qualifying block.  Since an attacker can
> also create many fake identities, they can avoid detection indefinitely by
> abandoning each account after a million earned shares.

There are other modes of detection, but nobody has bothered to implement them
since attackers can easily do a simple workaround in an arms race.

> I don't understand your proposal for fixing this.  You would have to come
> up with a scheme where:
>
> - The miner can detect a qualifying hash to earn a share.
> - Not be able to tell if the hash is for a valid block.

With my proposal, miners can find shares, but won't know if it's a valid block
until the subsequent block is also found (that subsequent block might not end
up being a real block in the big picture).

> The way I would do this is to have a secret part (not shared with the
> miners) of a block that is part of the merkle hash, which is also used in a
> secondary hash.  Difficulty is then divide into two parts: the first,
> solved by the miner (earning a "share" - e.g., 1 in 4 Billion hashes).  And
> a second, solved by the pool (1 in Difficulty shares).  A valid block would
> have to exhibit a valid Share Hash AND a valid Pool Hash in order to be
> accepted.

This only works for centralized pools, which are contrary to the health of the
Bitcoin network. Decentralized pools cannot have a secret.



--
Mike Koss
CTO, CoinLab
(425) 246-7701 (m)

A Bitcoin Primer - What you need to know about Bitcoins.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Bitcoin-development mailing list
Bitcoin-development <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bitcoin-development

Gmane