[bitcoin-dev] Multi-Stage Merge-Mine Headers Hard-Fork BIP

[bitcoin-dev] Multi-Stage Merge-Mine Headers Hard-Fork BIP

[James Hilliard]

https://github.com/bitcoin/bips/pull/340

BIP: ?
Title: 2016 Multi-Stage Merge-Mine Headers Hard-Fork
Author: James Hilliard <james.hilliard1@gmail.com>
Status: Draft
Type: Standards Track
Created: 2016-02-23

==Abstract==

Use a staged hard fork to implement a headers format change that is
merge mine incompatible along with a timewarp to kill the previous
chain.

==Specification==

We use a block version flag to activate this fork when 3900 out of the
previous 4032 blocks have this the version flag set. This flag locks
in both of the below stages at the same time.

Merge Mine Stage: The initial hard fork is implemented using a merge
mine which requires that the original pre-fork chain be mined with a
generation transaction that creates no new coins in addition to not
containing any transactions. Additionally we have a consensus rule
that requires that ntime be manipulated on the original chain to
artificially increase difficulty and hold back the original chain so
that all non-upgraded clients can never catch up with current time.
The artificial ntime is implemented as a consensus rule for blocks in
the new chain.

Headers Change Stage: This is the final stage of the hard fork where
the header format is made incompatible with merge mining, this is
activated ~50,000 blocks after the Merge Mine Stage and only at the
start of the 2016 block difficulty boundary.

==Motivation==

There are serious issues with pooled mining such as block withhold
attacks that can only be fixed by making major changes to the headers
format.

There are a number of other desirable header format changes that can
only be made in a non-merge mine compatible way.

There is a high risk of there being two viable chains if we don't have
a way to permanently disable the original chain.

==Rationale==

Our solution is to use a two stage hard fork with a single lock in period.

The first stage is designed to kill off the previous chain by holding
back ntime to artificially increase network difficulty on the original
chain to the point where it would be extremely difficult to mine the
2016 blocks needed to trigger a difficulty adjustment. This also makes
it obvious to unupgraded clients that they are not syncing properly
and need to upgrade.

By locking in both stages at the same time we ensure that any clients
merge mining are also locked in for the headers change stage so that
the original chain is dead by the time the headers change takes place.

We timewarp over a year of merge mining to massively increase the
difficulty on the original chain to the point that it would be
incredibly expensive to reduce the difficulty enough that the chain
would be able to get caught up to current time.

==Backward Compatibility==

This hardfork will permanently disable all nodes, both full and light,
which do not explicitly add support for it.
However, their security will not be compromised due to the implementation.
To migrate, all nodes must choose to upgrade, and miners must express
supermajority support.

==Reference Implementation==

TODO

Re: [bitcoin-dev] Multi-Stage Merge-Mine Headers Hard-Fork BIP

[Tier Nolan]

[-- Attachment #1: Type: text/plain, Size: 4801 bytes --]

You need more detail for it to be a BIP.

New Header

new_header.prev = hash of previous header's bitcoin header
new_header.small_nonce = 4 byte nonce
new_header.big_nonce = 8 byte nonce

new_header.... (Can contain any new fields desired)

Fake Block

block.version = 4
block.prev = new_header.prev
block.merkle = calculate_merkle(coinbase)
block.timestamp = block.getPreviousBlock().median_time_past + 1
block.bits = calculate_bits()
block.nonce = new_header.small_nonce
block.tx_count = 1

Coinbase

coinbase.version = 1
coinbase.tx_in_count = 0
coinbase.tx_out_count = 1
coinbase.tx_out[0].value = 0
coinbase.tx_out[0].pk_script = "OP_RETURN"

This is a "nuclear option" attack that knocks out the main chain.  The
median time past will increase very slowly.  It only needs to increase by 1
every 6th blocks.  That gives an increase of 336 seconds for every
difficulty update.  This will cap the update rate, so give an increase of
4X every doubling.

The new headers will end up not meeting the difficulty, so they will
presumably just repeat the last header?

If the bitcoin chain stays at constant difficulty, then each quadrupling
will take more time.

After 2 weeks: 4XDiff   (2 weeks per diff period)
After 10 weeks: 16XDiff (8 weeks per diff period)
After 42 weeks: 256XDiff (32 weeks per diff period)


On Wed, Feb 24, 2016 at 5:52 AM, James Hilliard via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> https://github.com/bitcoin/bips/pull/340
>
> BIP: ?
> Title: 2016 Multi-Stage Merge-Mine Headers Hard-Fork
> Author: James Hilliard <james.hilliard1@gmail.com>
> Status: Draft
> Type: Standards Track
> Created: 2016-02-23
>
> ==Abstract==
>
> Use a staged hard fork to implement a headers format change that is
> merge mine incompatible along with a timewarp to kill the previous
> chain.
>
> ==Specification==
>
> We use a block version flag to activate this fork when 3900 out of the
> previous 4032 blocks have this the version flag set. This flag locks
> in both of the below stages at the same time.
>
> Merge Mine Stage: The initial hard fork is implemented using a merge
> mine which requires that the original pre-fork chain be mined with a
> generation transaction that creates no new coins in addition to not
> containing any transactions. Additionally we have a consensus rule
> that requires that ntime be manipulated on the original chain to
> artificially increase difficulty and hold back the original chain so
> that all non-upgraded clients can never catch up with current time.
> The artificial ntime is implemented as a consensus rule for blocks in
> the new chain.
>
> Headers Change Stage: This is the final stage of the hard fork where
> the header format is made incompatible with merge mining, this is
> activated ~50,000 blocks after the Merge Mine Stage and only at the
> start of the 2016 block difficulty boundary.
>
> ==Motivation==
>
> There are serious issues with pooled mining such as block withhold
> attacks that can only be fixed by making major changes to the headers
> format.
>
> There are a number of other desirable header format changes that can
> only be made in a non-merge mine compatible way.
>
> There is a high risk of there being two viable chains if we don't have
> a way to permanently disable the original chain.
>
> ==Rationale==
>
> Our solution is to use a two stage hard fork with a single lock in period.
>
> The first stage is designed to kill off the previous chain by holding
> back ntime to artificially increase network difficulty on the original
> chain to the point where it would be extremely difficult to mine the
> 2016 blocks needed to trigger a difficulty adjustment. This also makes
> it obvious to unupgraded clients that they are not syncing properly
> and need to upgrade.
>
> By locking in both stages at the same time we ensure that any clients
> merge mining are also locked in for the headers change stage so that
> the original chain is dead by the time the headers change takes place.
>
> We timewarp over a year of merge mining to massively increase the
> difficulty on the original chain to the point that it would be
> incredibly expensive to reduce the difficulty enough that the chain
> would be able to get caught up to current time.
>
> ==Backward Compatibility==
>
> This hardfork will permanently disable all nodes, both full and light,
> which do not explicitly add support for it.
> However, their security will not be compromised due to the implementation.
> To migrate, all nodes must choose to upgrade, and miners must express
> supermajority support.
>
> ==Reference Implementation==
>
> TODO
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

[-- Attachment #2: Type: text/html, Size: 6190 bytes --]

Re: [bitcoin-dev] Multi-Stage Merge-Mine Headers Hard-Fork BIP

[James Hilliard]

I've updated the BIP with your suggestions, would it make sense to
just move the activation condition to the 42 week boundary instead of
repeating the last header? Would that be at block 6048 from the start
of the timewarp?

https://github.com/jameshilliard/bips/blob/bip-msmmhhf/bip-msmmhhf.mediawiki

On Wed, Feb 24, 2016 at 4:58 AM, Tier Nolan via bitcoin-dev
<bitcoin-dev@lists.linuxfoundation.org> wrote:
> You need more detail for it to be a BIP.
>
> New Header
>
> new_header.prev = hash of previous header's bitcoin header
> new_header.small_nonce = 4 byte nonce
> new_header.big_nonce = 8 byte nonce
>
> new_header.... (Can contain any new fields desired)
>
> Fake Block
>
> block.version = 4
> block.prev = new_header.prev
> block.merkle = calculate_merkle(coinbase)
> block.timestamp = block.getPreviousBlock().median_time_past + 1
> block.bits = calculate_bits()
> block.nonce = new_header.small_nonce
> block.tx_count = 1
>
> Coinbase
>
> coinbase.version = 1
> coinbase.tx_in_count = 0
> coinbase.tx_out_count = 1
> coinbase.tx_out[0].value = 0
> coinbase.tx_out[0].pk_script = "OP_RETURN"
>
> This is a "nuclear option" attack that knocks out the main chain.  The
> median time past will increase very slowly.  It only needs to increase by 1
> every 6th blocks.  That gives an increase of 336 seconds for every
> difficulty update.  This will cap the update rate, so give an increase of 4X
> every doubling.
>
> The new headers will end up not meeting the difficulty, so they will
> presumably just repeat the last header?
>
> If the bitcoin chain stays at constant difficulty, then each quadrupling
> will take more time.
>
> After 2 weeks: 4XDiff   (2 weeks per diff period)
> After 10 weeks: 16XDiff (8 weeks per diff period)
> After 42 weeks: 256XDiff (32 weeks per diff period)
>
>
> On Wed, Feb 24, 2016 at 5:52 AM, James Hilliard via bitcoin-dev
> <bitcoin-dev@lists.linuxfoundation.org> wrote:
>>
>> https://github.com/bitcoin/bips/pull/340
>>
>> BIP: ?
>> Title: 2016 Multi-Stage Merge-Mine Headers Hard-Fork
>> Author: James Hilliard <james.hilliard1@gmail.com>
>> Status: Draft
>> Type: Standards Track
>> Created: 2016-02-23
>>
>> ==Abstract==
>>
>> Use a staged hard fork to implement a headers format change that is
>> merge mine incompatible along with a timewarp to kill the previous
>> chain.
>>
>> ==Specification==
>>
>> We use a block version flag to activate this fork when 3900 out of the
>> previous 4032 blocks have this the version flag set. This flag locks
>> in both of the below stages at the same time.
>>
>> Merge Mine Stage: The initial hard fork is implemented using a merge
>> mine which requires that the original pre-fork chain be mined with a
>> generation transaction that creates no new coins in addition to not
>> containing any transactions. Additionally we have a consensus rule
>> that requires that ntime be manipulated on the original chain to
>> artificially increase difficulty and hold back the original chain so
>> that all non-upgraded clients can never catch up with current time.
>> The artificial ntime is implemented as a consensus rule for blocks in
>> the new chain.
>>
>> Headers Change Stage: This is the final stage of the hard fork where
>> the header format is made incompatible with merge mining, this is
>> activated ~50,000 blocks after the Merge Mine Stage and only at the
>> start of the 2016 block difficulty boundary.
>>
>> ==Motivation==
>>
>> There are serious issues with pooled mining such as block withhold
>> attacks that can only be fixed by making major changes to the headers
>> format.
>>
>> There are a number of other desirable header format changes that can
>> only be made in a non-merge mine compatible way.
>>
>> There is a high risk of there being two viable chains if we don't have
>> a way to permanently disable the original chain.
>>
>> ==Rationale==
>>
>> Our solution is to use a two stage hard fork with a single lock in period.
>>
>> The first stage is designed to kill off the previous chain by holding
>> back ntime to artificially increase network difficulty on the original
>> chain to the point where it would be extremely difficult to mine the
>> 2016 blocks needed to trigger a difficulty adjustment. This also makes
>> it obvious to unupgraded clients that they are not syncing properly
>> and need to upgrade.
>>
>> By locking in both stages at the same time we ensure that any clients
>> merge mining are also locked in for the headers change stage so that
>> the original chain is dead by the time the headers change takes place.
>>
>> We timewarp over a year of merge mining to massively increase the
>> difficulty on the original chain to the point that it would be
>> incredibly expensive to reduce the difficulty enough that the chain
>> would be able to get caught up to current time.
>>
>> ==Backward Compatibility==
>>
>> This hardfork will permanently disable all nodes, both full and light,
>> which do not explicitly add support for it.
>> However, their security will not be compromised due to the implementation.
>> To migrate, all nodes must choose to upgrade, and miners must express
>> supermajority support.
>>
>> ==Reference Implementation==
>>
>> TODO
>> _______________________________________________
>> bitcoin-dev mailing list
>> bitcoin-dev@lists.linuxfoundation.org
>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>