From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193] helo=mx.sourceforge.net) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1XlK4o-0008IX-RN for bitcoin-development@lists.sourceforge.net; Mon, 03 Nov 2014 16:01:54 +0000 Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com designates 209.85.212.180 as permitted sender) client-ip=209.85.212.180; envelope-from=alex.mizrahi@gmail.com; helo=mail-wi0-f180.google.com; Received: from mail-wi0-f180.google.com ([209.85.212.180]) by sog-mx-3.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128) (Exim 4.76) id 1XlK4m-0000vX-SX for bitcoin-development@lists.sourceforge.net; Mon, 03 Nov 2014 16:01:54 +0000 Received: by mail-wi0-f180.google.com with SMTP id hi2so6822719wib.1 for ; Mon, 03 Nov 2014 08:01:46 -0800 (PST) MIME-Version: 1.0 X-Received: by 10.194.90.175 with SMTP id bx15mr48104808wjb.25.1415030506641; Mon, 03 Nov 2014 08:01:46 -0800 (PST) Received: by 10.27.203.138 with HTTP; Mon, 3 Nov 2014 08:01:46 -0800 (PST) In-Reply-To: References: Date: Mon, 3 Nov 2014 18:01:46 +0200 Message-ID: From: Alex Mizrahi To: Bitcoin-Dev Content-Type: multipart/alternative; boundary=047d7bfd011eb1dd720506f676c6 X-Spam-Score: -0.6 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (alex.mizrahi[at]gmail.com) -0.0 SPF_PASS SPF: sender matches SPF record 1.0 HTML_MESSAGE BODY: HTML included in message -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1XlK4m-0000vX-SX Subject: Re: [Bitcoin-development] side-chains & 2-way pegging (Re: is there a way to do bitcoin-staging?) X-BeenThere: bitcoin-development@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Nov 2014 16:01:55 -0000 --047d7bfd011eb1dd720506f676c6 Content-Type: text/plain; charset=UTF-8 > From the introduction "[...]Because signers prove computational work, > rather than proving secret knowledge as > is typical for digital signatures, we refer to them as miners. To > achieve stable consensus on the > blockchain history, economic incentives are provided where miners are > rewarded with fees and > subsidies in the form of coins that are valuable only if the miners > form a shared valid history, > incentivising them to behave honestly.[...]" > This isn't applicable in case of sidechains: anybody with sufficient hashpower will be able to unlock a locked coin on the parent chain by producing an SPV proof. "Only if the miners form a shared valid history" isn't a requirement here, as miner will get bitcoins which aren't in any way connect to sidechain he have wrecked. Thus there is no incentive to behave honestly. Thus sidechains, in principle, reward their miners > with the same Bitcoin will use in the future: only transaction fees. > Since some people claim that won't be enough Whether it is enough depends on a variety of factors, including existence of other chains miner can mine. You cannot assume that it is the same situation as with a simple single-chain model. E.g. imagine 1000 BTC were moved to a sidechain. Miners can keep mining bitcoins as usual, and in parallel work on an SPV proof to claim these 1000 BTC. (I assume that merged-mining is allowed.) In this case the amount of fees which miners could collect by honest mining on the sidechain is irrelevant, as long as it is smaller than 1000 BTC. This is quite different from attacks which can be performed on vanilla Bitcoin (see below), so I don't think you can say that the security model is the same. Also says "Given our assumption that p > q, the probability drops > exponentially as the number of blocks the > attacker has to catch up with increases." > Yes, but that doesn't apply to reorganizations which attacker might cause intentionally. Hence I think it was disingenuous to include these two very different treats into one section: it sounds like you claim that attacker-induced reorganizations are unlikely, while it isn't the case. So the longer the contest period is, the harder it is to succeed with > a fraudulent transfer. > Yes, but "harder" isn't same as "unlikely". Another problem with this section is that it only mentions reorganizations. But a fraudulent transfer can happen without a reorganization, as an attacker can produce an SPV proof which is totally fake. So this is not similar to double-spending, attacker doesn't need to own coins to perform an attack. > I hope this clarifies our assumptions. > Yep, thanks. It looks like you assume that sidechain security will be similar to Bitcoin security in the long term. Now quite the assumptions I've been looking for, but OK... I'm sorry for the harsh tone, but I just find it hilarious that people who explained that proof-of-stake is not going to work because an attacker might collect everybody's past signing keys to rewrite the whole history (I'm referring to this: https://download.wpsoftware.net/bitcoin/pos.pdf ) didn't bother to mention that miners can collude to wreck a sidechain and get an awesome reward, basically for free. something something the mote in thy brother's eye something something --047d7bfd011eb1dd720506f676c6 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
=C2=A0
From the introduction "[...]Because signers prove computational= work,
rather than proving secret knowledge as
is typical for digital signatures, we refer to them as miners. To
achieve stable consensus on the
blockchain history, economic incentives are provided where miners are
rewarded with fees and
subsidies in the form of coins that are valuable only if the miners
form a shared valid history,
incentivising them to behave honestly.[...]"

=
This isn't applicable in case of sidechains: anybody with su= fficient hashpower will be able to unlock a locked coin on the parent chain= by producing an SPV proof.
"Only if the miners form a share= d valid history" isn't a requirement here, as miner will get bitco= ins which aren't in any way connect to sidechain he have wrecked.=C2=A0= Thus there is no incentive to behave honestly.

Thus sidechains, in principle, reward their miners
with the same Bitcoin will use in the future: only transaction fees.
Since some people claim that won't be enough

Whether it is enough depends on a variety of factors, including exist= ence of other chains miner can mine.
You cannot assume that it is= the same situation as with a simple single-chain model.

E.g. imagine 1000 BTC were moved to a sidechain. Miners can keep min= ing bitcoins as usual, and in parallel work on an SPV proof to claim these = 1000 BTC. (I assume that merged-mining is allowed.)
In this case = the amount of fees which miners could collect by honest mining on the sidec= hain is irrelevant, as long as it is smaller than 1000 BTC.

<= /div>
This is quite different from attacks which can be performed on va= nilla Bitcoin (see below), so I don't think you can say that the securi= ty model is the same.

Also says "= Given our assumption that p > q, the probability drops
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;pa= dding-left:1ex"> exponentially as the number of blocks the
attacker has to catch up with increases."

Yes, but that doesn't apply to reorganizations which attacker m= ight cause intentionally.
Hence I think it was disingenuous to in= clude these two very different treats into one section:
it sounds= like you claim that attacker-induced reorganizations are unlikely, while i= t isn't the case.

So the longer th= e contest period is, the harder it is to succeed with
a fraudulent transfer.

Yes, but "h= arder" isn't same as "unlikely".

Another problem with this section is that it only mentions reorganization= s.
But a fraudulent transfer can happen without a reorganization,= as an attacker can produce an SPV proof which is totally fake. So this is = not similar to double-spending, attacker doesn't need to own coins to p= erform an attack.
=C2=A0
I hope this clarif= ies our assumptions.

Yep, thanks. It loo= ks like you assume that sidechain security will be similar to Bitcoin secur= ity in the long term.
Now quite the assumpt= ions I've been looking for, but OK...
<= br>
I'm sorry for the harsh tone, but I= just find it hilarious that people who explained that proof-of-stake is no= t going to work because an attacker might collect everybody's past sign= ing keys to rewrite the whole history
(I= 9;m referring to this:=C2=A0https://download.wpsoftware.net/bitcoin/pos.pdf )=C2=A0
didn't bother to mention that miners can = collude to wreck a sidechain and get an awesome reward, basically for free.=
something something the mote in thy brothe= r's eye something something
--047d7bfd011eb1dd720506f676c6--