1. "51% attack" is not a thing as in "one has to have 51% of hashpower to perform it". it's just that with 51% of hashpower it becomes relatively cheap to perform such attack. one can throw enough money at the problem and get lucky to perform large reorg with just 10% of hashpower. the lower the number - the more lucky attacker has to get.

2. "rewriting a block" or "billion dollar bounty" as the GP put it are just conveying wrong ideas. there is zero chance for that $1B to get stolen even if attacker gets 100% of hashrate. all they can do is revert the transaction so that money goes back to original owners by generating a fork in the chain that doesn't include said transaction.

even that is not enough because competing miners (assuming attacker doesn't really have all 100% of hashpower) will still eventually include the transaction because it pays lucrative fees.

the trick here is that in Bitcoin parties agree to finalize the deal only after certain number of confirmations (blocks created after the one that includes the transaction). general rule is to wait for 6 confirmations.

if there indeed was some $1B deal where 94k BTC changed hands i wouldn't be surprised if their agreed upon number of confirmations was ~500 blocks (half the value of transaction in question in miner rewards), which is roughly 3 days wait.

ultimately though i'm pretty sure this was some kind of cold-storage consolidation so no BTC actually changed hands.

1. A malicious syndicate gathers a billion dollars of bitcoin and sends it to themselves

2. In a short period of time, like a few days, the syndicate exchanges that bitcoin for non-bitcoin assets

3. The syndicate spends tens or hundreds of millions of dollars to fork the chain, backing up the ledger, so that they own the billion dollars of bitcoin again

So anyone accepting bitcoin for non-bitcoin assets for the next week or so is at risk. It doesn’t have to be a single transaction, though; this danger occurs whenever the transaction volume on bitcoin gets above the cost of mining.

which is now worth zero :)

The qualitative difference is that with 51% of hashpower you can sustain the attack indefinitely. Other miners might get the occasional block and temporarily take the lead but in the long run you'll always have the longest chain using only blocks you've mined yourself.

With less than 50% there's a chance that you can revert a transaction temporarily by mining two consecutive blocks (one to omit the transaction and another to make your chain longer than the original) in less time than it takes the main network to reach the same block height, but the odds of maintaining the attack drop by at least half with each additional block. The main network will always win eventually.

In any case no one controls anywhere close to 51% of the hashpower right now. There are pools which approach that size but they aren't monolithic entities; if the pool operators attempted to leverage their position as coordinators to carry out a sustained attack then miners would leave the pool.

If you're concerned that the person you're receiving funds from might be willing to attempt a double-spend then you should wait for a suitable number of confirmations before considering the funds successfully transferred. However, if they control over 50% of the hash rate then there is no suitable number of confirmations that would make the transfer safe.

Yes indeed. There are a number of very interesting game-theoretic feedback loops built into bitcoin that enhance security. This is one of them.

The expectation, at this point, is that defense will only occur if you are an elite insider. An unknown user may or may not be such an elite, and thus may or may not get defense.

Surely you aren't going to make such a statement without examples! I can think of examples where things were attacked, including some of the largest value destructions, and insider status didn't help. For example, the multisig thing that happened to Gav Wood (the second time).

If your lone example is the Dao attack, that looked like successful governance to me.

I wasn't sure what you were referring to, but it looks like maybe https://cointelegraph.com/news/parity-multisig-wallet-hacked...

The astounding, insane decision to use "libraries" aka delegate call in any immutable smart contract always boggled my mind. The amount of space saved is so ludicrously small as to beggar belief. Hope the 10k or whatever worth of space savings (about 20 transactions worth) was worth it.

Anyway, he didn't get a roll back, and the $200m in value that disappeared didn't either.

That seems a little out there.

(1) There is something like 1 person who uses bitcoin to move billions of dollars around. The small-time users (<$1,000,000 per transaction) wouldn't have any reason to lose trust in the system. If some company loses $1 bil in dollars, I really don't care; I don't live in a world where it affects me personally. Nobody is ever going to put serious resources into stealing from me because I'm just not that important.

(2) If they re-write the block, that doesn't mean that they've gotten away with it. Most countries have a legal system that would sit up and take notice if someone signs up for a billion dollar transaction, takes the goods and welches on paying.

Yes, but why bitcoin then?

I note that my emails from seekingalpha recently have ads saying "Vote <you-know-who> in 2020! Free Gold Victory Coin For Supporters - Claim Yours Now".

The Bitcoin and Ethereum ecosystems are rather different.

So around $12 billion (plus the datacenter, operations, etc). You'd pretty much send BTC to being worth $0...and then you're stuck with $12 billion in useless hardware.

Even if we were extremely generous would be a billion in hardware at the very least (I am assuming $500 manufacturing cost)

Theoretically, I can spend that much to make it's value go to $0. (yes, there are liquidity and other concerns, but you get the point)

The Market Cap of Bitcoin is $184,000,000,000

I have plenty of money to play with.

Moreover, to gain $184B by shorting Bitcoin you'd need to find someone willing to loan you $184B worth of Bitcoin, and then somehow sell all of it without crashing the price or drawing unwanted attention to your activities. Of course if the price doesn't react the way you expect you could end up paying a lot more than $184B to buy it all back to repay the loan. You shouldn't assume that even a successful (but expensive, and obviously temporary) 51% attack will drive the price down to zero.

That is, the attack you're proposing would require commandeering 15% of the world economy and more than doubling world electrical generation capacity.

Bribing or backdooring ASIC miners is a far more likely vulnerability.

Hash functions used in the real world haven't been proven to have this property (and there are various theoretical limits on how readily they could be proven to have it, and maybe on the extent to which they could actually have it), but in order to be widely adopted, a hash function has to pass every available statistical test for approximating pseudorandomness, and also has to resist mathematical analysis aimed at finding useful structure. That means that ordinary human intelligences fail to find a practical recipe for predicting properties of the output from properties of the input.

In the same way, we would expect that deep learning systems fail to find such recipes too.

On the other hand, it's not absolutely impossible that there are some kinds of regularities that a deep learning system might discover. If so, they would be considered very serious flaws in the hash function in question. But deployed cryptographic primitives have sometimes had problems like this. The best example that I know of is the RC4 cipher

https://en.wikipedia.org/wiki/RC4#Security

where there have been a series of statistical biases (which are often forms of correlation between input and output, which should not exist if RC4 approximated pseudorandomness well). Some of these were apparently discovered experimentally by researchers with some kind of hypothesis testing tools, as opposed to based on theoretical abstract reasoning about the mathematics of RC4. This makes me think that some kinds of deep learning systems might also have been able to discover those correlations, although I'm not sure that they would have been the most efficient methods for doing so. (An interesting test might be to try to use deep learning to find new correlations in RC4 that aren't yet known -- which seems plausible since researchers have repeatedly found new ones over time.)

I think there are interesting problems about what kinds of correlations and structures deep learning systems can or can't learn efficiently, and whether those are the kinds of correlations and structures that are likely to exist as genuine flaws within deployed hash functions. I definitely don't know enough about the mathematics of deep learning to appreciate how to begin answering this question; I only know that if it turned out to be useful in some case, it would mean that the application of human intelligence and existing statistical tools to assessing hash functions' security had dramatically fallen down on the job.

Most people think that this is impossible, but it has not been proven yet. Unless you had some reason for believing the technique would work, it's probably not worth the effort to try.

A sort-of precedent for that kind of problem which I mentioned in my sibling comment is the correlation weaknesses in RC4. While they're not the most powerful possible break of RC4, by any means, they are unanticipated flaws in the structure of RC4 specifically, and they might well have been discovered by software tools that can't solve NP problems in general. It seems to me that we don't have security proofs for symmetric cryptography at all, including for block cipher security properties as well as hash function security properties, and so while your observation is totally right in general, in any specific case it might just turn out that the cryptographic primitive we were using was weak in an unanticipated way that's specific to that class of functions.

Compare https://en.wikipedia.org/wiki/Random_oracle (although reading that article reminds me of how much I don't understand about this topic)!

As schoen pointed out, no common hash function, including the ones used in Bitcoin, has a proof of NP-completeness.

Moreover, none of those hash functions involve factoring numbers, and factoring numbers is also not known to be NP-complete, although it is also not known to be tractable in polynomial time. One reason commonly-used proof-of-work functions do not involve integer factorization is that, while integer factorization is not known to be doable in polynomial time, there are a number of algorithms that require subexponential time, so an integer-factorization-based proof-of-work witness would be much larger than an equivalent hash-function-based proof-of-work witness.

Also, it is not the case that efficient integer factorization would completely break all current encryption. Not only do no commonly-used hash functions depend on it, neither do any commonly-used symmetric ciphers (such as AES), and the currently-most-popular asymmetric cryptosystems also do not depend on the difficulty of integer factorization; instead they depend on the difficulty of the elliptic-curve discrete logarithm problem.

ECDLP is also not known to be NP-complete, but the currently-known algorithms for it are much worse than currently-known algorithms for integer factorization, so elliptic-curve cryptosystems require much smaller keys and less computation to resist the known attacks than integer-factorization-based cryptosystems.

As little as ten years ago, algorithms that could be broken by better integer factorization algorithms were relatively much more important than they are today, because elliptic-curve cryptography was much less widely used. Many vulgar accounts of the situation intended for the ignorant are not up to date.

Finally, it is not true that a proof that P=NP would "completely break all current encryption", for two reasons. First, it might not be a constructive proof — it might show that a polynomial-time algorithm for factoring integers, solving ECDLP, or computing hash preimages exists without actually telling you how to compute it. Second, even a constructive proof of P=NP might not provide an algorithm that was adequately efficient — if it takes O(n²) time to encrypt and decrypt, where n is the size of a key, but O(n⁸) time to break a message or a key, you might be adequately safe with, say, RSA-4096. But an O(n⁸) algorithm for 3-SAT would definitely be a constructive proof of P=NP.

(Shor's algorithm on a quantum computer can break RSA, because it does depend on integer factorization, in O(n³) time, if quantum computers can exist, which they probably can. This would not make it impossible to do RSA encryption securely, but it would require much larger keys than are currently used.)

However, your fundamental point is that a successful attack on Bitcoin's hashing algorithm, using artificial neural networks or anything else, would be very surprising and have major implications, because that proof-of-work scheme is designed to require exponential work, and as far as anyone knows, it does. And that fundamental point is correct, even though you have made a number of errors in your supporting points.

SO these machines are made to specifically mine bitcoin, other ASICs do other jobs, but individual units cannot transfer from one job to another and cannot be re-purposed.

Finally, you certainly cannot buy off the ASIC miners with a few million, not least because they own billions of dollars worth of ASICS that can't do anything but mine Bitcoin, and a successful state-orchestrated attack on Bitcoin would make all of them worthless. I don't think a state government taking down Bitcoin by its own rules is completely impossible, but you don't seem to have any grasp of the scales involved.

And in the end, after your massive investment, the community would just make some trivial change to the protocol and completely ignore the attack. Really, if this sort of thing was so easy then everyone would be doing it. You're certainly welcome to try.

Bitcoin has long since passed the stage where you could 51%-attack it for piddly amounts of money.

Most other altcoins, though...

Or are ASICs capital expense cheap and available and already over provisioned compared to operational costs, like dark fiber optics?

Separate from the manufacturers, relatively easy courses of action I can see are buying hashing power from marketplaces like nicehash, and temporarily concentrating their machines on BTC and not mining BCH. This can only get you so much though since BTC hashrate dwarfs BCH hashrate.

And really, if you’re talking about limiting cases, you’re bounded by what your counterparties are good for, and by what your relevant regulators will let you get away with (or, depending on who your counterparties are, how far you can go before you end up in a ditch somewhere)