"Rolling back" the network means successfully creating a new longest chain that forks off of an arbitrary old block.

The further back in time you to "rollback" to, the less probable it is for the 51% to successfully mine all those needed blocks to get up to par with the existing longest chain.

Realistically speaking, this sort of attack is highly improbable.

Indeed. See the "bitcoin snack machine" for some hard numbers: https://bitcointalk.org/index.php?topic=423.0

> The network nodes only accept the first version of a transaction they receive to incorporate into the block they're trying to generate. When you broadcast a transaction, if someone else broadcasts a double-spend at the same time, it's a race to propagate to the most nodes first. If one has a slight head start, it'll geometrically spread through the network faster and get most of the nodes.

> A rough back-of-the-envelope example:

  1         0
  4         1
  16        4
  64        16
  80%      20%

> So if a double-spend has to wait even a second, it has a huge disadvantage.

I'm not sure anyone has put the infrastructure into place, though.

That has nothing to do with rolling back or 51% attacks. A racing attack and a 51% attack are different things.

Oh, you're probably right. It seemed related because the further back an adversary wanted to roll back to, the more hash power they'd need to get ahead. But it's a different category.

I wonder if there has been an analysis of how much hash power you'd need relative to how many blocks in the past you'd want to roll back.

That analysis is actually in the original 2008 bitcoin whitepaper:

https://bitcoin.org/bitcoin.pdf

If you have 51% of the power, you can roll back everything if you spend enough time on it. If you have 30%, you have a 4% chance of being able to catch up from 10 blocks behind, even if you spend infinite time on that specific fork.

I'm curious, has anyone done any back of the envelope calculations on this?

Let's say the US Government started a side-chain starting at the very first transaction and has kept it within it's own firewall, and has been mining for years at optimal difficulty levels so that they have to put in the least amount of work. Which now that I think about it, would just be difficulty 1, and the only reason to go above difficulty 1 would be because you started after the original chain, and you would only up the difficulty right before you were going to release it to the public.

Could they at any moment open it up and everyone would move over to their chain since it is the longest, where suddenly the US Gov owns every single coin and there's never been a single transaction?