Are there any attacks with a plurality of computing power?

There has been some discussion about possible attacks if one has the majority (over 50%) of the computing power of the bitcoin network. What happens if an attacker (or coordinated group of attackers) has more computing power than any other user (or coordinated group of users), but not necessarily the majority of all computing power?

Toy example

As a toy example, consider we have 3 users: Alice, Bob, and Steve.

Alice and Bob are both honest users that are fine using the protocol as specified. However, they will not go above-and-beyond the protocol to help each other (in fact, they would be happy to make money off the disadvantage of the other, as long as they are still complying with the protocol).

Steve is an attacker and is willing to perform actions outside of the protocol in order to either gain profit or just destroy the network. If Steve has 41% of the computing power, Bob has 34%, and Alice has 25% then are there attacks Steve could launch?

The toy example is included to just make it clear what I mean by plurality vs. majority, and what I mean by honest but uncoordinated users. I am obviously more interested in an answer to the general question than this specific toy model.

Artem Kaznatcheev

Posted 2011-09-24T18:19:43.290

Reputation: 1 816

The Finney attack (explained in the first paragraph of this question) is one such attack.

– David Schwartz – 2011-09-24T21:18:29.693

2Technically the Finney attack doesn't require a plurality of computing power, it just requires some computing power. The more substantial that amount the better the chance of success, but a plurality is not a requirement. Artem, are you asking for attacks which require a plurality or attacks which can be executed with a plurality or less? – David Perry – 2011-09-24T22:25:32.313

1I assumed by "plurality" he just meant "a significant amount, but less than half". In which case, attacks that are more likely to succeed the more computing power you have, such as the Finney attack, are exactly what he's asking about. – David Schwartz – 2011-09-25T00:10:13.327

I am really interested in attacks that require or significantly benefit from having more computing power than any other cooperative of users. If the attack just requires some computing power, unless it qualitatively gets better when reaching plurality, it won't really answer the question. Let me know if I should make this more clear in the question. – Artem Kaznatcheev – 2011-09-25T07:09:51.923

Answers

In a certain sense, all 51% attacks are really plurality attacks, but you have to consider all honest users as forming a single "coordinated group". (Which is true when you think about it: they are all following the intended protocol as implemented by standard software.)

Suppose for example that 30% of hash power is controlled by honest miners, 32% by Cartel X, and 38% by Cartel Y. The honest miners are mining on the main chain. Cartel X wants to reverse a transaction that appeared in some previous block A, so they are mining on a side chain that diverges from the main chain at block A-1. Cartel Y wants to reverse a different transaction that appeared in a previous block B, so are likewise mining on their own side chain from B-1.

Given enough time, Cartel Y's chain will eventually be longer than either the "honest" chain or the chain produced by Cartel X, so it will become the official record. Cartel Y will be successful in reversing their transaction, and Cartel X will not.

The 51% figure is based on the assumption that all miners who are not part of the attacking cartel are honest. But if some of them are part of a competing cartel, then a plurality indeed suffices, assuming you count all honest miners as a cartel of their own.

In principle something similar could happen in the event of a blockchain fork, where honest miners could split into two or more non-cooperating groups mining on distinct chains. In that case an attacker controlling more hash power than either group could mount a 51% attack also.

Nate Eldredge

Posted 2011-09-24T18:19:43.290

Reputation: 21 420

There are no such attacks known and there are some reasons none are likely to be exist. There is nothing special cooperating users could do, so far as we know. And the only 'tipping point' where something becomes possible, is 51% of total mining power. Other than that, there is no advantage to having more computing power than someone else.

David Schwartz

Posted 2011-09-24T18:19:43.290

Reputation: 46 931

"Other than that, there is no advantage to having more computing power than someone else.". Well, you could not do anything nefarious, but you'd be getting a bigger share of the mining proceeds. – Thilo – 2011-09-28T04:16:45.910

I'm not sure why you would care whether your share was bigger than someone else's or not. What difference does it make, for example, if you get X, whether an attacker gets Y (Y > X), or two other people (one an attacker, one not) get Y/2 (Y/2 < X)? (The question was specifically whether there was an advantage to having more computing power than a malicious attacker.) – David Schwartz – 2011-09-28T04:20:02.163

Yes, and my comment was specifically not about the malicious attacker. Just some extra context to soften the statement that there was "no advantage [in any way] to having more computing power". – Thilo – 2011-09-28T04:29:21.720

There are at least two double spend attacks if merchants accept zero-confirm transactions. (Bear in mind that a single confirmation takes an average of 10 minutes, and longer than an hour with probability 1:400).

With the Finney attack you precompute a block with a transaction to yourself. When you have a solution, you go to a merchant and buy something, giving him a transaction from the same address (and same output). When you step out of the shop with your goods, you release the presolved block (containing a transaction to yourself) into the wild, invalidating the genuine transaction.
With the discount scheme you override the transaction only with a certain probability (proportional to the size of your rig), but there are no timing issues. A potential real-world example is described here. See also here for a discussion.

newmeraire

Posted 2011-09-24T18:19:43.290

Reputation: 67

I don't think this is an answer to the question – Pieter Wuille – 2011-09-26T20:50:59.633