Why does an adversary have to control 50% of the computing power to double spend?

If transactions in a block are valid, in order to add that block in the block chain, a proof of work needs to be found. I have read the bitcoin paper by Satoshi.

If the difficulty of the proof of work requires say 2^52 computations (13 hex zeros) on an average, and since every node on the network is working independently, why can't the powerful adversary surpass the length of current block chain and present his version of block chain to the network? Specifically, why does the attacker have to control 1 percent or x percent of the network's computational power, when honest nodes on the network are not working in collaboration to find the proof of work?

If the adversary can find a proof of work quicker than the most powerful honest peer, he can compute a longer block chain and broadcast it to the network.

Let us assume that there are 2^20 nodes on the network, each computing 2^40 hashes per second on an average. Each node would then require 68 minutes to find a proof of work (trying 2^52 hashes). The total computing power of the network is number of nodes * computing power of each node = 2^20*2^40 = 2^60.

If the adversary operates at the speed of 2^45 hashes per second, he requires just 2^7 = 2 min to find a proof of work (2^52 hashes).

Now, the computing power of the network is 2^60, however each node is trying to find a proof of work independently. The computing power of adversary compared to the network is 32,000 times smaller. The amount of computing power controlled by the adversary is 1/32000 = 0.00001%, but still he can compute the longer block chain.

Please help, if I am assuming something wrong here. The honest nodes on the network do not work in collaboration. So attacker need not control 50% of computing power on the network and has to expend computing power just more than average computing power of the honest nodes.

Curious

Posted 2015-02-16T05:17:46.067

Reputation: 275

2^12 is 4096, so each computer with 2^40 hashes per second would require 68 minutes, not 16. – Murch – 2015-02-16T07:36:31.510

agreed, can you answer the question? – Curious – 2015-02-16T08:16:59.700

Got a bit sidelined in between, but I just did. :) – Murch – 2015-02-16T08:25:07.240

Also see: How is it that concurrent miners do not subvert each other's work?, How can we be sure that a new block will be found?

– Murch – 2015-02-16T08:47:44.497

1Misconception: "If the adversary can find a proof of work quicker than the most powerful honest peer, he can compute a longer block chain and broadcast it to the network." should be: "quicker than ALL honest peers combined." – Jannes – 2015-02-16T09:33:04.693

Probably already answered below, but "The honest nodes on the network do not work in collaboration." yes they actually do. That's the beauty of PoW. :) – Jannes – 2015-02-16T09:35:50.573

@Jannes: Yes, I've addressed both points in my answer. :) – Murch – 2015-02-16T11:34:32.927

@Murch Yeah should have read the answer first. Great one (again). Already upvoted. Thx. – Jannes – 2015-02-16T14:44:13.980

Every node on the network is working with different inputs to a hash function but trying to achieve the same target. So in a way all nodes are working together. – Curious – 2015-02-17T04:26:29.333

Answers

There are two assumptions in your question that aren't completely correct.

1) Each node would then require 68 minutes to find a proof of work (trying 2^52 hashes).

The process of finding a new block is not a linear task of work that needs to be accumulated. Rather it is a random process. Instead of a pile of work you are going through that has a fixed size, you could think of it as a lottery: Each try can win, but in average it takes 2^52 tries to win. This distinction is very important, because…

2) The honest nodes on the network do not work in collaboration.

…it allows the network to collaborate without coordinating!
Every mining entity is trying to confirm a different block. This is so, because each is trying to claim the block reward for themselves, therefore at least one transaction, the coinbase transaction, must differ.¹
So, since we have established that we are looking at a random process, and everyone is working on different data, we realize that the honest nodes are not duplicating each other's work. Therefore, all the honest nodes are going through a lot more inputs together than the adversary, and in effect are collaborating at finding a new block.
As cpast has pointed out in the comments, it is also very important to realize that nobody loses progress by switching. Therefore, only the time that the block requires to propagate through the network is lost, and everybody will switch to the new block with the one just found as a parent as soon as they receive it. Finally, this means that we need to compare the mining power of the honest network with the adversary's mining power in order to see who can create the greater chain. And as you have said yourself, with your exemplary numbers the network is 2^15 times as powerful than the adversary.

¹ Also, they can be working of different sets of transactions, the transactions will be in a different order for different miners, the timestamp changes every second, and they add more random data to try different inputs.

Murch

Posted 2015-02-16T05:17:46.067

Reputation: 41 609

Is the probability of finding proof of work for any block, where each node is working on different block is equivalent to the probability of finding proof of work for the given block, each node working on same block but with different nonce? – Curious – 2015-02-16T08:35:15.450

2SHA-256 is a cryptographic hash algorithm. That means, that nobody can predict which inputs will lead to a successful hash. Especially, it is irrelevant how big the change is between two inputs, as their outputs are not in a recognizable relationship to each other. Therefor, it does not matter what is changed about the input as long as there is some change. So, as long as nobody is duplicating the same inputs, working on different blocks or different nonces is equivalent. – Murch – 2015-02-16T08:41:37.513

1Finally I got it. – Curious – 2015-02-16T08:46:29.790

I've just discovered Princeton's online course "Intro to Crypto and Cryptocurrencies", which covers Cryptographic Hashfunctions and collisions in the first few minutes, it seems to be building up to proof of work, but I have to leave for work now. ;)

– Murch – 2015-02-17T06:39:33.910

Because it's irrelevant how long an individual honest node takes to mine a block. The honest nodes work independently, but if any of them mine a block they all move on to the next block. Nodes aren't all trying the same thing; each of the 2^20 honest nodes is looking at different hash values, so while an individual node only succeeds every 16 minutes on average, someone will get lucky and succeed after a minuscule fraction of a second (for instance, there's a 1/16 chance an honest miner succeeds in the first minute, so with 16 honest miners you'd expect someone to succeed then).

cpast

Posted 2015-02-16T05:17:46.067

Reputation: 121

but if a new block is mined successfully by some honest node, it is added to the block chain and therefore all honest nodes have to consider this by computing its hash and including in the. Therefore, for honest nodes proof of work starts from scratch again because of ordering of blocks in the block chain. The attacker on other hand, can mine say 5-6 blocks in 10 min and broadcast them to the network, thus forming the longer chain. – Curious – 2015-02-16T05:51:55.597

But the honest chain gets another block mined in another fraction of a second. Every hash has the same probability of being valid, but the honest guys get 32,000 hashes to the bad guy's one. "Proof of work" isn't something you make progress towards and then have to start over, it's something where you're as likely to get a valid hash in minute 1 as in minute 60. – cpast – 2015-02-16T05:53:32.997

Also, the attacker has to increase his blockchain when he mines a block; even if "start from scratch" was a thing, the attacker would also have to do so. – cpast – 2015-02-16T05:59:35.793

I understand that every node on the network is not trying the same think. but say a honest node A, finds a proof of work for a block and broadcasts it to the network. If valid proof of work is found, all peers on the network confirm this by adding thatblock to the block chain. Since, blocks in the block chain are ordered, the peers have to include the hash of newly included block in their proof of work and the computation starts again from the scratch. Am I wrong? Further I am assuming that the attacker is working independently and mines 6 new blocks and broadcast them together on the network. – Curious – 2015-02-16T06:05:16.670

Also, every block must be added once in 10 min on an average. Otherwise, difficulty of proof of work is increased. How come, fraction of second is enough to mine a block? – Curious – 2015-02-16T06:26:10.947

@Curious A consequence of 2^20 people who can each mine a block every 16 minutes means a block is mined every 2^-16 minutes, or over 64k mined per minute. Your numbers are what led to that. – cpast – 2015-02-16T06:35:32.633

So the strength is due to every honest node in the network is working independently on different block (different transactions) to find a proof of work. If every honest node works on the same block(same transactions), in this case, the attacker can exploit his fast computing power? – Curious – 2015-02-16T06:44:08.660

I think I have understood your point. But bitcoin network mines every block in 10 min on an average. So how difficult needs to be the proof of work, to achieve this. does it also depends upon the number of nodes on the network? – Curious – 2015-02-16T06:46:09.190

And you seem to misunderstand mining. "Start over" has no meaning, because you have no meaningful work tied up in your failed efforts. Mining is like the lottery; each hash is a ticket. The fact that you bought a bunch of losing tickets doesn't mean you're about to get a winning one; when they move on to the next series of tickets, you didn't lose any value you had stored in old losing tickets, because they had no value anyway. – cpast – 2015-02-16T06:47:40.340

Yes, difficulty scales so that you would expect one hash in (number computed in ten minutes by the whole network) to be valid. And the attacker can't work off the same block (when he mines it he has to add a block too, six hashes of one block doesn't equal six blocks), but he also mined many fewer blocks than the honest network (who mined tens of thousands before he got one). – cpast – 2015-02-16T06:50:53.293

Does difficulty also depends upon the number of nodes on the network? So basically the probability of finding a valid proof of work in a given time is sum of probability of all the nodes on the network. – Curious – 2015-02-16T06:52:28.897