Rewriting the entire blockchain: is it possible to spoof block timestamps of a privately mined chain?

3

According to fork.lol and Pieter's bitcoin.sipa, it would currently take ~200 days for an attacker with 100% of the current hashpower to rewrite the entire btc blockchain. My question pertains to how an attack like this could actually play out:

Lets assume that 100% of the hashpower is in an attackers hands, and the btc chain has stopped progressing. The attacker points 100% of the hashpower towards mining on the genesis block, so they will generate the first 2016 blocks SUPER fast, and then the difficulty will increase by a factor of 4. This will continue until the difficulty reaches it's current levels, and after ~200 days the attacker's chain will have a higher cumulative difficulty, despite having a much lower block height.

But I don't think that is very interesting, the rest of the network will realize there is a problem well before 200 days have passed, and probably code up a solution of some sort to keep things running smoothly.

So how possible is a more covert attack? Could an attacker with a modest amount of hashpower mine a private chain, and spoof the timestamps to keep the difficulty lower than it should be? Thus allowing the creation of a 'replica' chain with a few txs changed for the attackers benefit?

This could be done while the honest chain is still operating, and the attacker would slowly catch up to the honest chain. The further along the attacker makes it, the more hash power they will need to dedicate to the attack to keep outrunning any honest miners. But if a modest amount of hashpower can privately rewrite a good chunk of the early history, it seems like the current 200 day window might actually be a slight overestimate.

Note: In this scenario, the total time to enact the attack would be longer than 200 days, but some of this time would be spent privately mining with a portion of hash power that 'won't be missed' by the network. So the rest of the network may only be able to notice that an attack is happening inside of the 200-day window.

I do not see this as a real threat, I'm more interested in understanding what is actually possible, particularly in regards to spoofing time stamps on a private chain to keep difficulty targets low.

chytrik

Posted 2018-01-06T22:40:17.663

Reputation: 10 276

1Your exact question is a bit unclear to me. Yes an attacker can mine a private chain with a lower difficulty.. But then no one would accept it because it has a lower difficulty. – kaykurokawa – 2018-01-06T22:49:17.390

To clarify then: does spoofing timestamps in this way work, and if it does, how much might that allow them lower the 'proof of work equivalent days' required to rewrite the entire chain? (assuming an attacker has access to a majority of hashpower) – chytrik – 2018-01-06T22:54:34.517

Waiting for Pieter Wuille to answer.......

– Chak – 2018-01-06T22:55:42.120

1

I think you are perhaps confused about how Bitcoin calculates the "best" chain. The "best" chain contains the most work and is not necessarily the longest. If you mess with the timestamp to lower your difficulty, you've effectively made your chain "shorter". See: https://bitcoin.stackexchange.com/questions/29742/strongest-vs-longest-chain-and-orphaned-blocks

– kaykurokawa – 2018-01-07T02:24:46.220

@kaykurokawa I understand the distinction between 'block height' and 'most work', I think you've misunderstood my question slightly. To rephrase: if an attacker with a modern ASIC wanted to rewrite the entire chain, but end up at the same block height/cumulative difficulty as the current chain, could timestamp spoofing a priv mined chain allow them to do so quickly? Eg. block 150k on honest chain is 52 difficulty, block 150k on attack chain is also 52 difficulty, even though attacker has what should be '1000 difficulty worth of hashpower'. Numbers obv made up, but should communicate the point – chytrik – 2018-01-07T03:21:08.847

i believe that's why we have checkpoints in the source code so a user performing IBD might not be easily fooled to verify an alt-chain with the same amount of work done while the block history was still in low-diff. In relatively-higher diff blocks, this is a non-issue since its non-trivial to forge these blocks – renlord – 2018-05-07T10:31:19.573

Answers

1

Yes, an attacker could spoof the timestamps on the block and create a covert alternative history. However, this doesn't make much of a difference in this attack. The reason is that, if the attacker chooses to manipulate timestamps to increase the difficulty, then they will end up producing fewer, in count, high-difficulty blocks. On the other hand, if they choose to manipulate timestamps to lower the difficulty, then they will end up producing more, in count, low-difficulty blocks. In any case, the cumulative difficulty in the adversarial chain will be the same (both in expectation and, due to a Chernoff bound, with high probability, unless they increase difficulty tremendously).

I'm doubtful about your claim that the network will realize there's a problem. The attacker's chain will remain private until they have surpassed the current honest chain in cumulative difficulty. During covert mining, the honest parties are unaware that an attack is taking place (and the honest chain can continue growing, provided there is some non-majority honest power). The attack will only become visible when the attacker reveals the chain, when the honest parties will instantly switch to it. At that point, the attacker can perform a large double spending attack and walk away prior to the honest parties employing a patch.

One thing the attacker has to keep in mind is that the current blockchain is sometimes checkpointed, so if a client has a checkpoint, then the adversary can only reorg the chain up to that checkpoint. Furthermore, especially near the present, the block timestamps have to match the current time of the verifier computers, as this is checked by some clients, at least approximately. Other than that, this attack could work.

dionyziz

Posted 2018-01-06T22:40:17.663

Reputation: 855

Asked: 2018-01-06T22:40:17.663

Viewed: 436 times

Active: 2018-07-18T21:02:38.040