Probability an honest node finds the next block vs. probability the attacker finds the next block

I am trying to understand Satoshi's paper [1]. On page 6 of the paper, he calculates the probability that someone can attack the blockchain from z blocks behind. He begins by defining:

My question: The mining of a block i.e., solving the hash puzzle is a completely brute-force trial-and-error process in which one keeps trying a random nonce until one gets a hit. No one has an upper hand in this process. So shouldn't p and q be equal to each other?

EDIT: since comment would have been very long. Responding to the comments, in that case it gets even worse. q can be greater than p. Let the Bitcoin network be composed of M mining pools with their compute power be given by p_i. Then all an attacker needs to do is to form a pool whose compute power is greater than max(p_i). Am I missing something? In other words, the pool with max compute power can attack the blockchain already.

In an ideal design, if I want to attack the blockchain, I should be pitted against the sum of p_i not the max of p_i.

attack

morpheus

Posted 2019-08-02T17:03:57.890

Reputation: 131

not if they are dependent on the hashpower of the attacker vs the hashpower of the honest node – JBaczuk – 2019-08-02T17:10:44.240

My question assumes the hashpower are equal. I think its a safe assumption. – morpheus – 2019-08-02T17:11:48.807

2@morpheus That's not a reasonable assumption. Why would the attacker have exactly half of the hashrate? – Pieter Wuille – 2019-08-02T17:24:14.100

Help me understand. Given N miners each having same computer, everyone has equal chance of finding the next block, no? – morpheus – 2019-08-02T17:42:36.320

1The attacker may have multiple computers. Or a datacenter. Or be the NSA. – Pieter Wuille – 2019-08-02T20:50:08.320

– Murch – 2019-08-02T23:25:28.027

"No one has an upper hand in this process. So shouldn't p and q be equal to each other?" is not accurate. The chance of succeeding follows the number of tries each participant is making. – Murch – 2019-08-02T23:26:15.213

@Murch, yes I get that. I had made an assumption that an attacker would be able to assemble same hash power as the most powerful mining pool. In that case wouldn't p be equal to q? And why is that not a safe assumption? (think of the most powerful pool as the one who wants to attack :) – morpheus – 2019-08-02T23:43:06.233

Answers

-1

The reason p and q are not equal is because the attacker is indeed pitted against the cumulative power of the entire network vs. being pitted against one miner.

If there was just one miner to compete with, then both the attacker and miner would have equal chances of finding the next block and p is indeed equal to q in that case (assuming identical hardware and hashing power). But when there are n miners, each of them working independently, then the chances that one of them finds the next block increase dramatically. The rate factor becomes $n \lambda$ instead of just $\lambda$. See https://en.wikipedia.org/wiki/Exponential_distribution#Distribution_of_the_minimum_of_exponential_random_variables and so now p/q=n.

Another way to get above result is to recognize that mining a block is like winning a lottery where everyone has equal chances (again assuming identical compute power). So if there are n miners plus 1 attacker, then p/q=n

Bitcoin is pure genius.

morpheus

Posted 2019-08-02T17:03:57.890

Reputation: 131

"If there was just one miner to compete with ... p is indeed equal to q in that case". The probability of finding the block is proportional to the number of tries, which means that it is proportional to the hash power that you have. Even if there are two miners, one could be using a huge datacenter, while the other might be mining on his 10 year old laptop. Their hash power would not be the same, and hence p and q will also not be equal to one another. Hash rate is the metric to be used to find out the probability of a miner finding the next block. – Ugam Kamat – 2019-08-03T01:44:06.013

1This is very confused. Even if there was just one attacker and one honest miner, there is no reason to assume they have the same hashrate. Hashrate depends on how much hardware and electricity each has at its disposal. – Pieter Wuille – 2019-08-03T01:48:09.247

No one has an upper hand in this process. So shouldn't p and q be equal to each other?

The chances of finding a valid block header that meets the target requirement increases proportionally to the number of tries. This means that it is proportional to the hash power that you have. Even if there are two miners, one could be using a huge datacenter (the size of United States), while the other might be mining on his 10 year old laptop. Their hash power would not be the same, and hence p and q will also not be equal to one another. Hash rate is the metric to be used to find out the probability of a miner finding the next block.

Then all an attacker needs to do is to form a pool whose compute power is greater than max(p_i). Am I missing something? In other words, the pool with max compute power can attack the blockchain already.

What you are describing is a 51% attack. With the current hashrate of the Bitcoin network, it would require HUGE investments (billions of dollars) from the entity who is planning to do such attacks. At that investment level, the economic incentive to launch such attacks may be tiny, unless it's a state actor who is trying to annihilate the confidence of the network. Even if a fraudulent miner amasses >50% of the hash rate of the network, full nodes MAY try to patch themselves to reject such blocks (for example: if that attacker tries to broadcast a longest chain that is > 6 blocks different than the original chain, to prevent double spends).

Ugam Kamat

Posted 2019-08-02T17:03:57.890

Reputation: 5 180