Hacker News Reader

Comment by SwellJoe | Hacker News Reader

Note that that lower confirmation time results in lower security for the network and higher susceptibility to double spend from a well-equipped mining operator. A lucky miner could capture 50%+ for 2 minutes a lot more easily than for 10. Satoshi didn't set the block time to 10 minutes arbitrarily.

Network speed increases and increasing network hashing power and distribution make it less of an issue...but, the issue remains. Litecoin and Doge are less secure than Bitcoin in this regard and more susceptible to 50% attacks.

Edit: It's clear I don't actually understand all the implications of this. But, all of the replies below me don't seem to either. I need to re-read the Bitcoin paper.

View on HN

A miner has the same likelihood of beating the rest of the network at N blocks no matter what the block duration is.

An attacker in a 1-minute block network will have the same likelihood of winning 10 blocks (in 10 minutes) as if they were running bitcoin and won 10 blocks (in 100 minutes).

However, in the 1-minute network, there are ten times as many opportunities in the same amount of time to attempt to perform this kind of attack.

If I wait for 2 confirmations in Bitcoin, is this more secure than, less secure than, or equally secure to waiting for 20 confirmations in Dogecoin?

The analysis is a bit tricky.

If an organization with 45% of the hashing power became malicious, it would be able to "double spend" 2 confirmations approximately 20.25% of the time. (the other 80% of the time, the 55% side of the network would "catch up").

For an organization with 45% hashing power to maliciously double-spend cross 20 confirmations, it'd have to win the coin flip 20 times, or 0.00001% of the time.

Methinks the faster hash rate is strictly better from a security standpoint... especially when you consider players who can perform a near-50% double-spend on the network. (A large 30% player may go for a "double-spend" within 2 confirmations, and will be successful 9% of the time)

Wrong: All else being identical, a currency with 10 minute blocks will have a 10x mining difficulty than a currency with a 1 minute block.

Lower mining difficulty = Easier to beat network.

(Easier to beat PER BLOCK, no difference PER UNIT TIME)

In fact, if you take into account the time it takes to propagate a block across the network, shorter confirmation times may actually lead to less security.

e.x. if the confirmation time is 60 seconds, and it takes 30 seconds to propagate a block across the network, the miner that just mined a block will have a huge advantage in computing the next block.

Well, if we start getting pedantic :-) smaller blocks also mean more block headers, which also hampers performance.

On the flip side, I don't think mined blocks typically take more than five seconds, due to the efficiency of the highly-branching network (though I haven't looked at the numbers to confirm this...) But I admit I hadn't thought about that extra detail, thank for pointing it out.

That's not true, there's a very big difference per unit time.

The difficulty of attempting a double spend decreases linearly with the nominal length of the blocks, but it increases exponentially with the number of blocks required to confirm a transaction. So if for instance you decide you need an average confirmation time of 20 minutes, that'd be 2 blocks in Bitcoin and around 20 blocks in our hypothetical 1-minute Bitcoin. In general, for any given target confirmation time the 1-minute Bitcoin will be harder to attack than the 10-minute one - and this is especially true for the sub-10-minute and sub-20-minute confirmation times many merchants want.

If you're targetting an average confirmation time of say 5 minutes, that's a solid 5 confirmations with 1-minute-coin but a risky zero confirmation transaction with Bitcoin - and in practice a lot of services do accept transactions with zero confirmations because it's the only way to get the level of convenience their customers expect.

Given the same amount of hashing power on the network, a one-minute block takes a tenth as much computation as a ten-minutes block. The network adjusts the difficulty so blocks are produced close to the desired rate.

Your first statement is true only if the difficulty on both chains are equal.

Lets assume chain A and chain B have the same hash power across their respective networks. Chain A has a block every 10 minutes, and Chain B has a block every 1 minute. The difficulty of finding a block in Chain B will be 10x easier than Chain A. Therefore an attacker will be 10x as likely to find a block on Chain B than Chain A.

On chain A, 6 confirmations provides a certain level of security against a double-spend. To get that same amount of security on chain B, you need 60 confirmations.

Your security against double spend is equal to the total network hashing power multiplied by the time since your transaction was added to the chain. Increasing the block speed does not affect your security.

Increasing the block speed only provides a smaller measure of your security. If you are OK with 3 minutes of security at the current network hashing power, you still have to wait for the first block on chain A (up to 10 minutes). On chain B, you would be satisfied after 3 blocks (max 3 minutes).

https://news.ycombinator.com/item?id=7117592

Lets take a hypothetical look at a coin that has a 1-hour confirmation time, and compare it against Doge, BTC. Lets call it HourCoin.

If you have 30% control of the mining pool, you have a 30% chance to "double-spend" anyone who accepts HourCoin after 1-hour (aka: one confirmation)

If you have 30% control of the BTC mining pool, you only have a 0.07% chance of double-spending any transaction after 1-hour. (aka: 6 confirmations)

If you have 30% control of the DOGE mining pool, you have a 4.23e-32 chance of double-spending a transaction after 1-hour.

If you're concerned with the 50% attack, then you should favor coins with faster confirmation times. It reduces the efficacy of "near 50%" attacks.

> For an organization with 45% hashing power to maliciously double-spend cross 20 confirmations, it'd have to win the coin flip 20 times, or 0.00001% of the time.

That's not right. If they want to maliciously double-spend, they'd just have to get 20 blocks in less time than the rest of the network got it in, and publish their result. This is not the same as beating the network at 20 individual blocks.

For instance, you can double spend by getting your 20 blocks in 19 minutes, when the rest of the network took 21 minutes. This is not the same as beating the rest of the network at all 20 blocks - some of yours may have taken longer.

You're technically right - the correct calculation is in section 11 of Satoshi's original paper [1], though the probability of success still reduces exponentially with the number of confirmations in the same way that dragontamer's calculation does.

[1] http://bitcoin.org/bitcoin.pdf

Thanks for the link. Binomial walk makes sense.

So it isn't 2^n, but a convolution summation over n-choose-r. Yeah... I don't feel like doing the "correct" math on this one.

But the concept is still correct. It is exponentially harder for the malicious user to double-spend based. It is much harder to break ten "one minute" confirmation, than one "ten minute" confirmation.

This is useful in practice if you are willing to accept only 1 or 2 confirmations. For retail type situations, a fast blocks are definitely better, which I touched on at the end of my post.

I constantly see the argument that 6 confirmations on LTC == 6 confirmations on BTC. This is the argument the original poster was making, and this what I am arguing against.

If you have a security requirement, wait for 20 confirmations before accepting the currency.

The problem is that the "most convenient" BTC confirmation time is ~10 minutes (but can be as high as ~1 hour due to the random factor in finding the next block). You can always wait for more confirmations if you want security, but you cannot change the protocol to be faster once it is set.

10 minutes is far too long. I argue that 1 minute is still too long, but is far more acceptable. Again, if you really want high security, wait for 20 confirmations or more. It will take longer for BTC to reach 6 confirmations than for you to get 30+ confirmations on DOGE.

If they had the same size network, it would take 60 confirmations on DOGE to match 6 confirmations on BTC. If you are OK with 30 confirmations on DOGE, you would be OK with 3 confirmations on BTC. In other words, it would take the same amount of time on either network.

Due to their respective network size, it would actually take many hours on DOGE to equal the same security as 1 hour on BTC.

"If they had the same size network, it would take 60 confirmations on DOGE to match 6 confirmations on BTC. If you are OK with 30 confirmations on DOGE, you would be OK with 3 confirmations on BTC."

That's not actually true. Satoshi actually provided code in his original paper to calculate this which I've just run, and it turns out that if, say, an attacker controlled 30% of the total mining power of each network during their attack they'd have a 33% chance of successfully double-spending against BTC with its 3 confirmation requirement and a 0.015% chance of successfully double-spending against DOGE with its 30 confirmation requirement. That's a big difference.

Let's suppose we decided to take advantage of this to require less confirmations on DOGE, say 10. Then the chance of a successful double-spend goes up to 4%, still lower than Bitcoin. Of course, let's be generous and assume our attacker now has three times the opportunities to double-spend, upping that to a 12% chance of success. It'd still be safer to accept transactions with 10 confirmations taking 10 minutes on same-size-DOGE than ones with 3 confirmations taking 30 minutes on BTC.

Actually, it looks like if we give our attacker those extra attempts provided by a faster attack for free, 8 one-minute confirmations are at least as secure as 3 ten-minute ones for any size of attacker that BTC can realistically defend against at all. (And remember, we're already talking about attackers powerful enough that 3 confirmations in BTC isn't safe. If we assume a hacker with 10% of the total mining power, which is arguably all that 3 confirmations can realistically protect against, 5 DOGE confirmations are enough and take half the amount of time as a single BTC confirmation)

This isn't even factoring in the fact that DOGE makes it harder to build ASICs due to the SCrypt algorithm.

Its far far easier to get a 600 GH/s system in BTC than it is to get a similar system in DOGE or LTC.

Reply on news.ycombinator.com