Bitcoin Security Under Temporary Dishonest Majority

Abstract

We prove Bitcoin is secure under temporary dishonest majority. We assume the adversary can corrupt a specific fraction of parties and also introduce crash failures, i.e., some honest participants are offline during the execution of the protocol. We demand a majority of honest online participants on expectation. We explore three different models and present the requirements for proving Bitcoin's security in all of them: we first examine a synchronous model, then extend to a bounded delay model and last we consider a synchronous model that allows message losses.

Updatable Blockchains

“…The updatable ledger that we have described can be updated to any ledger L 2 under the condition that the genesis functionality of L 2 tolerates an adversary that can see the genesis block τ max rounds before the honest parties and decide the genesis block among a set of m candidate genesis blocks. This requirement might look strong, but we note that the problem of constructing a ledger that is secure in such a scenario is simpler than the problem of constructing a ledger that supports temporary dishonest majority [2]. A ledger with security assumption A that tolerates temporary dishonest majority is such that its security properties (liveness and consistency) become valid again when A[τ 1 ] = 1, even if A[τ ] = 0 for all τ ∈ [τ 0 , τ 1 − δ] for some τ 0 , τ 1 , δ ∈ N such that τ 1 − δ ≥ τ 0 .…”

Decentralized Blockchain interoperability

“…One important difference between our scheme and the existing blockchain protocols is that traditional full nodes are able to verify the whole state evolution of the system from genesis. This allows them to recover in case of temporary dishonest majority [7,14], while our system cannot do so. Let us consider what could happen in case an adversary temporarily has the upper hand in a blockchain where ev erybody is mining using our protocol.…”

“…We will refer to this model as the 1 2 adversary. This assumption is generally necessary to solve the consensus problem in polynomial time [120], although it can be temporarily relaxed [9]. Throughout this work, we will assume that the honest majority holds during all rounds.…”

“…An address is manually crafted, so that it is clear it was not gen erated from a regular keypair. For example, the allzeros address is considered nothing upmysleeve 7 . It is hard to obtain a public key hashing to this address, thus funds sent If the adversary is successful then it has presented t, pk, pkh such that H(pk) = pkh and H(t) ⊕ 1 = pkh.…”

“…NIPoPoWs under dishonest majority. While our analysis has used the assumption that honest majority holds for all rounds, it is a known result that full nodes in proofofwork settings can withstand temporary dishonest majority [9]. More specifically, consider an execution in which honest majority holds most of the time, but a spike of dishonest major ity occurs for a limited number of rounds.…”