安全与密码学2013arxiv.org编辑精选
多数并不足够：比特币挖矿是脆弱的
Majority is not Enough: Bitcoin Mining is Vulnerable
专业 · 约 75 分钟读完前置知识：比特币挖矿与共识基础、概率论/马尔可夫链、博弈论与激励机制
导读
论文挑战比特币安全性依赖诚实节点占多数的假设：如果一个“自私”矿池隐瞒新挖出的区块，建立临时更长的私有链并在合适时机公布，就可能比诚实挖矿更有利可图，并吸引更多矿工加入、最终控制多数算力。作者还提出一种向后兼容的协议修改（传播同长度竞争分支并随机选择挖哪条）来提高攻击门槛，但其可行性和激励兼容性在讨论中受到质疑。
HN 关注点：是否真的推翻“多数诚实即安全”，以及自私挖矿策略、网络位置优势与所提修复方案的激励兼容性。
后来怎么样
该文使“自私挖矿”成为区块链安全与激励分析的标准术语，并催生大量关于矿池策略、分叉选择与协议防御的后续研究，深刻影响了业界对算力集中与共识安全的理解。
HN 评论精选
这几条评论里：质疑 3 补充 1
质疑概述自私挖矿的盈利逻辑，但强调多重自私池、矿工网络连通性等使结论仍需检验。
作者认为，如果规模超过某个阈值的“自私”矿池把新发现的区块保密，它就能建立一条暂时比公共链更长的私有链，并且能足够频繁地在公共链赶上之前公布更长的私有链，使这种策略比诚实挖矿更赚钱；因此理论上越来越多理性矿工会加入自私矿池，使其迅速增长到控制多数节点。理论上如此。在评判这篇论文前，还有许多复杂微妙的问题需要分析。例如，如果其他矿工不加入自私矿池，而是建立自己的竞争性自私矿池会怎样？另外，正如 nullc 在本帖和 Bitcoin Forum 上指出的，矿工之间的对等连接已经非常广泛，临时隐瞒区块的成本可能远高于作者假设。比特币社区必须详细审视这篇论文，但如果作者逻辑和数学正确，这可能是一个真实漏洞。
cs702查看英文原文
The authors argue that if a "selfish" mining pool of size above a certain threshold keeps newly discovered blocks secret, this pool will be able to build a private block chain that is temporarily longer than the public one, frequently enough to make the selfish strategy more profitable than the honest one (by revealing longer private chains just before the public one catches up), so in theory more and more rational miners will join the selfish pool, which will therefore quickly grow to control a majority of all nodes. In theory. There are many complex and subtle issues that must be thoroughly analyzed before passing judgment on this paper. For example, what if other miners, instead of joining the selfish pool, decide to create their own competing selfish pools? Also, as nullc points out elsewhere on this thread[1] and the Bitcoin Forum[2], peering between miners is already so extensive that temporarily keeping blocks secret could be much costlier than assumed by the authors of the paper. The Bitcoin community must go through this paper in detail, but IF the authors' logic and math prove correct, this could be a real vulnerability. -- [1] https://news.ycombinator.com/item?id=6669735 [2] https://bitcointalk.org/index.php?topic=324413.msg3476697#msg3476697 -- Edits: moved paragraphs around and added sentence about and footnotes pointing to nullc's thoughts.
质疑比特币开发者认为论文的新意是网络位置优势假设，并质疑其解决方案会造成大矿工规模优势，主张先强化网络。
我（Greg Maxwell，比特币参考客户端开发者）的初步看法在这里：https://bitcointalk.org/index.php?topic=324413.msg3476697#msg3476697 。简言之，这里的新意在于假设攻击者利用网络位置优势来消除延迟区块带来的损失。我不喜欢他们提出的解决方案，因为它在所有情况下都会给大型矿工（其规模已经出现过）带来规模优势，即使没有网络攻击。我更倾向于先短期加强网络，防止形成位置优势。（已经有人认为矿工间广泛对等连接使攻击无效，但无法确定是否足够，所以加强网络无害。）
nullc查看英文原文
My (Greg Maxwell, a developer of the Bitcoin reference client) preliminary look at it is here: https://bitcointalk.org/index.php?topic=324413.msg3476697#msg3476697 In short, the new thing here is the assumption that the attacker uses a network positional advantage to eliminate the loss associated with delaying blocks. I am not fond of their proposed solution, since it creates a size advantage for large miners (of sizes which have already existed) in all cases, even without the network attack. I'd rather initially focus on strengthening the network against the formation of the positional advantage in the short term. (There is already some belief that there is extensive peering between miners making the attack ineffective, but its impossible to know if its adequate, so there is no harm in in strengthening that some.)
质疑从激励兼容角度质疑随机选择分支的修复方案，认为矿工有动机偏好先收到的分支。
作者提出一种简单、向后兼容的比特币协议修改来提高门槛：当矿工得知同长度的竞争分支时，应传播所有分支，并均匀随机选择在哪条上挖矿。作为前算法交易员，我认为这个方案似乎不激励兼容。假设有两条分支 0 和 0'，矿工先收到 0。挖出区块的概率与挖矿时间成正比，因此矿工会（a）收到通知后立即开始挖 0，（b）在 0 上找到区块的概率高于 0'。因此对矿工有利的是让 0 而非 0' 成为区块链。由于其他矿工也遵循类似逻辑，传播 0 而非 0' 对矿工有利。只有当（i）两条分支同时到达且（ii）没有关于其他矿工偏好哪条分支的信息时，随机选择分支才是理性的。
JumpCrisscross查看英文原文
"We propose a simple, backwards-compatible change to the Bitcoin protocol to address this problem and raise the threshold. Speci cally, when a miner learns of competing branches of the same length, it should propagate all of them, and choose which one to mine on uniformly at random." Former algorithmic trader here. This solution does not appear to be incentive-compatible. Suppose there are two branches, 0 and 0'. Miner receives 0 first. The probability of mining a block is proportional to the time spent mining. Miner thus (a) starts mining 0 immediately upon notification and (b) has a greater probability of finding a block on 0 than 0'. It is thus in Miner's interest for 0 to become the blockchain versus 0'. Since other miners are following a similar logic, it is in the miner's interest to propagate 0 over 0'. Randomly selecting which branch to mine is rational only if (i) both branches arrive at the same time and (ii) there is no information about which branch other miners are showing preference towards.
补充用25%算力矿池的例子解释选择性公布区块如何获得先手，并指出论文只假设单一自私矿池、现实中可能出现多个。
给没看懂的人：想法很简单。如果你是一个拥有25%算力的矿池，大致可以做到。你像普通矿池一样挖矿；它并非不诚实，叫自私是因为它表现得像普通矿池。比如你找到一个区块，其他矿池也会这样；但你不公布，而是保密，这是关键。多试几次，你会连续找到两个区块——矿池经常发生。但你等到其他矿池找到他们的区块，或者他们已经浪费很多周期去找时，再公布你早已找到的区块。通过选择性公布找到的区块，你浪费其他矿池的周期，并让自己在下一轮区块搜索中取得先手。矿工可能加入这个自私矿池，因为他们有先手，不会觉得算力被自私矿池特定时机公布区块而不断作废。论文假设只有一个自私矿池。我猜如果一个自私矿池出现，也会同时出现多个其他自私矿池；如果所有矿池都这样，矿工就没有激励……
sktrdie查看英文原文
For people that don't get it. The idea is simple. If you're a pool with 25% hashing power you can sort of make this happen. What you do is that you mine like a regular pool. In fact it's not a dishonest pool but it's called selfish because it acts like a normal pool. Say you find a block, which happens like any other pool. Instead of publishing it, you keep it private. This is the key. Now with enough tries it will happen that you find two blocks in a row - again happens all the time with pools. But what you do is that you wait until the other pools find theirs. Once they find the block (you already found it remember?), or they've wasted many cycles finding it, you publish yours that you've found already. By doing this you kind of selectively publish the blocks you find, wasting other pools cycles and sort of giving you a heads start for the next block search. It's all actually about building a pool that selectively publishes blocks so that it can get you a heads start for the next mining cycle. Miners will likely join this selfish pool because they'll have a heads start and not feel as though their hashing power is going to waste since it's constantly being invalidated by the selfish pool (by publishing blocks at specific times). The paper assumes there's only one selfish pool. I presume that if a selfish pool arises, there will also be a variety of other selfish pools arising at the same time. If all pools are acting this way, then there's really no incentive for miners to go to any specific pool (avoiding centralization). So it will just be like regular mining again.
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
- 自称作者的回复
历次讨论
- 2013Hacker News 讨论帖200 分 · 86 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选