<p>Because it's irrelevant how long an individual honest node takes to mine a block. The honest nodes work independently, but if <em>any</em> of them mine a block they all move on to the next block. Nodes aren't all trying the same thing; each of the 2^20 honest nodes is looking at different hash values, so while an individual node only succeeds every 16 minutes on average, someone will get lucky and succeed after a minuscule fraction of a second (for instance, there's a 1/16 chance an honest miner succeeds in the first minute, so with 16 honest miners you'd expect <em>someone</em> to succeed then). </p>

CC BY-SA 3.0
2015-02-16T05:51:55.597Z
but if a new block is mined successfully by some honest node, it is added to the block chain and therefore all honest nodes have to consider this by computing its hash and including in the. Therefore, for honest nodes proof of work starts from scratch again because of ordering of blocks in the block chain. The attacker on other hand, can mine say 5-6 blocks in 10 min and broadcast them to the network, thus forming the longer chain.
Curious
CC BY-SA 3.0
2015-02-16T05:53:32.997Z
But the honest chain gets another block mined in another fraction of a second. Every hash has the same probability of being valid, but the honest guys get 32,000 hashes to the bad guy's one. "Proof of work" isn't something you make progress towards and then have to start over, it's something where you're as likely to get a valid hash in minute 1 as in minute 60.
cpast
CC BY-SA 3.0
2015-02-16T05:59:35.793Z
Also, the attacker has to increase *his* blockchain when he mines a block; even if "start from scratch" was a thing, the attacker would also have to do so.
cpast
CC BY-SA 3.0
2015-02-16T06:05:16.670Z
I understand that every node on the network is not trying the same think. but say a honest node A, finds a proof of work for a block and broadcasts it to the network. If valid proof of work is found, all peers on the network confirm this by adding thatblock to the block chain. Since, blocks in the block chain are ordered, the peers have to include the hash of newly included block in their proof of work and the computation starts again from the scratch. Am I wrong? Further I am assuming that the attacker is working independently and mines 6 new blocks and broadcast them together on the network.
Curious
CC BY-SA 3.0
2015-02-16T06:26:10.947Z
Also, every block must be added once in 10 min on an average. Otherwise, difficulty of proof of work is increased. How come, fraction of second is enough to mine a block?
Curious
CC BY-SA 3.0
2015-02-16T06:35:32.633Z
@Curious A consequence of 2^20 people who can each mine a block every 16 minutes means a block is mined every 2^-16 minutes, or over 64k mined per minute. Your numbers are what led to that.
cpast
CC BY-SA 3.0
2015-02-16T06:44:08.660Z
So the strength is due to every honest node in the network is working independently on different block (different transactions) to find a proof of work. If every honest node works on the same block(same transactions), in this case, the attacker can exploit his fast computing power?
Curious
CC BY-SA 3.0
2015-02-16T06:46:09.190Z
I think I have understood your point. But bitcoin network mines every block in 10 min on an average. So how difficult needs to be the proof of work, to achieve this. does it also depends upon the number of nodes on the network?
Curious
CC BY-SA 3.0
2015-02-16T06:47:40.340Z
And you seem to misunderstand mining. "Start over" has no meaning, because you have no meaningful work tied up in your failed efforts. Mining is like the lottery; each hash is a ticket. The fact that you bought a bunch of losing tickets doesn't mean you're about to get a winning one; when they move on to the next series of tickets, you didn't lose any value you had stored in old losing tickets, because they had no value anyway.
cpast
CC BY-SA 3.0
2015-02-16T06:50:53.293Z
Yes, difficulty scales so that you would expect one hash in (number computed in ten minutes by the whole network) to be valid. And the attacker *can't* work off the same block (when he mines it he has to add a block too, six hashes of one block doesn't equal six blocks), but he also mined many fewer blocks than the honest network (who mined tens of thousands before he got one).
cpast
CC BY-SA 3.0
2015-02-16T06:52:28.897Z
Does difficulty also depends upon the number of nodes on the network? So basically the probability of finding a valid proof of work in a given time is sum of probability of all the nodes on the network.
Curious
CC BY-SA 3.0
2015-02-16T07:01:03.150Z
Is the probability of finding proof of work for any block, where each node is working on different block is equivalent to the probability of finding proof of work for the given block, each node working on same block but with different nonce?
Curious
CC BY-SA 3.0
2015-02-16T05:44:42.500Z
2015-02-16T05:44:42.500Z
cpast
<p>There are two assumptions in your question that aren't completely correct.</p>

<p>1) <em>Each node would then require 68 minutes to find a proof of work (trying 2^52 hashes).</em></p>

<p>The process of finding a new block is <strong>not a linear task</strong> of work that needs to be accumulated. <a href="https://bitcoin.stackexchange.com/a/22984/5406">Rather it is a random process.</a> Instead of a pile of work you are going through that has a fixed size, you could think of it as a lottery: <a href="https://bitcoin.stackexchange.com/q/35662/5406">Each try can win</a>, but <strong><em>in average</em></strong> it takes 2^52 tries to win. This distinction is very important, because…</p>

<p>2) <em>The honest nodes on the network do not work in collaboration.</em></p>

<p>…it allows the network to collaborate without coordinating!<br>
Every mining entity is trying to confirm a <em>different block</em>. This is so, because each is trying to claim the block reward for themselves, therefore at least one transaction, the <a href="https://bitcoin.stackexchange.com/questions/4571/what-is-the-coinbase">coinbase transaction</a>, must differ.¹<br>
So, since we have established that we are looking at a random process, and everyone is working on different data, we realize that the honest nodes are not duplicating each other's work. Therefore, all the honest nodes are going through a lot more inputs together than the adversary, and in effect <strong><em>are collaborating</em></strong> at finding a new block.<br>
As <a href="https://bitcoin.stackexchange.com/a/36073/5406">cpast has pointed out in the comments</a>, it is also very important to realize that nobody loses progress by switching. Therefore, only the time that the block requires to propagate through the network is lost, and everybody will switch to the new block with the one just found as a parent as soon as they receive it.
Finally, this means that we need to compare the mining power of the honest network with the adversary's mining power in order to see who can create the greater chain. And as you have said yourself, with your exemplary numbers the network is 2^15 times as powerful than the adversary.</p>

<p>¹ Also, they can be working of different sets of transactions, the transactions will be in a different order for different miners, the timestamp changes every second, and they add more random data to try different inputs.</p>

CC BY-SA 3.0
2015-02-16T08:35:15.450Z
Is the probability of finding proof of work for any block, where each node is working on different block is equivalent to the probability of finding proof of work for the given block, each node working on same block but with different nonce?
Curious
CC BY-SA 3.0
2015-02-16T08:41:37.513Z
SHA-256 is a cryptographic hash algorithm. That means, that nobody can predict which inputs will lead to a successful hash. Especially, it is irrelevant how big the change is between two inputs, as their outputs are not in a recognizable relationship to each other. Therefor, it does not matter what is changed about the input as long as there is some change. So, as long as nobody is duplicating the same inputs, working on different blocks or different nonces is equivalent.
Murch
CC BY-SA 3.0
2015-02-16T08:46:29.790Z
Finally I got it.
Curious
CC BY-SA 3.0
2015-02-17T06:39:33.910Z
I've just discovered Princeton's online course "[Intro to Crypto and Cryptocurrencies](https://www.youtube.com/watch?v=fOMVZXLjKYo)", which covers Cryptographic Hashfunctions and collisions in the first few minutes, it seems to be building up to proof of work, but I have to leave for work now. ;)
Murch
CC BY-SA 3.0
2015-02-16T08:24:21.490Z
2015-02-16T14:44:37.370Z
2017-04-13T12:47:33.660Z
Murch
<p>If transactions in a block are valid, in order to add that block in the block chain, a proof of work needs to be found. I have read the bitcoin paper by Satoshi.</p>

<p>If the difficulty of the proof of work requires say 2^52 computations (13 hex zeros) on an average, and since every node on the network is working independently, why can't the powerful adversary surpass the length of current block chain and present his version of block chain to the network? Specifically, why does the attacker have to control 1 percent or x percent of the network's computational power, when honest nodes on the network are not working in collaboration to find the proof of work?</p>

<p>If the adversary can find a proof of work quicker than the most powerful honest peer, he can compute a longer block chain and broadcast it to the network.</p>

<p>Let us assume that there are 2^20 nodes on the network, each computing 2^40 hashes per second on an average. Each node would then require 68 minutes to find a proof of work (trying 2^52 hashes). The total computing power of the network is number of nodes * computing power of each node = 2^20*2^40 = 2^60.</p>

<p>If the adversary operates at the speed of 2^45 hashes per second, he requires just 2^7 = 2 min to find a proof of work (2^52 hashes).</p>

<p>Now, the computing power of the network is 2^60, however each node is trying to find a proof of work independently. The computing power of adversary compared to the network is 32,000 times smaller. The amount of computing power controlled by the adversary is 1/32000 = 0.00001%,  but still he can compute the longer block chain.</p>

<p>Please help, if I am assuming something wrong here. The honest nodes on the network do not work in collaboration. So attacker need not control 50% of computing power on the network and has to expend computing power just more than average computing power of the honest nodes.</p>

CC BY-SA 3.0
2015-02-16T07:36:31.510Z
2^12 is 4096, so each computer with 2^40 hashes per second would require 68 minutes, not 16.
Murch
CC BY-SA 3.0
2015-02-16T08:16:59.700Z
agreed, can you answer the question?
Curious
CC BY-SA 3.0
2015-02-16T08:25:07.240Z
Got a bit sidelined in between, but I just did. :)
Murch
CC BY-SA 3.0
2015-02-16T08:47:44.497Z
Also see: [How is it that concurrent miners do not subvert each other's work?](http://bitcoin.stackexchange.com/q/35662/5406), [How can we be sure that a new block will be found?](http://bitcoin.stackexchange.com/a/22984/5406)
Murch
CC BY-SA 3.0
2015-02-16T09:33:04.693Z
Misconception: "If the adversary can find a proof of work quicker than the most powerful honest peer, he can compute a longer block chain and broadcast it to the network." should be: "quicker than ALL honest peers combined."
Jannes
CC BY-SA 3.0
2015-02-16T09:35:50.573Z
Probably already answered below, but "The honest nodes on the network do not work in collaboration." yes they actually do. That's the beauty of PoW. :)
Jannes
CC BY-SA 3.0
2015-02-16T11:34:32.927Z
@Jannes: Yes, I've addressed both points in my answer. :)
Murch
CC BY-SA 3.0
2015-02-16T14:44:13.980Z
@Murch Yeah should have read the answer first. Great one (again). Already upvoted. Thx.
Jannes
CC BY-SA 3.0
2015-02-17T04:26:29.333Z
Every node on the network is working with different inputs to a hash function but trying to achieve the same target. So in a way all nodes are working together.
Curious
<mining-theory><proof-of-work><majority-attack><mining-technical-details>
Why does an adversary have to control 50% of the computing power to double spend?
Curious
# Why does an adversary have to control 50% of the computing power to double spend?

(Asked by: username_0 on 2015-02-16)

If transactions in a block are valid, in order to add that block in the block chain, a proof of work needs to be found. I have read the bitcoin paper by Satoshi.

If the difficulty of the proof of work requires say 2^52 computations (13 hex zeros) on an average, and since every node on the network is working independently, why can't the powerful adversary surpass the length of current block chain and present his version of block chain to the network? Specifically, why does the attacker have to control 1 percent or x percent of the network's computational power, when honest nodes on the network are not working in collaboration to find the proof of work?

If the adversary can find a proof of work quicker than the most powerful honest peer, he can compute a longer block chain and broadcast it to the network.

Let us assume that there are 2^20 nodes on the network, each computing 2^40 hashes per second on an average. Each node would then require 68 minutes to find a proof of work (trying 2^52 hashes). The total computing power of the network is number of nodes \* computing power of each node = 2^20\*2^40 = 2^60.

If the adversary operates at the speed of 2^45 hashes per second, he requires just 2^7 = 2 min to find a proof of work (2^52 hashes).

Now, the computing power of the network is 2^60, however each node is trying to find a proof of work independently. The computing power of adversary compared to the network is 32,000 times smaller. The amount of computing power controlled by the adversary is 1/32000 = 0.00001%, but still he can compute the longer block chain.

Please help, if I am assuming something wrong here. The honest nodes on the network do not work in collaboration. So attacker need not control 50% of computing power on the network and has to expend computing power just more than average computing power of the honest nodes.

**Tags:** mining-theory, proof-of-work, majority-attack, mining-technical-details

> **Comments:**
> **username_1**: 2^12 is 4096, so each computer with 2^40 hashes per second would require 68 minutes, not 16.  
> **username_0**: agreed, can you answer the question?  
> **username_1**: Got a bit sidelined in between, but I just did. :)  
> **username_1**: Also see: [How is it that concurrent miners do not subvert each other's work?](http://bitcoin.stackexchange.com/q/35662/5406), [How can we be sure that a new block will be found?](http://bitcoin.stackexchange.com/a/22984/5406)  
> **username_2**: Misconception: "If the adversary can find a proof of work quicker than the most powerful honest peer, he can compute a longer block chain and broadcast it to the network." should be: "quicker than ALL honest peers combined."  
> **username_2**: Probably already answered below, but "The honest nodes on the network do not work in collaboration." yes they actually do. That's the beauty of PoW. :)  
> **username_1**: @username_2: Yes, I've addressed both points in my answer. :)  
> **username_2**: @username_1 Yeah should have read the answer first. Great one (again). Already upvoted. Thx.  
> **username_0**: Every node on the network is working with different inputs to a hash function but trying to achieve the same target. So in a way all nodes are working together.  

---

## 2 answers

### Answer by username_1 on 2015-02-16. Score: 7 | Accepted answer

There are two assumptions in your question that aren't completely correct.

1) *Each node would then require 68 minutes to find a proof of work (trying 2^52 hashes).*

The process of finding a new block is **not a linear task** of work that needs to be accumulated. [Rather it is a random process.](https://bitcoin.stackexchange.com/a/22984/5406) Instead of a pile of work you are going through that has a fixed size, you could think of it as a lottery: [Each try can win](https://bitcoin.stackexchange.com/q/35662/5406), but ***in average*** it takes 2^52 tries to win. This distinction is very important, because…

2) *The honest nodes on the network do not work in collaboration.*

…it allows the network to collaborate without coordinating!  
Every mining entity is trying to confirm a *different block*. This is so, because each is trying to claim the block reward for themselves, therefore at least one transaction, the [coinbase transaction](https://bitcoin.stackexchange.com/questions/4571/what-is-the-coinbase), must differ.¹  
So, since we have established that we are looking at a random process, and everyone is working on different data, we realize that the honest nodes are not duplicating each other's work. Therefore, all the honest nodes are going through a lot more inputs together than the adversary, and in effect ***are collaborating*** at finding a new block.  
As [username_3 has pointed out in the comments](https://bitcoin.stackexchange.com/a/36073/5406), it is also very important to realize that nobody loses progress by switching. Therefore, only the time that the block requires to propagate through the network is lost, and everybody will switch to the new block with the one just found as a parent as soon as they receive it.
Finally, this means that we need to compare the mining power of the honest network with the adversary's mining power in order to see who can create the greater chain. And as you have said yourself, with your exemplary numbers the network is 2^15 times as powerful than the adversary.

¹ Also, they can be working of different sets of transactions, the transactions will be in a different order for different miners, the timestamp changes every second, and they add more random data to try different inputs.

> **Comments:**
> **username_0**: Is the probability of finding proof of work for any block, where each node is working on different block is equivalent to the probability of finding proof of work for the given block, each node working on same block but with different nonce?  
> **username_1**: SHA-256 is a cryptographic hash algorithm. That means, that nobody can predict which inputs will lead to a successful hash. Especially, it is irrelevant how big the change is between two inputs, as their outputs are not in a recognizable relationship to each other. Therefor, it does not matter what is changed about the input as long as there is some change. So, as long as nobody is duplicating the same inputs, working on different blocks or different nonces is equivalent.  
> **username_0**: Finally I got it.  
> **username_1**: I've just discovered Princeton's online course "[Intro to Crypto and Cryptocurrencies](https://www.youtube.com/watch?v=fOMVZXLjKYo)", which covers Cryptographic Hashfunctions and collisions in the first few minutes, it seems to be building up to proof of work, but I have to leave for work now. ;)  

---

### Answer by username_3 on 2015-02-16. Score: 2

Because it's irrelevant how long an individual honest node takes to mine a block. The honest nodes work independently, but if *any* of them mine a block they all move on to the next block. Nodes aren't all trying the same thing; each of the 2^20 honest nodes is looking at different hash values, so while an individual node only succeeds every 16 minutes on average, someone will get lucky and succeed after a minuscule fraction of a second (for instance, there's a 1/16 chance an honest miner succeeds in the first minute, so with 16 honest miners you'd expect *someone* to succeed then).

> **Comments:**
> **username_0**: but if a new block is mined successfully by some honest node, it is added to the block chain and therefore all honest nodes have to consider this by computing its hash and including in the. Therefore, for honest nodes proof of work starts from scratch again because of ordering of blocks in the block chain. The attacker on other hand, can mine say 5-6 blocks in 10 min and broadcast them to the network, thus forming the longer chain.  
> **username_3**: But the honest chain gets another block mined in another fraction of a second. Every hash has the same probability of being valid, but the honest guys get 32,000 hashes to the bad guy's one. "Proof of work" isn't something you make progress towards and then have to start over, it's something where you're as likely to get a valid hash in minute 1 as in minute 60.  
> **username_3**: Also, the attacker has to increase *his* blockchain when he mines a block; even if "start from scratch" was a thing, the attacker would also have to do so.  
> **username_0**: I understand that every node on the network is not trying the same think. but say a honest node A, finds a proof of work for a block and broadcasts it to the network. If valid proof of work is found, all peers on the network confirm this by adding thatblock to the block chain. Since, blocks in the block chain are ordered, the peers have to include the hash of newly included block in their proof of work and the computation starts again from the scratch. Am I wrong? Further I am assuming that the attacker is working independently and mines 6 new blocks and broadcast them together on the network.  
> **username_0**: Also, every block must be added once in 10 min on an average. Otherwise, difficulty of proof of work is increased. How come, fraction of second is enough to mine a block?  
> **username_3**: @username_0 A consequence of 2^20 people who can each mine a block every 16 minutes means a block is mined every 2^-16 minutes, or over 64k mined per minute. Your numbers are what led to that.  
> **username_0**: So the strength is due to every honest node in the network is working independently on different block (different transactions) to find a proof of work. If every honest node works on the same block(same transactions), in this case, the attacker can exploit his fast computing power?  
> **username_0**: I think I have understood your point. But bitcoin network mines every block in 10 min on an average. So how difficult needs to be the proof of work, to achieve this. does it also depends upon the number of nodes on the network?  
> **username_3**: And you seem to misunderstand mining. "Start over" has no meaning, because you have no meaningful work tied up in your failed efforts. Mining is like the lottery; each hash is a ticket. The fact that you bought a bunch of losing tickets doesn't mean you're about to get a winning one; when they move on to the next series of tickets, you didn't lose any value you had stored in old losing tickets, because they had no value anyway.  
> **username_3**: Yes, difficulty scales so that you would expect one hash in (number computed in ten minutes by the whole network) to be valid. And the attacker *can't* work off the same block (when he mines it he has to add a block too, six hashes of one block doesn't equal six blocks), but he also mined many fewer blocks than the honest network (who mined tens of thousands before he got one).  
> **username_0**: Does difficulty also depends upon the number of nodes on the network? So basically the probability of finding a valid proof of work in a given time is sum of probability of all the nodes on the network.  
> **username_0**: Is the probability of finding proof of work for any block, where each node is working on different block is equivalent to the probability of finding proof of work for the given block, each node working on same block but with different nonce?  

---

