[jcoffland]

> The technological innovation of a blockchain is that it combines cryptographic signatures with a fault-tolerant distributed database.

This is the naive view that has allowed the financial industry to ditch Bitcoin and run with blockchain. The problem that Bitcoin solves and private blockchains do not is called the Byzantine generals problem which did not have a known solution until Bitcoin came along.

Private blockchains cannot solve the Byzantine generals problem because they cannot ensure that one of it's limited number of parties is not employing massively more computing power in order to cheat. Bitcoin only works because an unlimited number of players are mining as hard as they can making it improbable that a single entity can exceeded 50% of the total hash power. With private blockchains it will always be reasonable to assume that cheating would be with in reach.

[jude-]

No.

First, solutions to Byzantine agreement for known numbers of processes predate Bitcoin.

Second, Nakamoto Consensus is not Byzantine agreement. Byzantine agreement forbids committed writes from being reverted, and each replica sees the same history of writes. However, Nakamoto Consensus only offers probabilistic write durability (our transactions can get orphaned arbitrarily far into the future), and different peers can see divergent histories of arbitrary length even under normal operation.

Third, Byzantine agreement is defined in terms of the set of peers. Systems where the agreement protocol does not know the number of peers cannot solve the Byzantine agreement problem, since they can't prove that no more than f of 3f+1 peers are faulty (neither quantity is known to the system).

Fourth, open-membership Byzantine agreement was published this year: http://hackingdistributed.com/2016/08/04/byzcoin/. The membership set changes every "block", but the peers in the set during the current epoch are known.

EDIT: typo

[riprowan]

Byzcoin is interesting but like Bitcoin its security model depends on massively decentralized mining.

Mining is a function of turning electricity into coins. Since coin generation rate is fixed through a difficulty adjustment, mining becomes a winner-take-all game where only those miners with the lowest electricity costs can effectively compete. Thus the system collapses quickly into a mining oligarchy.

What does Byzcoin propose to resolve the as-yet unresolved problem of mining centralization, which is fundamental to the success of any of these coins?

[lefkok]

Any proof-of-work based system has this problem, especially when the PoW is outsourceable. However, I believe you are missing the point of Byzcoin, which is that if there is a set of decentralised miners we can still get the strongly consistent, final guarantees of Byzantine agreement in a scalable way.

ByzCoin has PoW to be Bitcoin compatible, but it can change to PoS or PoA or even permissioned systems (e.g hyperledger).

[semi-extrinsic]

> The problem that Bitcoin solves and private blockchains do not is called the Byzantine generals problem which did not have a known solution until Bitcoin came along.

I'm not an expert in any way, but the Wikipedia page for Byzantine Fault Tolerance suggests a solution to this problem was known as early as 2001, used in the Boeing 777 avionics software. See abstract of the paper below. That significantly predates Bitcoin. Or am I misunderstanding something?

http://ieeexplore.ieee.org/document/963311/?arnumber=963311

[wmf]

There were known solutions given a fixed set of generals. Nakamoto consensus handles the case of an unknown number of anonymous generals (miners) who may come and go when they please.

[semi-extrinsic]

Out of curiosity: were there known solutions for an arbitrarily large number of fixed generals? Could a similar solution as with Nakamoto consensus be obtained by having a huge, fixed number of generals, setting some as occupied and using live inputs for those, and then using an alternating series of yes/no votes for the unoccupied generals? (Maybe you'd have trouble with off-by-one errors in the alternating series, but you could ad-hoc fix that.)

Come to think of it, why does the variable number of generals make a difference? When you are making a single decision, is that decision not an atomic operation such that the number of generals influencing it is fixed? Otherwise, wouldn't necessarily the outcome of the vote be (marginally) affected by the order in which you evaluate the votes cast? (That seems like a very bad property for a consensus algorithm to have.)

[wmf]

I assume protocols like Paxos can work with any odd number of generals. Since the generals are anonymous, consider a Sybil attack. If there are N total generals, what's to prevent me from claiming that I am all N generals? If there are N total generals but M entities try to each spam the system with fake generals, how does the system decide?

[semi-extrinsic]

So you're saying blockchains prevent this because proof-of-work? I.e. that you literally can't run a Sybil attack, because the only way to impersonate N miners is to actually run N miners?

[wmf]

Yes. (Modulo arguments about the definition of "blockchain".)

[riprowan]

How can you know a general is not a sybil?

[IshKebab]

> making it improbable that a single entity can exceeded 50% of the total hash power

Not that improbable: http://www.coindesk.com/ghash-io-never-launch-51-attack/

[CyberDildonics]

Keep in mind that a 51% attack doesn't guarantee anything, it just increases the likelyhood that you can reorder transactions.

[jcoffland]

True, and the problem gets worse with less participants.

[Marazan]

What? The Byzantine generals problems most certainly did have solutions before Block chain came along.

[jcoffland]

Not for an unknown number of generals.

[skybrian]

True, but not necessarily that important. In world of Bitcoin this is important due to anonymity and criminal activity.

In a regulated industry there are other ways to prevent cheating. Making cheating obvious and undeniable is probably enough to prevent it from happening (due to legal risk).

[kpil]

In the context of banks, where there are a limited set of semi-trusted entities and multiple trusted third-parties, I seems that most most solutions to prevent cheating offers is either really similar to a trusted third party solution, or offers no major benefits, but comes with many drawbacks.

In cash transactions, it's hard to beat the speed of a trusted third party with a deposited "float" for ensuring that you can pay at the end of the day - even a bad day where a part defaults.

In securities, there is perhaps some room for a blockchain solution, as the infrastructure is much more complex and underdeveloped - due to the historically gigantic margins.

[jcoffland]

If a private blockchain forks how do you decide which one was the cheaters branch and which one legit?

[wmf]

The legit branch is signed/vouched by at least (N/2)+1 parties and the cheating branch has less than (N/2)-1.

[jcoffland]

So groups of banks get to vote on what is true or not. How could that ever fail. /s

[petra]

If that is viewed as a failure-mode before deployment, they can add servers at neutral bodies like courts, etc.