Bitcoin incorporates countless aspects of security. Some are exceedingly complex yet uncontroversial. Bitcoin’s “social security” is simple yet surprisingly controversial.
Bitcoin is not a payment protocol, it is a money. A money is useful because of its properties, one of which is immutability. Holders of a money suffer a loss when changes to the money are not predictable. Gold has been used as a money for millennia. It is much easier to discover than to manufacture, and its scarcity ensures a fairly predictable rate of inflation. If alchemists had discovered a way to change these “rules” of gold, they could have stolen from all others who held it.
Bitcoin’s social security architecture exists to prevent such changes. As an information money, its rules could otherwise be changed quite easily. There is only one case in which change to a money is not a theft — when every individual holding the money agrees to the change. Bitcoin therefore refers to its definition as consensus rules. It is not a problem that consensus is exceedingly hard to achieve, it is a requirement.
Social security is a consequence of choices made by people. It has nothing to do with cryptography, network protocols, hashing or any other technology. Bitcoin gives people the ability to make these choices, but effective defense is only a consequence of people actually doing so. In a previous post I explored definitions of decentralization for defense against against both changes to, and disruption of, the money.
State of Mining Decentralization
In Bitcoin, mining is only a defense if it’s distributed among a large number of people. The total level of mining is important, but it is only decentralization that makes it useful. A large amount of centralized hash power is at best a waste of energy and at worst a threat itself. In the current situation 8 mining pools direct 90% of the Bitcoin hash power.
It is an error to assume that widely used things will not be attacked by the state. There are countless existence proofs to dispel this theory, including alcohol, drug, gambling, firearm, and prostitution prohibitions as well as taxes and restrictions on travel, speech, trade, etc. But more to the point, witness the perpetual example of currency debasement.
Bitcoin social security is specifically designed as the defense against such attacks. But currently a state-level attack could subvert the protections of mining by direct action against 2 pools, and collusion of pools would enable just 2 people to subvert these protections. Whether or not they are likely to do so is irrelevant to Bitcoin’s security. What matters is the system’s ability to repel the attack.
State of Economic Decentralization
Large miners are publicly using their disproportionate influence over the network in an ongoing attack on consensus. While they do not have the ability to compel a hard fork, the attack is coordinated with payment processors and web wallet services. The lack of economic decentralization resulting from use of such services may result in a failure of Bitcoin’s defense of consensus.
Efforts by developers to persuade these people to preserve consensus are a matter of horse-trading. Round tables have the room to seat the people who can currently compel a change in “consensus” rules. This is sufficient evidence that Bitcoin’s social security has been reduced to a point where it is failing to achieve its objective.
I do not consider this a failure of Bitcoin, this is a human failure. Too many people have chosen to leave their doors unlocked. As developers we need to provide better information and tools for people to protect themselves. Self defense is the basis of social security.
Defining Social Security
So how would we define the state of social security? From the previous post:
economic decentralization = recipients * receipts standard deviation / receipts mean
mining decentralization = miners * hash power standard deviation / hash power mean
These definitions are a level of decentralization in two independent axes, not a level of security.
A maximum level of participation (recipients and miners respectively) at a maximum level of activity (receipts and hash power respectively) is required to achieve the maximum level of security. Given that there is no limit to humanity, trade or computation, the level of security in each axis is unbounded. A minimum level of zero in each axis is achieved with either no participants or no activity.
The level of security in each axis can thus be defined as a function of total humanity, participation, and levels of decentralization:
consensus security = receipts * economic decentralization / humanity
disruption security = hash power * mining decentralization / humanity
Note that this is the product of (1) the level of activity, (2) the coefficient of variation in the activity, and (3) the fraction of participating humanity. The last two factors are unitless (percentages). In other words, the level of security in each axis is a fraction of total activity:
security = activity * variation * participation
These relations do not say anything about the absolute effectiveness represented by any value, or the relative effectiveness of any two values except that a greater value represents a greater effectiveness. This is not due to a deficiency in the method. The factors include people, specifically the effectiveness of their individual abilities to resist (and their perception of value in the money). All who validate or mine offer some level of resistance, but there is no implied continuity. We refer to a “level” of security, not an “amount” of security.
Removing decentralization produces the following:
consensus security = receipts
disruption security = hash power
This is the reductio ad absurdum of any such theory. Activity only contributes to social security to the extent that it is distributed among independent people.
Price of Attack
Consensus and disruption security definitions cannot be combined. These definitions model attacks against distinct aspects of Bitcoin, with distinct consequences. Certainly such attacks can be applied in concert, but equating them would require pricing the consequences of each and defining the probably of occurrence, arriving at a unified concept of risk. This would only follow from projecting against historical measurement.
The price of a consensus attack is the price of forcing people to accept a change to consensus rules. In a highly centralized economy this would cost the price of a physical attack on a small number of people. For an evenly distributed economy, this may cost more than the amount of the money each person holds.
The price of a disruption attack is the price of directing a majority of total hash power. With highly centralized mining this would cost the price of a physical attack on a small number of people. For evenly distributed mining this would require independent production of 100% of the total other hash power during the attack.
A state actor may attempt widespread compulsion in either distributed scenario. This and the other decentralized attack scenarios are highly subjective and cannot be priced, even with a perfect measure of decentralization. The social security model rests on the axiom that such an attack is infeasible.
The fundamental difference in the security model of one who rejects decentralization is a different choice of axiom. Such a person accepts either (1) the state can be trusted to not attack the money, or (2) the state can be trusted with control of the money. Either is a choice that rejects Bitcoin and explains the interest in private blockchains.
We have proposed a system for electronic transactions without relying on trust.
– Satoshi Nakamoto