On the insecurity of quantum Bitcoin mining

Abstract

Grover’s algorithm confers on quantum computers a quadratic advantage over classical computers for searching in an arbitrary data set, a scenario that describes Bitcoin mining. It has previously been argued that the only side effect of quantum mining would be an increased difficulty. In this work, we argue that a crucial argument in the analysis of Bitcoin security breaks down when quantum mining is performed. Classically, a Bitcoin fork occurs rarely, i.e., when two miners find a block almost simultaneously, due to propagation time effects. The situation differs dramatically when quantum miners use Grover’s algorithm, which repeatedly applies a procedure called a Grover iteration. The chances of finding a block grow quadratically with the number of Grover iterations applied. Crucially, a miner does not have to choose how many iterations to apply in advance. Suppose Alice receives Bob’s new block. To maximize her revenue, she should stop and measure her state immediately in the hopes that her block (rather than Bob’s) will become part of the longest chain. The strong correlation between the miners’ actions and the fact that they all measure their states at the same time may lead to more forks—which is known to be a security risk for Bitcoin. We propose a mechanism that, we conjecture, will prevent this form of quantum mining, thereby circumventing the high rate of forks.

Appendices

Subtle implications of quantum mining

Quantum mining has some subtle implications, which are discussed below.

1.1 Effects on the confirmation time

The confirmation time for a transaction is defined as the time it takes for the transaction to be included in a block after being broadcast to the network by the user. Classically, it takes a miner a fraction of a second for each attempt to solve a proof-of-work puzzle. Upon receiving a transaction, a miner can include the transaction in the next attempt to solve the proof-of-work puzzle. Therefore, a block typically contains the transactions paying with the highest fees (measured in bitcoin per byte) that fit into a block⁸ at the time that the block was mined. For a user who is willing to pay enough, under normal circumstances (i.e., assuming that the user has Internet connection, miners are rational, no denial-of-service attack, etc.), she can guarantee that her transaction will be confirmed in the next block by offering a high enough fee (for example, a higher fee rate than all others).

A quantum miner can only update her block after a full run of the Grover algorithm. This condition holds with or without our proposed selection rule. For example, if the number of Grover algorithm iterations by all miners is set to 2 min, a user who offers a high enough fee can only guarantee her inclusion in blocks created 2 min after the transaction is broadcast. In a more realistic scenario, where the number of Grover iterations is chosen according to some distribution, users who pay high enough fees can only be guaranteed inclusion in the next two blocks (rather than in the next block, which is the current state of affairs).

Apparently, the reduced ability to guarantee inclusion is relatively unimportant since the block creation process is already unpredictable: There are no guarantees regarding the time it will take for the next block to be mined (only the expected time is guaranteed). Quantum mining will only increases the unpredictability. More precisely, although classically, a user could guarantee that a transaction would get included in the next block, she could not guarantee the more important property, i.e., when it would get included. Because this property cannot be guaranteed, the loss of the guarantees on the less relevant property is of secondary importance.

1.2 Economy of mining equipment

Suppose there are two classical mining devices with hash rates of x and 2x. Other things being equal (such as electricity consumption), we would expect the second device to cost twice as much as the first, since classically, the revenue from Bitcoin mining is linear in the hash rate. For quantum devices, the quadratic speedup renders a different scenario: One would expect, at least naively, that the cost of the second device will be quadruple that of the first.

Were such a cost difference the case, quantum Bitcoin mining hardware manufacturers would be more strongly motivated to improve the hash rate (analogous to CPU speed), a scenario that may also exist in other markets affected by quantum speedups. This example is illuminating, since the connection between computational power and revenue is direct and can be calculated easily.

1.3 Finding the equilibrium and barrier of entry

The current strategy for classical miners is extremely simple: mine on top of the tip of the longest chain as fast as possible. It is plausible that in the PQMS equilibrium, the distribution over the number of Grover iterations Q the miner should apply (see Algorithm 1, line 6) in a PQMS would depend on the properties of the other miners (most importantly, the number and hash rates of the mining devices in each pool). To see a concrete example of such a dependence, see [18]. This information may not be accessible to all miners, in which case equilibrium would not be achieved.

Outside equilibrium, miners with more information about the strategies of the other miners would realize higher profits. This may lead to a high barrier to entry, which does not exist now.

An unsuccessful countermeasure

Equation (2) provides a new default tie-breaking rule as a countermeasure—a mechanism that we conjecture prevents the AQMS. In an earlier version of this manuscript, we provided a different, older rule that, it turns out, prevents the AQMS. But in so doing, it introduces a new vulnerability, which was discovered by Troy Lee. The goal of this Appendix is to explain the earlier countermeasure and the resulting vulnerability.

The old tie-breaking rule was as follows: Suppose the tips of the longest chains have timestamps $s_1,\ldots , s_n$, and they were first received at the times $t_1,\ldots ,t_n$. Let $t_{min}=\min _{i\in [n]} t_i$ and let the penalty of each of these tips be defined as $p_i=|t_{min} - s_i|$. The (old) default strategy was to mine “on-top” of the block that had the lowest penalty $p_i$.

Though the (old) tie-breaking rule seems to efficiently prevent the AQMS strategy, consider Mallory, the malicious miner who wants to harm Alice, an honest miner. We assume Mallory has an complete knowledge of the network and its properties, and we present a strategy that can be executed at no cost.

Consider the following example. Let us assume that a block sent by Alice is received by all the other miners after exactly 1 second and that Mallory is also aware of Alice’s activity. Mallory waits for Alice to create a valid block. Suppose that a block has a timestamp $s_A$ and that it was received by all the other miners at time $t_A = s_A + 1$. Mallory then starts mining a block with the timestamp $s_M=s_A+1$. Suppose that Mallory finds a block after running Grover’s algorithm for 100 seconds. As her block will be received much later than Alice’s block—roughly, $t_A + 100$, and therefore, $t_{min}$ will remain $t_A$. Note that Mallory’s penalty in this case is $|t_{min}-s_M|=|t_{min}-s_A+1|=0$, whereas Alice’s penalty will be $|t_{min}-s_A|=1$, and therefore, Mallory will minimize the penalty and win the fork race. As a result, other miners will start to mine on the top of Mallory’s block rather than on Alice’s block. In terms of costs—since all miners will mine the top of Mallory’s block if she succeeds—the strategy used by Mallory entails no risk to her, but it may cause Alice to incur significant damage. Insofar as Bitcoin mining is a zero-sum game, it may even be indirectly beneficial to use this strategy not just to attack others. We emphasize that Mallory does not need to be well connected to the other nodes. Rather, she needs to know Alice’s propagation time. We are not aware of similar classical or quantum attacks in the context of mining. This attack does not work if the default tie-breaking rule is as defined in Eq. (2). Note that in this example, $|s_M-t_M|$ is roughly 100 seconds, and basically, because of that, Mallory’s penalty will be higher than that of Alice. Therefore, this specific attack will not work.