Subject: Re: [Bitcoin-development] libzerocoin released, what about a zerocoin-only alt-coin with either-or mining

From: John Dillon <[email-masked]>
Date: Sun, 14 Jul 2013 19:52:56 +0000

On Sun, Jul 14, 2013 at 7:42 PM, Pieter Wuille <[email-masked]> wrote:
> On Sun, Jul 14, 2013 at 07:33:06PM +0000, Luke-Jr wrote:
>> Invalid blocks are rejected by validating clients in all circumstances.
>
> I don't think that's what John means.
>
> If you have hash power for the parent chain, mining invalid blocks for the
> merge-mined chain costs you nothing. Yes, they will be invalid, but you've
> lost nothing.
>
> The basic assumption underlying mining security is that it is more profitable
> to collaborate with mining a chain (and profit from the block payout) than to
> attack it. In the case of merged mining, this assumption is not valid.

You said it better than I did.

Essentially I am worried about the chain being strangled at birth, merge-mining
makes doing so cost nothing for the attacker. With zerocoin this is a
particularly dangerous possibility due to those in the Bitcoin community who
would like to see Bitcoin continue to have poor privacy properties.