Thanks for the research.

> The complexity of the attack is ~1/r^2 epochs, where r is the fra=
ction of the block rewards that the quantum miner would have received if th=
ey mined honestly. This attack (or variants thereof) provides essentially t=
he same benefits as classical 51% attacks, including double spending, and a=
ll the revenue from the block rewards.=C2=A0

Qua=
ntum algorithm like Grover's algorithm are well-adapted to solve problems w=
ith a hidden structure, e.g where the answer can be easily verified.

<=
div>This is the case any randomly yielded state from a qubit vector can be =
fast verified as a PoW on a classical computer architecture.Howe=
ver, I'm not sure Grover's algorithm works well for dynamic block template =
construction and corresponding PoW calculations.

Any last-minute =
high-fee transaction might be selected in the block template, invalidating =
all the oracle calls performed so far by the run of the Grover's algorithm.=

Classical computers do not have this issue that you cannot obser=
ve the state until the computation ends, contrary to quantum computers.

Inability to adapt to a fast-dynamic fee market might render this 51=
% attack unsustainable, in a post-subsidy world.

>=C2=A0**The attack isn't relevant for the=C2=A0forthcoming years, requiring an extremely fa=
st, noise-tolerant quantum computer.**

=
Information on what is the qubit format and associated solid-state technolo=
gy used for the estimation can be valuable. Especially to estimate the real=
-world energy cost compared to hydro pure ASIC-based mining infrastructure.=

Best,

Antoine

<= /div>

Le l=
undi 18 mars 2024 =C3=A0 13:31:37 UTC, Or Sattath a =C3=A9crit=C2=A0:

<= /div>

<= /div>

Hi,In a recen= t work=C2=A0with=C2=A0Bolton B= ailey (still not peer-reviewed)=C2=A0, we showed how a single quantum miner= , with relatively little hashing power, can execute a 51% attack.The at= tack isn't relevant for the=C2=A0forthcoming years, requiring an extremely fast, noise-tolerant quantum = computer.The attack is surprisingly simple. The attac= ker creates a private fork, increasing the difficulty by a factor c. Due to= the properties of Grover's algorithm, it is only \sqrt c harder for th= e quantum miner to mine at the new difficulty level, but these blocks count= as $c$ times more for the PoW. Therefore, by mining even a single epoch fo= r a large enough $c$, the quantum miner can generate more proof-of-work tha= n the competing (classical) chain. The complexity of the attack is ~1/r^2 e= pochs, where r is the fraction of the block rewards that the quantum miner = would have received if they mined honestly. This attack (or variants thereo= f) provides essentially the same benefits as classical 51% attacks, includi= ng double spending, and all the revenue from the block rewards.=C2=A0=This attack might be relevant when considering future p= rotocol modifications.Or

You received this message because you are subscribed to the Google Groups &= quot;Bitcoin Development Mailing List" group.

To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoind= ev+unsubscribe@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msg= id/bitcoindev/ee24a4e6-52fe-4e9a-93bb-f37a24f87a89n%40googlegroups.com.=

------=_Part_3961_1012099564.1710967353965-- ------=_Part_3960_2107380359.1710967353965--