Longest Chain
The idea of proving work by spending it (expensive to produce, free to check) is from 1992 and was invented to make junk mail cost something. What 2008 added was using it to decide whose version of history is real, and it did that with no authority and no vote. The rule is that the history everybody agrees on is the valid chain carrying the most accumulated proof of work, which is a figure derived from the difficulty targets rather than a meter of what anybody actually spent: two blocks at the same target count the same whether one was found on the first try and the other after ten million. Everything strange about the arrangement follows from taking that literally. Nothing is ever final. A payment is only probably permanent, and how probably is a number you can compute. An attacker with enough of the hash power rewrites the past without breaking anything at all: they simply outspend everybody, and the same rule that protects the chain hands it to them.
New to history settled by cost? Start here
Deciding which of two conflicting histories is real cannot be done by counting votes, because anybody can make more voters. So the measure is not how many agreed but how much work was spent.
Work here means computation that is expensive to do and instant to check. The accepted history is whichever cost the most to produce, so rewriting the past means redoing all of it and outpacing everyone still building on the present.
Hard, not impossible
Nothing in this topic is unbreakable, and that is a claim about these machines rather than about cryptography. Each of them rests on an operation that is cheap in one direction and expensive in the other, and expensive means a number of steps so large that doing them costs more than the secret is worth. The one-time pad is the standing exception: it is not hard to break, it is impossible, and it is impractical for almost everything, which is why the rest of this topic buys difficulty instead.
That makes every claim here a claim with a date on it. Secure means secure for this long, against someone with this much to spend, assuming nobody finds a shortcut. The machines in this topic each rest on one of those one-way operations, and each is worth asking the same question about: what exactly would an attacker have to do, and how much of it.
The machine for this idea on its own is Diffie-Hellman, if you would rather press it than read about it.
A chain, the work behind it, and the race that decides
1 A hash chain, and what editing a block three back does to it
Three blocks, each naming its parent by hash. Edit the middle one and nothing is checked against a database: the hashes simply stop matching.
| # | contents | hash | nonce | state |
|---|---|---|---|---|
| 0 | the first block | 00099b55442b20 | 866 | valid |
| 1 | Alice pays Bob 10 | 00032366351266 | 4,265 | valid |
| 2 | Bob pays Carol 4 | 000f504dc3052d | 231 | valid |
- broken by that edit
- none: every block is still below the target
- cost to make it stick
- nothing to redo
The chain holds: every block hashes to something below the target and each names the one before it.
2 Work: a hash below a target, expensive to find and free to check
A block only counts if its hash starts with enough zeros. Finding one takes as many tries as the target demands; checking it takes one.
- hashes tried to build these blocks
- 5,365 hashes for 3 blocks
- hashes needed to check them
- 3 hashes, one per block, whoever is asking
That asymmetry is the whole mechanism. It is not that forging a block is forbidden; it is that it costs the same as making one honestly, and then the honest chain has moved on.
3 Two histories from one parent, and the one that survives
Two chains from one parent. The rule picks the one with more work behind it, so an attacker is not breaking anything — they are racing.
4 An attacker's share of the hash power, raced thousands of times
- Nakamoto's eventual catch-up probability says
- 7.87 per cent
- racing it out says
- 8.57 per cent over 3,000 races
- do they agree
- the formula and the races agree
An attacker with 30 per cent of the hash power, 3 blocks behind, catches up with probability 7.87 per cent. That is why waiting for more blocks is the only thing that makes a payment safer, and why it never makes it certain.
How many blocks to wait before the odds fall below one in a thousand.
| attacker has | wait for | odds then |
|---|---|---|
| 10 per cent | 4 blocks | 0.02 per cent |
| 20 per cent | 5 blocks | 0.10 per cent |
| 30 per cent | 9 blocks | 0.05 per cent |
| 40 per cent | 18 blocks | 0.07 per cent |
What this page checked when it loaded.
| claim | held | measured |
|---|---|---|
| SHA-256 of the empty string matches the published value | yes | e3b0c44298fc1c14… |
| and of "abc", likewise | yes | ba7816bf8f01cfea… |
| finding a hash with three leading zeros took thousands of tries | yes | 4,552 tries |
| and checking it takes exactly one | yes | |
| the catch-up formula agrees with a simulation of 4,000 races | yes | formula 7.9 per cent, simulated 8.4 |
| at half the hash power catching up is certain, given time | yes |
All 6 checks held when this page loaded.
What is real here, and what is not
The hashing is real; the difficulty is twenty orders of magnitude short of real
This is genuine SHA-256 over a genuine byte string, and the tries counted are tries actually made. What is not real is the target: three leading hex zeros is about four thousand attempts. Bitcoin's difficulty was 127.48 trillion at the adjustment of 8 August 2026, and a block takes difficulty times 232 hashes on average, which is about 5.5 × 1023 attempts, or 279, or twenty hex zeros' worth. That makes this toy one part in 1020 of the real thing. The mechanism is identical and the scale is not remotely.
There is no network here, and the network is where it gets hard
One machine, no peers, no propagation delay, no orphaned blocks, no mempool and no difficulty adjustment. Blocks arriving at different times at different places is what makes a fork happen in the first place, and selfish mining, where withholding a block beats publishing it, is a real result that this model cannot express at all. The race here is a random walk, which is Nakamoto's own simplification and not a simulation of a network.
The catch-up formula is the paper's, and it assumes an attacker who never gives up
The expression is from section 11 of the 2008 paper: an attacker with q of the hash power, z blocks behind, catches up with probability (q/p) to the power z. It assumes they keep trying forever and that the honest chain grows at a constant rate. The simulation beside it is a bounded random walk, so a race that would take longer than two thousand steps is counted as a loss, which makes the simulated figure very slightly low rather than high. It is checked against the formula rather than trusted on its own.
Fifty per cent is not a cliff, and the page tries not to draw one
Below half the hash power the odds fall off exponentially with depth; at half and above they are one, from any distance, given time. It is a genuine discontinuity in the formula. But an attacker at forty-five per cent already catches up from three blocks behind more than half the time, so the interesting region starts long before the famous number, and treating the majority threshold as the point where security stops is the wrong reading of it.
Proof of work is from 1992 and was not invented for this
Dwork and Naor proposed it to make sending junk mail cost the sender something: a puzzle expensive to solve and cheap to verify, attached to each message. Hashcash reused it against spam in 1997. What 2008 contributed was not the work but what the work is FOR, using accumulated cost as the rule that decides which history everybody follows, which is why the era on this page starts sixteen years before the paper it is about.
This is the eventual catch-up probability, not the other formula people mean
Section 11 of the whitepaper gives two different calculations, and the name Nakamoto's formula gets used loosely for either. The one on this page is the first: qz, defined there as “probability the attacker will ever catch up from z blocks behind”, which is (q/p)z when p is greater than q. It answers a question with no time limit in it, will he ever, and that is why it is an upper bound on the risk rather than the risk itself. The second calculation in that section is the one a recipient actually wants: having waited z blocks, the attacker's progress is Poisson-distributed, and the paper sums over how far he might already have got. That is a different number and this page does not compute it. An outside reader pointed out that the shorter label invited the confusion, and they were right.
Sources
- C. Dwork and M. Naor, Pricing via Processing or Combatting Junk Mail, CRYPTO 1992. Where the idea of proving work (expensive to do, cheap to check) is introduced, sixteen years before it was used for this.
- S. Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System, 2008. Section 11 is the calculation this page reproduces and checks against a simulation.
- I. Eyal and E. G. Sirer, Majority Is Not Enough: Bitcoin Mining Is Vulnerable, Financial Cryptography 2014. Why the majority threshold is not where the trouble starts, and what this page cannot show without a network.
- Logical Art, the studio this belongs to.