Score:1

Can the last n bitcoin blocks (including transactions) be reliable enough to be used as a seed for a PRNG or an input to a crypto hash-function?

ps flag

Suggested by u/HolgerBier on reddit

Is it unpredictable enough or too difficult to manipulate (as in more than a few hundred million USD) to have a sequence of blocks?

Score:2
fr flag

Bitcoin, like most other blockchains, has a well-ordered collection of blocks. However, because the longest valid chain is the correct one, it may happen that, at a particular time, it's not clear which chain is valid (say, if there are two competing proposals for block N). This will almost certainly be resolved in the future in favour of one chain or the other, as one is built on and the other is not. Provided you specify some defined format of the chain to hash, you can use this value as a hash input, but you may want to wait for a few blocks to be sure that you don't have competing chains.

Now, whether you should use this for a PRNG or other secret input is different. If you want a secret input, this is not helpful, because if your project is interesting enough, it's possible for a mining group to get together and only attempt to mine blocks that would produce a certain outcome. For example, if you had a coin flip that determined who would win a large amount of money, it might be interesting to mine only the block that would let a certain person win. This becomes more complicated if there are many possible outcomes, since it increases the complexity of the attack, but in general, you cannot assume the output of a blockchain is random and free of influence. This is true even if multiple parties agree on a future block hash (say, N + 5). That would still provide the same incentive to attack the PRNG.

If you're looking to have a group of people agree on a secret seed ahead of time, each person can generate a random 256-bit secret $ S $, and then commit to it using a commitment scheme (such as the output of $ HMAC-SHA256(K, S) $ with a per-user random 256-bit $ K $). Everyone shares their commitment ahead of time, and then reveals their $ K $ and $ S $, and the $ S $ values can be used in a fixed order for a hash or seed. If you need to not reveal the value of the PRNG ahead of time (say, for playing a card game), you can send the $ S $ values to one person (the dealer), and then reveal the commitments at the end.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.