I think it’s a very fair and a very simple question that warrants a simple answer. Ouroboros forms an open BFT network. It’s known that long range attack scenario is one of the most trivial attacks on open BFT networks. I think given the popularity of the attack, it’s fair to demand a down-to-Earth explanation which is as abstract as the description of the attack.
Addendum:
The original Ouroboros paper, upon inspection, provides a rather handwavy argumentation, which would also require some elaboration! Citing verbatim, emphasis mine.
Nothing at stake attacks
The “nothing at stake” problem refers in general to attacks against
PoS blockchain systems that are facilitated by shareholders continuing simultaneously multiple blockchains exploiting the fact that little computational effort is needed to build a PoS blockchain.
Provided that stakeholders are frequently online, nothing at stake is taken care of by our analysis of forkable strings (even if the adversary brute-forces all possible strategies to fork the evolving blockchain in the near future, there is none that is viable), and our chain selection rule that instructs players to ignore very deep forks that deviate from the block they received the last time they were online.
It is also worth noting that, contrary to PoW-based blockchains, in our protocol it is infeasible to have a fork generated in earnest by two shareholders. This is because slots are uniquely assigned and thus at any given moment there is a single uniquely identified shareholder
that is elected to advance the blockchain. Players following the longest chain rule will adopt the newly minted block (unless the adversary presents at that moment an alternative blockchain using older blocks). It is remarked in [15] that the “tragedy of commons” might lead stakeholders in some PoS based schemes to adhere to attacks because they do not have the power to deter attacks by themselves and would incur financial losses even if they did not join the attack. This would lead rational stakeholders to accept small bribes in alternative currencies that might at least obtain some financial gain. However, in the incentive structure of Ouroboros, slot leaders and endorsers who could potentially join an attack would receive rewards in both the main and the adversarial chain, resulting in those stakeholders not achieving higher profits by joining the attack.
Indeed, the idea of synchrony plus requiring stakeholders to be online is a great answer to the problem. As far as I understand the Ouroboros’s answer to the long range attack goes like this:
- Require rough synchrony (everyone := players + stakeholders can always know in which slot they are, even with slightly desynced clocks)
- Require presence from stakeholders (those who have a chance to issue a block unilaterally)
- Show that the length of the slot is enough for transaction finality. It means that now any forgery will have to rely on at most last epoch (a collection of slots, for which MPC random generator determines slot leaders).
3 is very dense and isn’t obvious from 1 and 2, but I’ll try to ELI5 it anyway. Slot leaders are determined in batches via a multi-party-computation algorithm, with probabilities proportional to their stakes. There is no way to vote yourself in as a slot leader ever, it’s random and proportional to stake. Players (regular actors who want to just verify the chain) can follow the trace of this MPC and verify its outcome. The function that assigns slot leaders is deterministic, absolutely new player will be able to follow the longest chain with a rather high probability, due to the online assumption. The genesis block is invulnerable to long range, then, as the player follows the chains available, the probability of the longest chain being adversarial is ~0. During this traversal, the player contacts a lot of slot leaders, at least $SECURITY_PARAMETER of whom is honest, thus, coupled with online requirement, selection of epoch length and the string prefix proof from the paper (sorry, you’ll need to read the proof there), there’s an overwhelming probability of constructing the longest honest chain. Now when it comes to the “exit” attacks during a particular epoch (they are no longer “long range attacks”! But still are a kind of a “nothing-at-stake” attack) – they are, indeed, possible, but txs in blocks within the current epoch may be treated by the player as not-yet final which should mitigate this “short range” “nothing at stake”.
I have no idea how Ouroboros Paros works though, I just followed the link sent by @adatainment and re-told it in this thread because it will be useful for someone.
. That was not intentional, of course.