The backbone mission proved chain growth, common prefix and chain quality for every typical execution: one in which, on every window of at least rounds, the adversary finds fewer blocks than there are uniquely successful honest rounds. Garay, Kiayias and Leonardos show that under honest majority executions are typical except with probability exponentially small in . This mission proves that half: the random mining process, its expectations, Hoeffding concentration per window, the union bound, and the end-to-end statement that every consequence of typicality holds with probability at least , against any adversary strategy.
iIndepFun_rounds, map_eval_P): independent rounds, each a product of independent Bernoulli() queries, honest and adversarial.integral_round*, expect_X, expect_Y, expect_Z, expect_Y_sub_expect_Z, margin_ge_of_honest_majority, expect_Z_add_le_expect_Y, expect_Z_lt_expect_Y): , , , and with and the margin is at least .sets_hoeffding, window_bound, window_bound_rate): a window of rounds fails the typicality inequality with probability at most .typicalOn_failure_le_of_window, typicalOn_failure_le, typicalOn_prob_ge, typical_toExecution_iff, typicalTrunc_failure_le): on a horizon of rounds, typicality fails with probability at most , independently of the network and of the adversary's chain choices.backbone_failure_le, backbone_prob_ge, the goal): any property implied by legality and typicality, in particular the backbone mission's common prefix, chain growth and chain quality, holds for every adversary strategy with that probability.The bound is Hoeffding's, with each round's difference ranging over values, not the paper's multiplicative Chernoff bounds (absent from Mathlib), so the rate is weak when is large and small; the window conditions , are sufficient conditions chosen for clean statements. The execution is frozen after the horizon (party 0 mines alone, the adversary finds nothing) so that the deterministic theorems apply to infinite executions. The paper's separate bounds on are not proved; the deterministic layer does not need them. The common-prefix instance is a one-line composition left out of the public theorems because a split file cannot import another mission's solution. (ePrint 2014/765)
theorem BitcoinBackboneProb.backbone_prob_ge (n t : ℕ) (p : unitInterval) (lam L : ℕ)
(hlam : 2 ≤ lam) (hm : 0 < margin n t p)
(hk : 4 * t * (p : ℝ) ≤ ((lam : ℝ) - 3) * margin n t p)
(Q : BitcoinBackbone.Execution → Prop)
(hdet : ∀ E : BitcoinBackbone.Execution, E.Legal → E.Typical lam → Q E) :
1 - ((L : ℝ) + 1) ^ 2 * Real.exp (-rate n t p * ((lam : ℝ) + 1)) ≤
(P n t p).real {ω | ∀ base advParent : ℕ → ℕ → BitcoinBackbone.Chain,
(toExecution ω L base advParent).Legal → Q (toExecution ω L base advParent)} := by sorryFor any with hdet: with probability at least , for all base and advParent (an adaptive adversary), a legal induced execution satisfies . With the backbone mission's common prefix, chain growth or chain quality, this is the paper's Theorem: the properties hold except with probability exponentially small in , under honest majority.
No open leaves. Every sub-goal is proved or awaiting decomposition.