As the author of the quoted article noted himself:
Originally, I thought that this problem was fundamental, but in reality it’s an issue that can be worked around. One solution, for example, is to note that every block must have a timestamp, and users reject chains with timestamps that are far ahead of their own. A long-range attack will thus have to fit into the same length of time, but because it involves a much smaller quantity of currency units its score will be much lower.
So your conclusion about the impossibility of the 'secret chain' with only 1% stake outpacing the main chain is correct, given that the clients validate the block timestamps (they can't go too far into the future).
However, the 51% attack in the basic PoS seems possible even outside the context of a long-range attack. The attacker having the 51% stake will create blocks on his secret chain and not on the main chain and eventually outpace the main chain.
When I say basic PoS I mean the system without any sophisticated features like the finality gadget described in the Mauve Paper where it's claimed that:
even majority collusions cannot conduct medium or long-range 51% attacks without destroying all of their ether.
The term Long-Range Attack can refer to different things depending on the cryptocurrency and the chosen algorithm. The formula that you included in your answer
hash(kernel) ≤ target × balance of UTXO
does not apply to Ethereum and Casper as there is no UTXO there.
The Preprogrammed long-range attack described in the NeuCoin whitepaper that stems from the fact that the stake modifier of a given stake is static and due to the use of coin age in the mining equation, doesn't apply to Ethereum either.
I am by no means an expert in PoW but I'll try to outline the logic behind the Long-range attack described in this article by V. Buterin that will work even with less than 50% stake:
- If we are given the simplest PoW algorithm where every account has a certain chance per second of generating a valid block. This chance is described with the formula:
SHA256(prevhash + address + timestamp) <= 2^256 * balance / diff
"There is nothing at stake" problem: a rational miner will choose to mine on both chains whenever there is an opportunity, to maximise his expected value.
- Miners who mine only on single chain are called altruistic.
- An attacker only needs to outpace altruistic miners to perform an attack, thus it's possible to perform this attack even having less than 50% stake (as long as non-altruistic miners' stakes add up to 51%).
To overcome this issue the slasher algorithm can be used. If a miner creates a block on 2 chains he will be punished. For that, anyone can submit the block from the other chain into the original chain in order to steal the mining reward.
- In order to make this algorithm scalable there has to be a limit on how many blocks back we need to look back in order to determine whether the submitted block belongs to the current chain or not (otherwise you would have to go back to the genesis every time). In Slasher it's 1000 blocks. Outside of this scope the punishing for mining on side chains doesn't work.
Long-range attack is when you start mining a sidechain 1000 or more blocks back.
- Other non-altruistic miners will mine on that chain too since there is no punishing and the expected value is higher.
- As long as the total stack of non-altruistic miners and the attacker adds up to 51% or more the side chain will eventually outpace the main chain and the attack will succeed.