As the author of the quoted article noted himself:
Originally, I thought that this problem was fundamental, but in reality it’s an issue that can be worked around. One solution, for example, is to note that every block must have a timestamp, and users reject chains with timestamps that are far ahead of their own. A long-range attack will thus have to fit into the same length of time, but because it involves a much smaller quantity of currency units its score will be much lower.
So your conclusion about the impossibility of the 'secret chain' with only 1% stake outpacing the main chain is correct, given that the clients validate the block timestamps (they can't go too far into the future).
The term Long-Range Attack can refer to different things depending on the cryptocurrency and the chosen algorithm. The formula that you included in your question
hash(kernel) ≤ target × balance of UTXO
doesn't apply to Ethereum and Casper as there is no UTXO there.
The Preprogrammed long-range attack described in the NeuCoin whitepaper that stems from the fact that the stake modifier of a given stake is static and due to the use of coin age in the mining equation, doesn't apply to Ethereum either.
I am by no means an expert in PoW but I'll try to outline the logic behind the Long-range attack described in this article by V. Buterin that will work even with less than 50% stake on 'non-secret' chain:
- If we are given the simplest PoW algorithm where every account has a certain chance per second of generating a valid block. This chance is described with the formula:
SHA256(prevhash + address + timestamp) <= 2^256 * balance / diff
"There is nothing at stake" problem: a rational miner will choose to mine on 2 chains or more whenever there is an opportunity, to maximise his expected value.
- Miners who mine only on single chain are called altruistic. Miners who mine on as many chains as they can (rational) are called non-altruistic.
- An attacker only needs to outpace altruistic miners to perform an attack, thus it's possible to perform this attack even having less than 50% stake (as long as non-altruistic miners' and attacker's stakes add up to 51%).
To overcome this issue the slasher algorithm can be used. If a miner creates a block on 2 chains he will be punished. For that, anyone can submit the block from the other chain into the original chain in order to steal the mining reward.
- In order to make this algorithm scalable there has to be a limit on how many blocks we need to look back in order to determine whether the submitted block belongs to the current chain or not (otherwise you would have to go back to the genesis every time). In Slasher it's 1000 blocks. Outside of this scope the punishing for mining on side chains doesn't work.
Long-range attack is when you start mining a sidechain 1000 or more blocks back.
- Other non-altruistic miners will mine on that chain too since there is no punishing and the expected value is higher.
- As long as the total stack of non-altruistic miners and the attacker adds up to 51% or more the side chain will eventually outpace the main chain and the attack will succeed.
The solution as the author noted is to introduce a rule into each client not to accept forks going back more than 1000 blocks. The problem is, however, what happens when a new user enters the picture. Then he considers hybrid PoW/PoS and social graph systems as a possible solution.
With the finality gadget described in the Mauve Paper:
even majority collusions cannot conduct medium or long-range 51% attacks without destroying all of their ether.