This page claims that it could be a group of people who made it, which seems a bit more likely: https://en.bitcoin.it/wiki/Satoshi_Nakamoto
Does anyone else have any interesting insights into the origin of Bitcoin?
It is not that I mean to insult amateurs -- amateurs can theoretically make secure cryptosystems (though Bitcoin is not secure under the security notions used by cryptographers), but it is usually pretty clear when a system was designed by someone who is not well-versed in cryptography. It is unfortunate, however, that Bitcoin's developers cannot be bothered to search Google:
https://www.google.com/search?q=digital+cash+site%3Aeprint.i...
This is interesting because if it wasn't secure I wonder why hundreds of millions of dollars have not been stolen yet? You could probably steal 100 million from some top addresses, move to MtGox and sell for a very decent rate before what you did became apparent (of course once what did became apparent Bitcoin would collapse forever)
Or if the addresses are secure and its something else that is not secure what is it? I am on the bitcointalk forum a lot and I have not read anything about the crypto being not secure.
Maybe I misunderstand what you mean by security?
In the case of Bitcoin there's the 51% attack, which is pretty serious flaw even if to carry it out is unfeasable.
We don't know if NSA or GCHQ have broken bitcoin (although they've certainly investigated it); and we haven't seen much crypt-analysis on it; but we have seen very many people trying (sometimes successfully) to attack Bitcoin and the wallets and the exchanges.
There isn't anything magical about the number 51, the original Bitcoin paper gives a program that can be used to compute the success probability for an attacker with a given share of the computing power to reverse transactions to a given depth... At >=50% the probability becomes one but at that point only if the attack is of infinite duration. But, for example an attacker with 40% hashpower can reverse six blocks with a 50% success rate.
Any kind of consensus system is going to be vulnerable to a majority attack of some kind— otherwise you'd have "minority imposes a wrong outcome" attacks.
At least in Bitcoin the "consensus" only controls transaction ordering: a majority attacker can't inflate the supply or spend other people's coins... they can only DOS and remove transactions from the fixed consensus (and thus replace their own). Which is powerful but still limited.
Some are self-executing, by which I mean that they can be enforced "by construction" - if you create an object that doesn't follow the rule, other people will know. Said another way, breaking the rule would also require breaking some crypto.
Some rules, though, are social. For example, why does everyone try to extend the longest branch in the block chain? Sure, the protocol says it's the rule, but why should that mean anything? People don't follow rules because they want to. They follow rules because it's in their enlightened self interest to do so. If you could make money by choosing a different rule, somebody would do that instead. So it must be that these rules get followed because it's in the interest of Bitcoin players to follow them. The natural follow-up question is whether these social/economic rules are stable. That is, why not some other solution? Why not only extend blocks whose (nonce % 0x0d) == 0?
Cryptographers use a very particular notion of security in which they like the security of their schemes to "reduce" to a well-understood assumption. That is, we prefer it you can prove something like "if you can break my system, then you can also solve problem X" where problem X is well-known and widely thought to be very hard. Then either I am forced to believe that your system is secure or that you have found an efficient way to solve problem X. And since solving problem X is unlikely, I should consider your system secure.
As I said, some parts of Bitcoin do reduce in this way to known cryptographic primitives (which in turn reduce to problems we believe are hard). But not all the parts.
But its not set in stone and the lead developers do have a huge amount of control.
Also many disagreements in the forum about the max block size and blocking Satoshi Dice do worry me.
There's still time, but it really is something you don't want to mess up. https://bitcointalk.org/index.php?topic=157141.0
You're taking a fundamentally confused position here. Consider: You have UberCoin— it is whatever spherical cow cryptocoin. EvilPal(Inc) then forks UberCoin and replaces its insides with a frontend to their EvilPal website (which then also copies in all the UberCoin ledger). By reduction, all digital currency systems are "social rules". It's not a useful description.
The longest chain rule is a rule that comes about for creating consensus in the system. If you change it in yours you will eventually break off into a private universe. The behavior actually does work by construction— but like my EvilPal example, that doesn't stop a stupid user from changing their own software to break off into another universe.
If you would like a longer formal analysis of the consensus mechanism in Bitcoin please see: https://socrates1024.s3.amazonaws.com/consensus.pdf
Bitcoin shipped and that shouldn't upset you so much.
- Sure some of the links in the Google search have lots of complicated schemes for a digital currency, but I think its the simplicity of the Bitcoin system that is unique.
- Also I hear the system itself can only be attacked via brute force, do you claim this is not the case?
The best known double-spending attack on Bitcoin requires work equal to the sum of all work done by the honest parties in the system. That is not a very high security margin; by comparison, attacking many of the systems from the Google search would require work that is exponential in the parameters of the system, while the honest parties only do work that is polynomial in those parameters. Forcing the attacker to do exponential work in the system parameters is the typical requirement for a cryptosystem to be "secure," and thus Bitcoin is not actually secure under the commonly accepted notions of security (at least among cryptographers).
Since you're apparently a professional cryptographer who would have designed a flawless Bitcoin right off the bat; Why don't you share some of your wisdom and point out a few of the amateur problems and how you would solve them?
I'm sure the Bitcoin community would be grateful for your input.
There is no particular need for me to design a better digital cash system; such systems have already been designed. It is not even clear that digital cash without a central authority can be provably secure, since nobody has proposed a security definition for digital cash that does not involve some currency issuing authority (no, Bitcoin's definition does not count -- it does not rule out feasible attacks). Personally, I have no real problem with having a "bank" that issues currency, as long as the bank cannot frame people for double spending or other cheating (which is the kind of protection that was described by Chaum and other researchers in the 90s).
So really, the ball is in the Bitcoin community's court. The research results on digital cash and secure multiparty computation is all publicly available and mostly available at no cost. Let the Bitcoin community develop a definition of security for digital cash without any "bank" if that is their goal; all that I am saying is that the definition must rule out feasible attacks if we are expected to take it seriously.
So far, it works. If BTC stops working, you can expect everyone to jump ship and hopefully a more secure alternative will be developed with lessons learned from the BTC ride. But for now, unless you can produce an attack that can lose people money in the bitcoin ecosystem, ranting about theoretical cryptosecurity in digital currencies and how BTC only being as secure as the majority of the swarm allows doesn't make anyone hesitant to invest in bitcoin.
> I have no real problem with having a "bank" that issues currency
The problem with banks is that they can always act in their own self-interest to fuck over the holders of their currency, and by having the only right to "counterfeit" their currency they have abnormal economic power in the economy their currency drives. It is the reason the US Federal Reserve is so corrupt right now, can wildly print US dollars to their own discretion, which is effectively stealing from anyone holding dollars by devaluing the currency as a whole, and they can do it at their own whims.
You're kidding, right? Bitcoin is the single most impressive application of cryptography that I have ever seen in my entire life, and I get to look at a lot of cool cryptosystems. The only entity that could have created Bitcoin is some kind of savant or a group of very talented people.
>ECDSA and SHA256 are referenced but little is said about whether or not they compose securely with the Bitcoin protocol, or even if the Bitcoin protocol itself is secure.
By making only a few basic assumptions about the security of SHA, RIPEMD, and ECDSA, it's plainly obvious to anyone who remotely understands the protocol that the protocol is, in fact, secure. If you don't believe me personally, why don't you ask all the talented cryptographers who could lay their hands on over a billion dollars if they found a critical flaw in the Bitcoin protocol?
>(though Bitcoin is not secure under the security notions used by cryptographers)
You have no idea what you're talking about. Bitcoin makes very strict security guarantees and does not violate them.
After all, there are really only two cryptographic ideas in Bitcoin: One is to used public key cryptography and signatures for transactions, which is completely obvious. The other is to use hashing for proof-of-work to build the block chain. This is certainly less obvious, but it wasn't outlandishly new either. Ideas like hashcash have been around much longer than Bitcoin.
Putting it all together in this way with its appeal to the goldbug mindset was certainly clever. But you are seriously overestimating the amount of intelligence required for developing Bitcoin.
No way. Have you looked at the whitepaper? The entire thing? Even completely ignoring the clever leveraging of cryptography, the sheer genius behind the methodology of the protocol makes me think that someone(s) extremely talented came up with it.
>Ideas like hashcash have been around much longer than Bitcoin.
True, but much of the genius comes from the way transactions themselves work. Right now, we're only leveraging a small portion of Bitcoin's capabilities. Because Bitcoin is really based on scripts assigned a value, the Bitcoin protocol allows for incredibly complex economic interactions in a cryptographically secure manner. The deeper I look into the protocol, the more I realize how genius some of the design decisions were.
And besides, Bitcoin obviously did something right, because it's the only decentralized digital currency to take off.
>But you are seriously overestimating the amount of intelligence required for developing Bitcoin.
I think you're underestimating the elegance and complexity of the Bitcoin protocol. It's much, much more than a few crypto primitives strung together.
Amateurs can be talented. On the other hand, look at how the Bitcoin protocol is described and how its security is analyzed -- no formal definition of security properties, no formal threat model, analysis that is limited to a specific attack strategy, etc. The most talented person in the world cannot be expected to duplicate the decades of research on secure multiparty computation and digital cash single-handed.
For comparison, here is the work of a pair of talented (i.e. Turing award winning) cryptography researchers:
http://groups.csail.mit.edu/cis/pubs/shafi/1982-stoc.pdf
"And besides, Bitcoin obviously did something right, because it's the only decentralized digital currency to take off."
I think the vast majority of Bitcoin users know little about Bitcoin's security properties or what it means for Bitcoin to be "secure." The fact that a system is popular does not mean that the system is secure, even when the purpose of the system is to provide security. Caesar ciphers remain remarkably popular, despite the ease with which they can be cracked.
It is also worth pointing out the Bitcoin is pretty unique in not having a "bank." Most digital cash systems require that currency be issued by an authority of some kind, and seek only to decentralize transactions (i.e. allowing offline transactions). Being the only digital cash system without a bank that became popular is not as big of an achievement as you make it seem -- there was not much competition there to begin with.
Not this talented. And you are aware that it's likely that "Satoshi Nakamoto" was actually a team of programmers, right? You don't get that kind of collaboration with clueless college kids.
>no formal definition of security properties, no formal threat model, analysis that is limited to a specific attack strategy
Why would they do that? Nakamoto wasn't selling the bloody thing, he was sharing the idea. We, the developers, have done this independently after Nakamoto fell off the radar.
>I think the vast majority of Bitcoin users know little about Bitcoin's security properties or what it means for Bitcoin to be "secure."
Maybe in the last year or so, but before that, 90% of the Bitcoin community was well educated on cryptography, and most of the power users still are.
>The fact that a system is popular does not mean that the system is secure
You're leaving something important out; the system is popular and the system has not been defeated in any meaningful capacity. That is a strong indicator of security.
>It is also worth pointing out the Bitcoin is pretty unique in not having a "bank." Most digital cash systems require that currency be issued by an authority of some kind, and seek only to decentralize transactions (i.e. allowing offline transactions).
No kidding! That's the whole motivation behind Bitcoin in the first place.
>Being the only digital cash system without a bank that became popular is not as big of an achievement as you make it seem
Are you shitting me? This is by far one of the biggest achievements in applied computer science in the last 25 years. Do you have any comprehension of the sheer number of previously purely theoretical methodologies leveraged to make Bitcoin happen? I feel like you're kind of dismissing Bitcoin without really completely understanding it.
Why would they do that?"
So that we can determine whether or not the system is secure before we commit to it. Replacing insecure cryptosystems is usually very expensive.
"the system has not been defeated in any meaningful capacity. That is a strong indicator of security."
As far as the Germans knew, Enigma had not be broken in any "meaningful capacity" either. They knew there were weaknesses but they did not believe anyone would go to the lengths required to exploit those weaknesses:
https://en.wikipedia.org/wiki/TICOM
Saying "well it has not been broken yet (as far as we know)!" is not a very good argument for security. Even AES has better arguments for security, based on models and heuristics that took many decades of work to develop.
"This is by far one of the biggest achievements in applied computer science in the last 25 years"
More than CAT scans? More than the Internet? Even if we limit ourselves to cryptography, it is clear that that is untrue. What do you think sees more widespread use: Bitcoin, or Kerberos? What do you think had a wider impact on the world: Bitcoin, or HBO encrypting its satellite feeds (for those who are not familiar, that was a major step toward widespread DRM)?
Bitcoin as an application of cryptography or computer science is not even a blip on the radar of achievement.
Double spending in Bitcoin requires the attacker to do duplicate the work done by all honest parties in the system; that is basically a polynomial time attack. This is documented in the original Bitcoin paper. It falls short of the standard for security that cryptographers generally deal in, which requires that the attacker's work be exponential in the parameters of the system.
Again, I don't mean to be dismissive of outsiders -- at one time, Diffie and Hellman were outsiders. The question that was asked was what can be concluded about Satoshi's true identity; that he (they?) is not well-educated in cryptography seems like a reasonable conclusion given what he published.
Yes, it is. Cracking previous digital cash systems fell into the class of "hire a hacker" difficulty problems, which are significantly less difficult than the P difficulty problem presented by pulling off a 51% attack on the Bitcoin network.
>that he (they?) is not well-educated in cryptography seems like a reasonable conclusion given what he published.
Right, the person/group who published what may be the most significant usage case of applied cryptography in human history is probably not educated in cryptography. Have you even read the whitepaper? Perhaps you would change your tune if you saw what is actually being guaranteed. Nakamoto was perfectly aware of the challenges. When I say "Bitcoin is secure", that's by my standard, not Nakamoto's. I can't speak for him/them.
David Chaum would disagree with you. Cryptographers have published a very large volume of research on how to create provably secure digital cash.
"Right, the person/group who published what may be the most significant usage case of applied cryptography in human history is probably not educated in cryptography"
So you think that someone who made no mention of any of the widely studied notions of security, any of the previous work in multiparty computation, any of the previous work in digital cash, or even the fact that allowing polynomial time attackers is a significant weakness in the design was well-educated in cryptography?
"Have you even read the whitepaper?"
The Bitcoin whitepaper reads like the work of someone who took an undergrad course in cryptography and spent a summer thinking about decentralized payments. Where is the notion of security even clearly defined -- what does it even mean to prevent double spending? What does it mean to control "more CPU power" than an attacker?
Compare the Bitcoin paper to this (just a random result from Google):
http://eprint.iacr.org/2007/148.pdf
Look at how security is defined in Section 3.2; that is typical of cryptography research in this day and age. Those are definitions that can be reasoned about in a rigorous way, without hand waving, without poorly defined concepts like "CPU power," and without having to analyze any specific attack strategy (i.e. the attacker is a "black box"). Where in the Bitcoin whitepaper do you see that sort of analysis, or even a hint that such an analysis is possible, desirable, or commonly used?
The security analysis presented in the Bitcoin whitepaper assumes a specific attack strategy: the attacker will try to compute a longer block chain than the rest of the network. Ignoring for the moment that this can be done in polynomial time, what reason is there to believe that no other attack strategy is possible? Maybe the attacker can adaptively send malicious messages to particular nodes in the network to break the security of the system. In multiparty computation, security analysis is usually based on the "simulation paradigm" -- a model of security based on showing that no polynomial time attack has a higher probability of success in the real protocol as it would in a simulation of the real protocol where a trusted party does all the work (which rules out all polynomial time attacks). That is a widely accepted notion of security, and the cryptographers who first published it recently won a Turing award; while other models may be valid, one would have expected an experienced cryptographer to have at least mentioned that they were using a different model (and perhaps justify their approach).
The whitepaper also includes statements that suggest a profound lack of knowledge of the decades of previous work in the field of digital cash. There are claims that no system with a central authority can possibly allow irreversible transactions, but that is untrue -- cryptographers discovered systems that support offline payments, in a model where the bank takes some action when double spending is detected (and in some systems, the bank can produce a proof that double spending occurred and that it was performed by a specific party, allowing for a trustworthy blacklist). Privacy is mentioned, and again the author makes claims about systems with central authorities that are simply not true -- Chaum's original work on digital cash was motivated by the need for private electronic payments, and that was the first problem to be solved in this field.
"When I say "Bitcoin is secure", that's by my standard"
What is your standard, and why should anyone else accept it?