5 ms·

This article makes me ponder about the origins of Bitcoin. This page claims that it could be a group of people who made it, which seems a bit more likely: http

by veb 14y ago

This article makes me ponder about the origins of Bitcoin. This page claims that it could be a group of people who made it, which seems a bit more likely: https://en.bitcoin.it/wiki/Satoshi_Nakamoto https://en.bitcoin.it/wiki/Satoshi_Nakamoto Does anyone else have any interesting insights into the origin of Bitcoin?

betterunix 14y ago
Judging by the original paper, the subsequent writings, and the kinds of things prominent members of the Bitcoin community say, it is likely that whoever created Bitcoin was an amateur. There are few references made to the work done by Chaum or Okamoto. The security proof in the Bitcoin paper considers only one specific attack strategy. ECDSA and SHA256 are referenced but little is said about whether or not they compose securely with the Bitcoin protocol, or even if the Bitcoin protocol itself is secure. It is not that I mean to insult amateurs -- amateurs can theoretically make secure cryptosystems (though Bitcoin is not secure under the security notions used by cryptographers), but it is usually pretty clear when a system was designed by someone who is not well-versed in cryptography. It is unfortunate, however, that Bitcoin's developers cannot be bothered to search Google: https://www.google.com/search?q=digital+cash+site%3Aeprint.iacr.org https://www.google.com/search?q=digital+cash+site%3Aeprint.i...
- josephagoss 14y ago
  If you don't mind, how is Bitcoin not secure under the security notions used by cryptographers? This is interesting because if it wasn't secure I wonder why hundreds of millions of dollars have not been stolen yet? You could probably steal 100 million from some top addresses, move to MtGox and sell for a very decent rate before what you did became apparent (of course once what did became apparent Bitcoin would collapse forever) Or if the addresses are secure and its something else that is not secure what is it? I am on the bitcointalk forum a lot and I have not read anything about the crypto being not secure. Maybe I misunderstand what you mean by security?
  - DanBC 14y ago
    Cryptographers have a high standard for 'not broken'. A cryptographic algorithm could have no real world attack, but be declared broken because there's a mathematical flaw. In the case of Bitcoin there's the 51% attack, which is pretty serious flaw even if to carry it out is unfeasable. We don't know if NSA or GCHQ have broken bitcoin (although they've certainly investigated it); and we haven't seen much crypt-analysis on it; but we have seen very many people trying (sometimes successfully) to attack Bitcoin and the wallets and the exchanges.
    - arpp 14y ago
      Democracy is also vulnerable to 51% attacks ;P
    - nullc 14y ago
      > the 51% attack, which is pretty serious flaw even if to carry it out is unfeasable There isn't anything magical about the number 51, the original Bitcoin paper gives a program that can be used to compute the success probability for an attacker with a given share of the computing power to reverse transactions to a given depth... At >=50% the probability becomes one but at that point only if the attack is of infinite duration. But, for example an attacker with 40% hashpower can reverse six blocks with a 50% success rate. Any kind of consensus system is going to be vulnerable to a majority attack of some kind— otherwise you'd have "minority imposes a wrong outcome" attacks. At least in Bitcoin the "consensus" only controls transaction ordering: a majority attacker can't inflate the supply or spend other people's coins... they can only DOS and remove transactions from the fixed consensus (and thus replace their own). Which is powerful but still limited.
  - deepblueocean 14y ago
    I look at it this way: there are two kinds of rules in the Bitcoin system: crypto rules and social rules. Some are self-executing, by which I mean that they can be enforced "by construction" - if you create an object that doesn't follow the rule, other people will know. Said another way, breaking the rule would also require breaking some crypto. Some rules, though, are social. For example, why does everyone try to extend the longest branch in the block chain? Sure, the protocol says it's the rule, but why should that mean anything? People don't follow rules because they want to. They follow rules because it's in their enlightened self interest to do so. If you could make money by choosing a different rule, somebody would do that instead. So it must be that these rules get followed because it's in the interest of Bitcoin players to follow them. The natural follow-up question is whether these social/economic rules are stable. That is, why not some other solution? Why not only extend blocks whose (nonce % 0x0d) == 0? Cryptographers use a very particular notion of security in which they like the security of their schemes to "reduce" to a well-understood assumption. That is, we prefer it you can prove something like "if you can break my system, then you can also solve problem X" where problem X is well-known and widely thought to be very hard. Then either I am forced to believe that your system is secure or that you have found an efficient way to solve problem X. And since solving problem X is unlikely, I should consider your system secure. As I said, some parts of Bitcoin do reduce in this way to known cryptographic primitives (which in turn reduce to problems we believe are hard). But not all the parts.
- ewillbefull 14y ago
  Can you point me toward _any_ proof-of-concepts for Chaum's scheme as applied to digital currency? Hell, there's still people on Bitcointalk trying to figure out how to bootstrap off of Bitcoin with some of those ideas. I don't think it's fair to throw "amateur" around like that, Bitcoin solves separate problems entirely. Crypto-anarchists spent decades theorizing things but never solving problems. Bitcoin shipped and that shouldn't upset you so much.
  - wmf 14y ago
    Chaum shipped DigiCash back in the 90s and Lucre is an open-source Chaum-like system.
    - DennisP 14y ago
      And now the OpenTransactions people are building Chaum-like systems for trading bitcoins.
- josephagoss 14y ago
  Also I looked at your Google search and could not find anyone talking about a block chain. I would be surprised if someone proposed a digital currency based on a blockchain before Satoshi, because that is the unique insight he is held in high regard for. - Sure some of the links in the Google search have lots of complicated schemes for a digital currency, but I think its the simplicity of the Bitcoin system that is unique. - Also I hear the system itself can only be attacked via brute force, do you claim this is not the case?
  - betterunix 14y ago
    "Also I hear the system itself can only be attacked via brute force, do you claim this is not the case?" The best known double-spending attack on Bitcoin requires work equal to the sum of all work done by the honest parties in the system. That is not a very high security margin; by comparison, attacking many of the systems from the Google search would require work that is exponential in the parameters of the system, while the honest parties only do work that is polynomial in those parameters. Forcing the attacker to do exponential work in the system parameters is the typical requirement for a cryptosystem to be "secure," and thus Bitcoin is not actually secure under the commonly accepted notions of security (at least among cryptographers).
    - josephagoss 14y ago
      Again you make a good point. It seems the 51% attack problem is glossed over a lot in the forums. I guess everyone is hoping that after a couple of years there will be millions of ASIC devices and this will be enough to ensure the 51% issues. But of course it can never be fully solved.
- moe 14y ago
  Your arrogant tone doesn't really jive with the lack of substance in your comment. Since you're apparently a professional cryptographer who would have designed a flawless Bitcoin right off the bat; Why don't you share some of your wisdom and point out a few of the amateur problems and how you would solve them? I'm sure the Bitcoin community would be grateful for your input.
  - betterunix 14y ago
    Is it really that arrogant to point out that the Bitcoin community has basically ignored the vast body of published, publicly available research on digital cash? Even if the point of Bitcoin is to go in a separate direction and have no central authorities of any kind, that previous work is highly relevant. There is no particular need for me to design a better digital cash system; such systems have already been designed. It is not even clear that digital cash without a central authority can be provably secure, since nobody has proposed a security definition for digital cash that does not involve some currency issuing authority (no, Bitcoin's definition does not count -- it does not rule out feasible attacks). Personally, I have no real problem with having a "bank" that issues currency, as long as the bank cannot frame people for double spending or other cheating (which is the kind of protection that was described by Chaum and other researchers in the 90s). So really, the ball is in the Bitcoin community's court. The research results on digital cash and secure multiparty computation is all publicly available and mostly available at no cost. Let the Bitcoin community develop a definition of security for digital cash without any "bank" if that is their goal; all that I am saying is that the definition must rule out feasible attacks if we are expected to take it seriously.
    - gbog 14y ago
      Sorry but you really look like a scholar saying platypus don't exist because they can't exist. Or Black Swans...
    - zanny 14y ago
      Money speaks a lot louder than PHD's who haven't made a competitive currency. Bitcoin is booming - nothing else is even on the radar. Bitcoin doesn't have to play ball with anyone if they are, by magnitudes, the largest digital currency in use. So far, it works. If BTC stops working, you can expect everyone to jump ship and hopefully a more secure alternative will be developed with lessons learned from the BTC ride. But for now, unless you can produce an attack that can lose people money in the bitcoin ecosystem, ranting about theoretical cryptosecurity in digital currencies and how BTC only being as secure as the majority of the swarm allows doesn't make anyone hesitant to invest in bitcoin. > I have no real problem with having a "bank" that issues currency The problem with banks is that they can always act in their own self-interest to fuck over the holders of their currency, and by having the only right to "counterfeit" their currency they have abnormal economic power in the economy their currency drives. It is the reason the US Federal Reserve is so corrupt right now, can wildly print US dollars to their own discretion, which is effectively stealing from anyone holding dollars by devaluing the currency as a whole, and they can do it at their own whims.
- wyager 14y ago
  >it is likely that whoever created Bitcoin was an amateur. You're kidding, right? Bitcoin is the single most impressive application of cryptography that I have ever seen in my entire life, and I get to look at a lot of cool cryptosystems. The only entity that could have created Bitcoin is some kind of savant or a group of very talented people. >ECDSA and SHA256 are referenced but little is said about whether or not they compose securely with the Bitcoin protocol, or even if the Bitcoin protocol itself is secure. By making only a few basic assumptions about the security of SHA, RIPEMD, and ECDSA, it's plainly obvious to anyone who remotely understands the protocol that the protocol is, in fact, secure. If you don't believe me personally, why don't you ask all the talented cryptographers who could lay their hands on over a billion dollars if they found a critical flaw in the Bitcoin protocol? >(though Bitcoin is not secure under the security notions used by cryptographers) You have no idea what you're talking about. Bitcoin makes very strict security guarantees and does not violate them.
  - nhaehnle 14y ago
    The GP post is perhaps a bit too dismissive of Bitcoin, but you should be very careful of hero worship as well. The pool of people who could have created Bitcoin includes almost everybody who has taken university-level courses on cryptography, and probably a whole bunch of non-academic crypto enthusiasts. After all, there are really only two cryptographic ideas in Bitcoin: One is to used public key cryptography and signatures for transactions, which is completely obvious. The other is to use hashing for proof-of-work to build the block chain. This is certainly less obvious, but it wasn't outlandishly new either. Ideas like hashcash have been around much longer than Bitcoin. Putting it all together in this way with its appeal to the goldbug mindset was certainly clever. But you are seriously overestimating the amount of intelligence required for developing Bitcoin.
    - wyager 14y ago
      >The pool of people who could have created Bitcoin includes almost everybody who has taken university-level courses on cryptography, No way. Have you looked at the whitepaper? The entire thing? Even completely ignoring the clever leveraging of cryptography, the sheer genius behind the methodology of the protocol makes me think that someone(s) extremely talented came up with it. >Ideas like hashcash have been around much longer than Bitcoin. True, but much of the genius comes from the way transactions themselves work. Right now, we're only leveraging a small portion of Bitcoin's capabilities. Because Bitcoin is really based on scripts assigned a value, the Bitcoin protocol allows for incredibly complex economic interactions in a cryptographically secure manner. The deeper I look into the protocol, the more I realize how genius some of the design decisions were. And besides, Bitcoin obviously did something right, because it's the only decentralized digital currency to take off. >But you are seriously overestimating the amount of intelligence required for developing Bitcoin. I think you're underestimating the elegance and complexity of the Bitcoin protocol. It's much, much more than a few crypto primitives strung together.

by veb 14y ago

betterunix 14y ago

Judging by the original paper, the subsequent writings, and the kinds of things prominent members of the Bitcoin community say, it is likely that whoever created Bitcoin was an amateur. There are few references made to the work done by Chaum or Okamoto. The security proof in the Bitcoin paper considers only one specific attack strategy. ECDSA and SHA256 are referenced but little is said about whether or not they compose securely with the Bitcoin protocol, or even if the Bitcoin protocol itself is secure. It is not that I mean to insult amateurs -- amateurs can theoretically make secure cryptosystems (though Bitcoin is not secure under the security notions used by cryptographers), but it is usually pretty clear when a system was designed by someone who is not well-versed in cryptography. It is unfortunate, however, that Bitcoin's developers cannot be bothered to search Google: https://www.google.com/search?q=digital+cash+site%3Aeprint.iacr.org https://www.google.com/search?q=digital+cash+site%3Aeprint.i...

josephagoss 14y ago
If you don't mind, how is Bitcoin not secure under the security notions used by cryptographers? This is interesting because if it wasn't secure I wonder why hundreds of millions of dollars have not been stolen yet? You could probably steal 100 million from some top addresses, move to MtGox and sell for a very decent rate before what you did became apparent (of course once what did became apparent Bitcoin would collapse forever) Or if the addresses are secure and its something else that is not secure what is it? I am on the bitcointalk forum a lot and I have not read anything about the crypto being not secure. Maybe I misunderstand what you mean by security?
- DanBC 14y ago
  Cryptographers have a high standard for 'not broken'. A cryptographic algorithm could have no real world attack, but be declared broken because there's a mathematical flaw. In the case of Bitcoin there's the 51% attack, which is pretty serious flaw even if to carry it out is unfeasable. We don't know if NSA or GCHQ have broken bitcoin (although they've certainly investigated it); and we haven't seen much crypt-analysis on it; but we have seen very many people trying (sometimes successfully) to attack Bitcoin and the wallets and the exchanges.
  - arpp 14y ago
    Democracy is also vulnerable to 51% attacks ;P
  - nullc 14y ago
    > the 51% attack, which is pretty serious flaw even if to carry it out is unfeasable There isn't anything magical about the number 51, the original Bitcoin paper gives a program that can be used to compute the success probability for an attacker with a given share of the computing power to reverse transactions to a given depth... At >=50% the probability becomes one but at that point only if the attack is of infinite duration. But, for example an attacker with 40% hashpower can reverse six blocks with a 50% success rate. Any kind of consensus system is going to be vulnerable to a majority attack of some kind— otherwise you'd have "minority imposes a wrong outcome" attacks. At least in Bitcoin the "consensus" only controls transaction ordering: a majority attacker can't inflate the supply or spend other people's coins... they can only DOS and remove transactions from the fixed consensus (and thus replace their own). Which is powerful but still limited.
- deepblueocean 14y ago
  I look at it this way: there are two kinds of rules in the Bitcoin system: crypto rules and social rules. Some are self-executing, by which I mean that they can be enforced "by construction" - if you create an object that doesn't follow the rule, other people will know. Said another way, breaking the rule would also require breaking some crypto. Some rules, though, are social. For example, why does everyone try to extend the longest branch in the block chain? Sure, the protocol says it's the rule, but why should that mean anything? People don't follow rules because they want to. They follow rules because it's in their enlightened self interest to do so. If you could make money by choosing a different rule, somebody would do that instead. So it must be that these rules get followed because it's in the interest of Bitcoin players to follow them. The natural follow-up question is whether these social/economic rules are stable. That is, why not some other solution? Why not only extend blocks whose (nonce % 0x0d) == 0? Cryptographers use a very particular notion of security in which they like the security of their schemes to "reduce" to a well-understood assumption. That is, we prefer it you can prove something like "if you can break my system, then you can also solve problem X" where problem X is well-known and widely thought to be very hard. Then either I am forced to believe that your system is secure or that you have found an efficient way to solve problem X. And since solving problem X is unlikely, I should consider your system secure. As I said, some parts of Bitcoin do reduce in this way to known cryptographic primitives (which in turn reduce to problems we believe are hard). But not all the parts.
ewillbefull 14y ago
Can you point me toward _any_ proof-of-concepts for Chaum's scheme as applied to digital currency? Hell, there's still people on Bitcointalk trying to figure out how to bootstrap off of Bitcoin with some of those ideas. I don't think it's fair to throw "amateur" around like that, Bitcoin solves separate problems entirely. Crypto-anarchists spent decades theorizing things but never solving problems. Bitcoin shipped and that shouldn't upset you so much.
- wmf 14y ago
  Chaum shipped DigiCash back in the 90s and Lucre is an open-source Chaum-like system.
  - DennisP 14y ago
    And now the OpenTransactions people are building Chaum-like systems for trading bitcoins.
josephagoss 14y ago
Also I looked at your Google search and could not find anyone talking about a block chain. I would be surprised if someone proposed a digital currency based on a blockchain before Satoshi, because that is the unique insight he is held in high regard for. - Sure some of the links in the Google search have lots of complicated schemes for a digital currency, but I think its the simplicity of the Bitcoin system that is unique. - Also I hear the system itself can only be attacked via brute force, do you claim this is not the case?
- betterunix 14y ago
  "Also I hear the system itself can only be attacked via brute force, do you claim this is not the case?" The best known double-spending attack on Bitcoin requires work equal to the sum of all work done by the honest parties in the system. That is not a very high security margin; by comparison, attacking many of the systems from the Google search would require work that is exponential in the parameters of the system, while the honest parties only do work that is polynomial in those parameters. Forcing the attacker to do exponential work in the system parameters is the typical requirement for a cryptosystem to be "secure," and thus Bitcoin is not actually secure under the commonly accepted notions of security (at least among cryptographers).
  - josephagoss 14y ago
    Again you make a good point. It seems the 51% attack problem is glossed over a lot in the forums. I guess everyone is hoping that after a couple of years there will be millions of ASIC devices and this will be enough to ensure the 51% issues. But of course it can never be fully solved.
moe 14y ago
Your arrogant tone doesn't really jive with the lack of substance in your comment. Since you're apparently a professional cryptographer who would have designed a flawless Bitcoin right off the bat; Why don't you share some of your wisdom and point out a few of the amateur problems and how you would solve them? I'm sure the Bitcoin community would be grateful for your input.
- betterunix 14y ago
  Is it really that arrogant to point out that the Bitcoin community has basically ignored the vast body of published, publicly available research on digital cash? Even if the point of Bitcoin is to go in a separate direction and have no central authorities of any kind, that previous work is highly relevant. There is no particular need for me to design a better digital cash system; such systems have already been designed. It is not even clear that digital cash without a central authority can be provably secure, since nobody has proposed a security definition for digital cash that does not involve some currency issuing authority (no, Bitcoin's definition does not count -- it does not rule out feasible attacks). Personally, I have no real problem with having a "bank" that issues currency, as long as the bank cannot frame people for double spending or other cheating (which is the kind of protection that was described by Chaum and other researchers in the 90s). So really, the ball is in the Bitcoin community's court. The research results on digital cash and secure multiparty computation is all publicly available and mostly available at no cost. Let the Bitcoin community develop a definition of security for digital cash without any "bank" if that is their goal; all that I am saying is that the definition must rule out feasible attacks if we are expected to take it seriously.
  - gbog 14y ago
    Sorry but you really look like a scholar saying platypus don't exist because they can't exist. Or Black Swans...
  - zanny 14y ago
    Money speaks a lot louder than PHD's who haven't made a competitive currency. Bitcoin is booming - nothing else is even on the radar. Bitcoin doesn't have to play ball with anyone if they are, by magnitudes, the largest digital currency in use. So far, it works. If BTC stops working, you can expect everyone to jump ship and hopefully a more secure alternative will be developed with lessons learned from the BTC ride. But for now, unless you can produce an attack that can lose people money in the bitcoin ecosystem, ranting about theoretical cryptosecurity in digital currencies and how BTC only being as secure as the majority of the swarm allows doesn't make anyone hesitant to invest in bitcoin. > I have no real problem with having a "bank" that issues currency The problem with banks is that they can always act in their own self-interest to fuck over the holders of their currency, and by having the only right to "counterfeit" their currency they have abnormal economic power in the economy their currency drives. It is the reason the US Federal Reserve is so corrupt right now, can wildly print US dollars to their own discretion, which is effectively stealing from anyone holding dollars by devaluing the currency as a whole, and they can do it at their own whims.
wyager 14y ago
>it is likely that whoever created Bitcoin was an amateur. You're kidding, right? Bitcoin is the single most impressive application of cryptography that I have ever seen in my entire life, and I get to look at a lot of cool cryptosystems. The only entity that could have created Bitcoin is some kind of savant or a group of very talented people. >ECDSA and SHA256 are referenced but little is said about whether or not they compose securely with the Bitcoin protocol, or even if the Bitcoin protocol itself is secure. By making only a few basic assumptions about the security of SHA, RIPEMD, and ECDSA, it's plainly obvious to anyone who remotely understands the protocol that the protocol is, in fact, secure. If you don't believe me personally, why don't you ask all the talented cryptographers who could lay their hands on over a billion dollars if they found a critical flaw in the Bitcoin protocol? >(though Bitcoin is not secure under the security notions used by cryptographers) You have no idea what you're talking about. Bitcoin makes very strict security guarantees and does not violate them.
- nhaehnle 14y ago
  The GP post is perhaps a bit too dismissive of Bitcoin, but you should be very careful of hero worship as well. The pool of people who could have created Bitcoin includes almost everybody who has taken university-level courses on cryptography, and probably a whole bunch of non-academic crypto enthusiasts. After all, there are really only two cryptographic ideas in Bitcoin: One is to used public key cryptography and signatures for transactions, which is completely obvious. The other is to use hashing for proof-of-work to build the block chain. This is certainly less obvious, but it wasn't outlandishly new either. Ideas like hashcash have been around much longer than Bitcoin. Putting it all together in this way with its appeal to the goldbug mindset was certainly clever. But you are seriously overestimating the amount of intelligence required for developing Bitcoin.
  - wyager 14y ago
    >The pool of people who could have created Bitcoin includes almost everybody who has taken university-level courses on cryptography, No way. Have you looked at the whitepaper? The entire thing? Even completely ignoring the clever leveraging of cryptography, the sheer genius behind the methodology of the protocol makes me think that someone(s) extremely talented came up with it. >Ideas like hashcash have been around much longer than Bitcoin. True, but much of the genius comes from the way transactions themselves work. Right now, we're only leveraging a small portion of Bitcoin's capabilities. Because Bitcoin is really based on scripts assigned a value, the Bitcoin protocol allows for incredibly complex economic interactions in a cryptographically secure manner. The deeper I look into the protocol, the more I realize how genius some of the design decisions were. And besides, Bitcoin obviously did something right, because it's the only decentralized digital currency to take off. >But you are seriously overestimating the amount of intelligence required for developing Bitcoin. I think you're underestimating the elegance and complexity of the Bitcoin protocol. It's much, much more than a few crypto primitives strung together.