6 ms·

Utter nonsense; no mathematician would have created Bitcoin. Mathematicians criticize cryptographers for not being rigorous enough in their proofs. Bitcoin do

Utter nonsense; no mathematician would have created Bitcoin. Mathematicians criticize cryptographers for not being rigorous enough in their proofs. Bitcoin does not even have a formal security definition, let alone any kind of proof. Anyone who is looking at professional cryptographers or accomplished researchers is looking in the wrong place. Bitcoin is the work of amateurs and enthusiasts, the sort of people who flood sci.crypt with claims about new cryptosystems and ignore the experts who still take the time to post there. It only caught on because it appeals to libertarians and anarchists, and eventually was promoted enough that mainstream media outlets were afraid that they would be left behind on reporting "the next big thing."

deleted 13y ago
[deleted]
bachback 13y ago
Uh, oh, outch - "experts".... this is so wrong in so many ways. But I'm sure the media will get it right.
terolacu 13y ago
Actually it appeals to anybody who doesn't want to see how his savings lose value every day, or are simply stolen by his own government. It also appeals to anybody who doesn't want to pay ridiculous fees for international wires, if the government allows it at all.
- dsdfoajsldkf 13y ago
  You don't sound like a libertarian/anarchist at all! /rolleyes
  - terolacu 13y ago
    Calling me names won't change anything, my argument still stands.
reedlaw 13y ago
A pretty harsh appraisal of a system that is already trusted with accounting for over a billion dollars worth of digital assets. Can you give some examples of other cryptographic systems of comparable complexity being used at scale for years without major incident? Message encryption, TLS, and Secure Shell are generally trusted as being secure, but all pale in comparison to the complexity of bitcoin in terms of what they attempt to achieve. Yes, bitcoin is vulnerable to a 51% network attack, but I believe there is a social engineering-type security built into the protocol. That is, early adopters are incentivized by easy block rewards and currency appreciation potential. But they also take the greater risk of 51% network attack. As bitcoin takes off, mining becomes more decentralized and less vulnerable to 51% attack. Just last week we saw this: https://news.ycombinator.com/item?id=5696596 https://news.ycombinator.com/item?id=5696596 (Bitcoin Network Speed 8 Times Faster than Top 500 Supercomputers Combined)
- betterunix 13y ago
  "A pretty harsh appraisal of a system that is already trusted with accounting for over a billion dollars worth of digital assets." That it is popular does not demonstrate that it was not designed by amateurs and enthusiasts. Many popular systems were hacked together by amateurs. Fidonet was the work of amateurs -- a global computer network that remains in use to this very day. It is also not the case that systems trusted with large amounts of money must necessarily be secure. If the past 20 years have taught us anything, it is that security is not even within the consciousness of most users of payment systems, at least when it comes to online payments. That credit cards were ever used for Internet payments, rather than Chaum's systems, should be proof enough of that. All that standards between most people's bank accounts and a potential thief is a password, yet there is little demand for smartcards or other more secure systems. "Message encryption, TLS, and Secure Shell are generally trusted as being secure, but all pale in comparison to the complexity of bitcoin in terms of what they attempt to achieve" Why separate encryption from TLS and SSH? TLS and SSH are encryption (and authentication) systems. Here, on the other hand, is a secure multiparty computation system that has served a large user base for over a decade without major incident: https://en.wikipedia.org/wiki/Mixmaster_anonymous_remailer https://en.wikipedia.org/wiki/Mixmaster_anonymous_remailer The most major attack on remailers so far was the recent attempt to de-anonymize the Pittsburgh bomb threats. It is unclear if the FBI was able to break the security of Mixmaster even after compromising numerous remailers; a man has been indicted, but the evidence (last I checked) remains secret. It seems unlikely, unless the FBI had compromised all the remailers except for the ones they raided prior to their investigation; that would mean that the FBI had effectively compromised the whole network, which is beyond what any secure computation system can protect against. Similarly, there is the Danish Sugar Beet Auction system. This system has fewer workers than Mixmaster, and certainly less than Bitcoin, but it was designed and engineered by prominent researchers and serves thousands of users (only a slightly smaller scale than Bitcoin). The system has been used for a few years now: http://fc09.ifca.ai/papers/15_Secure_MPC_goes_live.pdf http://fc09.ifca.ai/papers/15_Secure_MPC_goes_live.pdf "Yes, bitcoin is vulnerable to a 51% network attack" Let's be very clear here: Bitcoin is not merely vulnerable to a majority of parties behaving maliciously; that would be acceptable in a multiparty computation system. What Bitcoin is vulnerable to is one party working just slightly harder than all the other parties. In other words, a single malicious party, working in polynomial time, can successfully attack Bitcoin (whatever the definition of a successful attack actually is). The attack allows one party to deny confirmations on transactions involving another party. It allows one party to double-spend the currency. It allows one party to prevent other parties from being paid for mining. This is why I said Bitcoin is the work of amateurs and enthusiasts. This is the sort of attack that nobody in the cryptography research community would consider acceptable. This is not merely a disconnected between theory and practice (as is the case with PGP, TLS, and Mixmaster, all of which diverge somewhat from their theoretical foundations); the vulnerability exists in the very design of the Bitcoin protocol. There are other signs that Bitcoin is the work of amateurs. The protocol specification is hard to pin down; much of the design is documented only with code, rather than in the original paper. There is no threat model and no formal security definition. The security analysis in the original paper focuses on a specific method of attacking Bitcoin, without ruling out any other methods. None of this is something you would expect to see out of expert cryptographers, and to suggest that it is the work of an accomplished mathematician is beyond wishful thinking. If you want to compare Bitcoin to the work of experts, why don't you take a look at the work of experts? Here, for example, is some important work in the field of secure multiparty computation: http://www.cs.ucla.edu/~rafail/PUBLIC/57.pdf http://www.cs.ucla.edu/~rafail/PUBLIC/57.pdf Does the original Bitcoin paper even remotely resemble this? Here is an earlier, shorter work; can you honestly say that the original Bitcoin paper even resembles this: http://www.math.ias.edu/~avi/PUBLICATIONS/MYPAPERS/GMW87/GMW87.pdf http://www.math.ias.edu/~avi/PUBLICATIONS/MYPAPERS/GMW87/GMW...

deleted 13y ago

[deleted]

bachback 13y ago

Uh, oh, outch - "experts".... this is so wrong in so many ways. But I'm sure the media will get it right.

terolacu 13y ago

Actually it appeals to anybody who doesn't want to see how his savings lose value every day, or are simply stolen by his own government. It also appeals to anybody who doesn't want to pay ridiculous fees for international wires, if the government allows it at all.

dsdfoajsldkf 13y ago
You don't sound like a libertarian/anarchist at all! /rolleyes
- terolacu 13y ago
  Calling me names won't change anything, my argument still stands.

reedlaw 13y ago

A pretty harsh appraisal of a system that is already trusted with accounting for over a billion dollars worth of digital assets. Can you give some examples of other cryptographic systems of comparable complexity being used at scale for years without major incident? Message encryption, TLS, and Secure Shell are generally trusted as being secure, but all pale in comparison to the complexity of bitcoin in terms of what they attempt to achieve. Yes, bitcoin is vulnerable to a 51% network attack, but I believe there is a social engineering-type security built into the protocol. That is, early adopters are incentivized by easy block rewards and currency appreciation potential. But they also take the greater risk of 51% network attack. As bitcoin takes off, mining becomes more decentralized and less vulnerable to 51% attack. Just last week we saw this: https://news.ycombinator.com/item?id=5696596 https://news.ycombinator.com/item?id=5696596 (Bitcoin Network Speed 8 Times Faster than Top 500 Supercomputers Combined)

betterunix 13y ago
"A pretty harsh appraisal of a system that is already trusted with accounting for over a billion dollars worth of digital assets." That it is popular does not demonstrate that it was not designed by amateurs and enthusiasts. Many popular systems were hacked together by amateurs. Fidonet was the work of amateurs -- a global computer network that remains in use to this very day. It is also not the case that systems trusted with large amounts of money must necessarily be secure. If the past 20 years have taught us anything, it is that security is not even within the consciousness of most users of payment systems, at least when it comes to online payments. That credit cards were ever used for Internet payments, rather than Chaum's systems, should be proof enough of that. All that standards between most people's bank accounts and a potential thief is a password, yet there is little demand for smartcards or other more secure systems. "Message encryption, TLS, and Secure Shell are generally trusted as being secure, but all pale in comparison to the complexity of bitcoin in terms of what they attempt to achieve" Why separate encryption from TLS and SSH? TLS and SSH are encryption (and authentication) systems. Here, on the other hand, is a secure multiparty computation system that has served a large user base for over a decade without major incident: https://en.wikipedia.org/wiki/Mixmaster_anonymous_remailer https://en.wikipedia.org/wiki/Mixmaster_anonymous_remailer The most major attack on remailers so far was the recent attempt to de-anonymize the Pittsburgh bomb threats. It is unclear if the FBI was able to break the security of Mixmaster even after compromising numerous remailers; a man has been indicted, but the evidence (last I checked) remains secret. It seems unlikely, unless the FBI had compromised all the remailers except for the ones they raided prior to their investigation; that would mean that the FBI had effectively compromised the whole network, which is beyond what any secure computation system can protect against. Similarly, there is the Danish Sugar Beet Auction system. This system has fewer workers than Mixmaster, and certainly less than Bitcoin, but it was designed and engineered by prominent researchers and serves thousands of users (only a slightly smaller scale than Bitcoin). The system has been used for a few years now: http://fc09.ifca.ai/papers/15_Secure_MPC_goes_live.pdf http://fc09.ifca.ai/papers/15_Secure_MPC_goes_live.pdf "Yes, bitcoin is vulnerable to a 51% network attack" Let's be very clear here: Bitcoin is not merely vulnerable to a majority of parties behaving maliciously; that would be acceptable in a multiparty computation system. What Bitcoin is vulnerable to is one party working just slightly harder than all the other parties. In other words, a single malicious party, working in polynomial time, can successfully attack Bitcoin (whatever the definition of a successful attack actually is). The attack allows one party to deny confirmations on transactions involving another party. It allows one party to double-spend the currency. It allows one party to prevent other parties from being paid for mining. This is why I said Bitcoin is the work of amateurs and enthusiasts. This is the sort of attack that nobody in the cryptography research community would consider acceptable. This is not merely a disconnected between theory and practice (as is the case with PGP, TLS, and Mixmaster, all of which diverge somewhat from their theoretical foundations); the vulnerability exists in the very design of the Bitcoin protocol. There are other signs that Bitcoin is the work of amateurs. The protocol specification is hard to pin down; much of the design is documented only with code, rather than in the original paper. There is no threat model and no formal security definition. The security analysis in the original paper focuses on a specific method of attacking Bitcoin, without ruling out any other methods. None of this is something you would expect to see out of expert cryptographers, and to suggest that it is the work of an accomplished mathematician is beyond wishful thinking. If you want to compare Bitcoin to the work of experts, why don't you take a look at the work of experts? Here, for example, is some important work in the field of secure multiparty computation: http://www.cs.ucla.edu/~rafail/PUBLIC/57.pdf http://www.cs.ucla.edu/~rafail/PUBLIC/57.pdf Does the original Bitcoin paper even remotely resemble this? Here is an earlier, shorter work; can you honestly say that the original Bitcoin paper even resembles this: http://www.math.ias.edu/~avi/PUBLICATIONS/MYPAPERS/GMW87/GMW87.pdf http://www.math.ias.edu/~avi/PUBLICATIONS/MYPAPERS/GMW87/GMW...