bitcoin tutorial - college of computing & informaticsgreenie/cs475/bitcoin tutorial...

Bitcoin Tutorial

Based on a talk by Joseph Bonneau

Thanks to Andrew Miller, Arvind Narayanan, Jeremy Clark, Joshua Kroll, Ed Felten

CS 475 May 26, 2015

Bitcoin has many different parts!

Part I: Bitcoin in 6 easy steps

Double spending: why ecash is hard

BANK Alice

Bob SignA(Transfer X to B)

Charlie SignA(Transfer X to C)

SignZ(Transfer X to A)

Redeem X?

Redeem X?

Step 1: Make the bank a global log

SignA(Transfer X to C)

... SignA(Transfer X to B)

...


(the block chain)

SignatureBANK

SignatureBANK

SignatureBANK

SignatureBANK

Step 2: Participants vote on blocks

SignatureA SignatureB SignatureC ...

SignatureA SignatureB SignatureC ...

SignatureA SignatureB SignatureD ...

Step 3: A random user picks

N-2

N-1


SignatureB

SignatureA

N SignatureC

N

C

Step 4: Resolve conflicts by forking

SignA(Transfer X to B) SignatureB

SignatureA

SignA(Transfer X to C) SignatureC SignatureD

SignatureE

Step 5: Incentivise correct blocks

SignatureB

SignatureA

SignatureC SignatureD

SignatureE

Mint(X, A)

Mint(X, B)

Mint(X, D)

Mint(X, E)

Mint(X, C)

Step 6: Choose by hash power!

Mint(X, A)

Mint(X, B)

Mint(X, C)

SHA-256(BlockN-1, n) = 0x00000000000000003f89...

SHA-256(BlockN-1, n) = 0x00000000000000008c71...

Mining difficulty

Mining difficulty

Preventing double spending

SignA(Transfer X to B) SignA(Transfer X to C) SignA(Transfer X to B)

Longest chain wins

Transaction confirmation (~6 blocks)

Real time bitcoin http://www.blockchain.info

Bitcoin is transaction-based

IN: scriptSig ... scriptSig ...

OUT: scriptPub A,

5.9

...

... IN:

scriptSig A OUT:

scriptPubB, 5.0 scriptPubA,

0.9

IN: scriptSig A scriptSig A

OUT: scriptPubC,

10.0

IN: scriptSig ...

OUT: scriptPubA,

9.2

...

Bitcoin transactions specify scripts scriptPubKey: OP_DUP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG

IN: scriptSig ... scriptSig ...

OUT: scriptPub A,

5.9

IN: scriptSig A

OUT: scriptPubB, 5.0 scriptPubA,

0.9

<sig> <pubKey> OP_DUP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG

scriptSig: <sig> <pubKey>

Redemption script:

Bitcoin transactions specify scripts

<sig> <pubKey> OP_DUP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG

<sig> ✓ <pubKey>

<pubKey>

<pubKeyHash?>

<pubKeyHash>

Bitcoin script features ●  multiple signatures ●  escrow ●  time locking ●  commitment opening ... ●  smart contracts?

Part II: Mining & Consensus

51% attacks

Goldfinger Attack?

Checkpointing

How decentralized is Bitcoin?

Selfish mining Observation: for 0.33 < x < 0.5, a fraction x of selfish miners can earn greater than a fraction x of rewards

Secret Block

Secret Block

Majority is not enough: Bitcoin mining is vulnerable I8ay Eyal and Emin Gün Sirer. Financial Crypto 2014

Mining difficulty

bitcoinwisdom.com

Difficulty adjustment

bitcoinwisdom.com

10 minutes

2 weeks

Mining rewards

Courtesy: Brian Warner

Total network capacity ●  264 hashes per block (every 10 minutes!) ●  275 hashes in 2013 o  In exchange for ~US$250M

●  Consuming > 100 MW

Bitcoin mining hardware

Should I mine bitcoins?

Chilkoot pass, Klondike 1898

Mining pools Mint(25, KPOOL)

0x00000000000000003f89...

0x000000000000490c6b00...

0x00000000000000003f89... 0x0000000000001e8709ce...

0x00000000000007313f89...

0x00000000000045a1611f...

0x000000000000a877902e...

Mining pools

Part III: Bitcoin as a currency

Why does Bitcoin have value? Consensus ●  Consensus in state (blockchain) ●  Consensus in payment ●  Consensus in rules

The Economics of Bitcoin Mining, or Bitcoin in the Presence of Adversaries Joshua Kroll, Ian Davey, Ed Felten. WEIS 2013

Price during 2013

Price during 2013-2015

Black Markets

Silk Road: US$14M in Revenue in 2012 [Christin 2012] Traveling the Silk Road: A measurement analysis of a large anonymous online marketplace Nicolas ChrisSn, WWW 2013

Capital controls

E-commerce

Bitcoin exchanges

Beware the middleman: Empirical analysis of Bitcoin-‐exchange risk Tyler Moore and Nicolas ChrisSn, Financial Crypto 2013

Bitcoin ATMs

Bitcoin meetups

Part IV: Neat applications

Green Addresses (speeding up payments)

IN: scriptSig ...

OUT: scriptPub A,

10.0

IN: scriptSig A

OUT: scriptPub O,

1.0 scriptPub A, 9.0

x 6

Green Addresses (speeding up payments)

IN: scriptSig ...

OUT: scriptPub G,

10.0

IN: scriptSig A

OUT: scriptPub O,


I promise to never double-spend!

Sequential micropayments

IN: scriptSig ...

OUT: scriptPub G,

10.0

I promise to never double-spend!

IN: scriptSig A

OUT: scriptPub O,


IN: scriptSig A

OUT: scriptPub O,


IN: scriptSig A

OUT: scriptPub O,


IN: scriptSig A

OUT: scriptPub O,


Secure commitments (timestamping)

Hash Data

CommitCoin: carbon daSng commitments with Bitcoin Jeremy Clark, Aleksander Essex. Financial Crypto 2012

Randomness Beacon

Hash =

Part V: Anonymity

Tracing Bitcoin transactions

IN: scriptSig A1 scriptSig A2

OUT: scriptPub

A3, 5.9

...

... IN:

scriptSig A3 OUT:

scriptPubB, 5.0 scriptPubA4,

0.9

Joint control Change addresses

Building the transaction graph

A FisWul of Bitcoins: Characterizing Payments Among Men with No Names Sarah Meiklejohn et al, IMC 2013

Bitcoins carry a transaction history

Towards Risk Scoring of Bitcoin TransacSons Möser, Malte, Rainer Böhme, and Dominic Breuker, BITCOIN 2013

●  identification ●  censorship ●  recovery from theft ●  economic analysis

Mixes today

Caution: Mixing services may themselves be operating with anonymity. As such, if the mixing output fails to be delivered or access to funds is denied there is no recourse. Use at your own discretion.

-The Bitcoin Wiki

An inquiry into money laundering tools in the Bitcoin ecosystem Möser, Malte, Rainer Böhme, and Dominic Breuker, ECRIME 2013

If v ➡ kesc by tin, but not v ➡ kout by tout The client publishes

If I send you v bitcoins by Sme tin Will you send v to my address kout by Sme tout?

Sure! Just send your coins kesc Sign(v, tin, tout ,kout ,kesc}

Anyone can verify cheaSng

(Ideally) no one trusts anymore

Better mixes with warranties

Mixcoin: Anonymity for Bitcoin with accountable mixes J. Bonneau, A. Narayanan, A. Miller, J. Clark, J. Kroll, E. Felten. Financial Crypto 2013

Coin Join

IN: scriptSig P scriptSig M scriptSig S

OUT:

scriptPub P’, 1.0 scriptPub M’, 1.0 scriptPub

S’, 1.0

Zerocoin Bitcoin Zerocoin

CRYPTO! Zerocoin: Anonymous distributed e-‐cash from bitcoin Ian Miers, ChrisSna Garman, Ma8hew Green, Avi Rubin. IEEE Oakland 2013

Zerocash

“Cryptocurrencies are just a gateway drug to SNARKS”

Zerocash: Decentralized Anonymous Payments from Bitcoin E. Ben-‐Sasson, A. Chiesa, C. Garman, M. Green, I. Miers, E. Tromer, M. Virza IEEE Oakland 2014

Part VI: Extensions & Altcoins

Types of changes to Bitcoin

●  overlay ●  soft fork ●  hard fork ●  alternate chain ●  alternate systems

Easy

Hard

Deploym

ent difficulty

Overlays

✓Soft fork changes

●  Pay-to-script-hash ●  Pay-to-SNARK (CoinWitness) ●  ECDSA-P256 replacements ●  Zerocoin

Hard fork changes

●  Change block size ●  Change block frequency ●  Various bug fixes ●  Restructuring the chain

Altcoins (Bitcoin-like chain)

Other altcoins

Bitcoin limitations ●  ~7 transactions per second

o  Visa: ~10k tps (peak) ●  248 currency units

o  ~32k per person on earth ●  0.0001 BTC transaction fees typical

o  ~$0.40 US ●  ~60 minutes confirmation delay

A reserve currency?

Questions

bitcoin tutorial - college of computing & informaticsgreenie/cs475/bitcoin tutorial...

Documents