Bitcoin: P2P Digital Currency Pern Hui Chia Q2S NTNU Trial - PowerPoint PPT Presentation

Experimental Bitcoin: P2P Digital Currency Pern Hui Chia Q2S NTNU Trial lecture, 7 Dec 2012, Trondheim

Outline • Background : Bitcoin • How it works • Risks & measures • Economics and society • Summary Bitcoin | Outline 2

Background

Background • Money – payment of goods and services – Bartering => commodity money => coinage => bank notes Source: wikipedia.org • E-banking, credit/debit cards • Digital currencies : convenience, anonymity, decentralization Bitcoin | Background 4

Use of digital currencies • Convenience : Paypal, Second Life L$, World of Warcraft Gold, .. • Anonymity: – Cash – relatively anonymous means of payment – E cash (Chaum, Fiat & Naor 1988) • Anonymous and safe payments • Suitable for small transactions compared to costly credit cards – Many other academic papers followed.. but none takes off Bitcoin | Background 5

Use of digital currencies (continued) • Decentralization – Why not central issuers & authorities? • Single point of failure – company bankrupts • Depreciation – unexpected money-printing by governments • Restriction – freedom to support Wikileaks? – B-money (Dai 1998) – crypto-anarchy, need not governments • Pseudonyms, computationally hard puzzle • Trusted arbitrators / servers – manage disputes given incentives/fines – Bitcoin (Nakamoto 2008) – no trust needed, assume majority are benign Bitcoin | Background 6

Timeline [21] 2008 Oct: Satoshi Nakamoto (alias), Bitcoin paper 2009 Jan: Genesis block, open-source project 2010 May: 10000 BTC traded with 2 pizzas Source: wikipedia.org Jul: Mt.Gox established 2011 Jun: $31 per BTC Jun: Theft (25k BTC), breach into Mt.Gox, $0.01 per BTC 2012 Dec: $13 per BTC Bitcoin | Background 7

Numbers [16,17] Controlled Money Supply • 10.5 million BTC issued 21m – Rate per 4 year: 10.5m, 5.2m, 2.6m, .. – Total BTC (2140) = 21m • Early Dec 2012: – $13 per BTC 2009 2140 – Market capital >$138m – 31k daily transactions • 2.4m BTC Bitcoin | Background 8

• Fiat currency – not backed by reserves nor government • Value = vendors/businesses accepting the currency • E-commerce: computer games, web hosting, IT services, clothing (alpaca socks), … • BitPay signs 1000 online merchants [18] • Also physical restaurants (green), hotels (blue), others (red) Source: en.bitcoin.it/wiki

Why Bitcoin? • Success factors (Barber et al. 2012) – Expected money supply • No unexpected money-printing=> no devaluation / inflation – No control of central authority – attract libertarians (and illegal activities) – Openness: open-source, APIs => 3 rd party services (mixer, exchanges) flourishes – Infinite divisibility – Achilles’ heel of strong anonymity • Satoshi = 0.00000001 BTC, could be further divided – Others • Low transactional costs • Instant & irreversible transactions Bitcoin | Background 10

How it works – simple, nothing fancy

A distributed ledger system • Not coins • Distributed ledgers – Unlike e-cash (Chaum et al. 1988) – Transaction history (not balances) where bank generates & verifies coins – Public Source: Bitcoin: A technical Introduction [15]

Design • Strong ownership – digital signatures – Cannot spend w/o private keys – Sign [ hash ( public key of recipient + amount + previous transaction ) ] – Multiple inputs (payer accounts), multiple outputs (recipients public keys) Source: Nakamoto 2008 Bitcoin | Design 13

Design (continued) • Preventing double-spending w/o trusted entities – Need: • Temporal order in transaction history • Network consensus • Temporal order – chained hashes – 1-way-ness ensures data exists (transaction occurs) at the time of hashing • Consensus – OK if can protect integrity – Proof-of-Work – computational puzzles, hard to cheat – Successful nodes rewarded with Bitcoin == ‘gold mining’ Bitcoin | Design 14

Design (continued) • Proof of Work (PoW) – Put unconfirmed transactions in blocks – Compute hash (SHA-256) – Success = hash has #leading-zeros e.g., 00000000000004d7d38d84545b... • Difficulty tunable: #hashing increases exponentially with #zero • Expected time: ~10 minutes per success – Else, increment nonce & re-compute Bitcoin | Design 15

Design (continued) • Racing & consensus: – New transactions broadcasted (best-effort) – Individual miners group transactions in respective block • Start solve proof-of-work – If found, solution (block) broadcasted to all – Miners accept solved-block if all transactions in block are valid • Transactions confirmed +1 • Miners work on the next block – Forks (racing) possible – always accept the longest chain • Harder to cheat (double-spend) as chain gets longer – Need to re-do proof-of-work Bitcoin | Design 16

Design (continued) • Not designed for strong anonymity – Depends on anonymous public keys – Users encouraged to create new key pairs per transaction – costless – But, • Transaction history publicly available • Pseudonyms can be linked – not true anonymity Bitcoin | Design 17

Risks & Measures

Risk: 51% attack • 2000 miners, 25T hashes / s • Breaks if majority are bad – Extremely powerful pooled miners • Deepbit Slush >50% BTC Guild BitMinter – But, can only double-spend • BTC value can skydive • More profitable to be benign (Nakamoto 2008) Source: blockchain.info, 3 Dec 2012

Risk: Double spending • Double-spending by individuals – Slow transactions – wait (tens of minutes) – Fast transactions (e.g., buying in stores, taxi) • Hard Bitcoin POS Source: http:// • Recommended: en.bitcoin.it/wiki – Listening period: wait for P2P delays – Observers: self-report double-spends • But, low-cost attack still possible (Karame et al. 2012) – Nodes should alert double-spending proactively Bitcoin | Risks & Measures 20

Risk: Theft / Loss • Malware: theft of keys – Threshold cryptography – store keys in multiple locations (Barber et al. 2012) • Hacking: breach of third party wallets – Can they protect our keys? • Loss of keys => BTC lost – Secure backup needed Bitcoin | Risks & Measures 21

Risk: Not so anonymous • Anonymity by hiding identities, multiple keys (pseudonyms) – Not a prominent design goal • Tracing transaction history (Reid & Harrigan 2011) – Passive tracing can already learn a lot • Structural analysis – associated keys, balance per key, .. • External information – vendor’s keys, keys used for public donation, .. • Context discovery, flow and temporal analysis – Active tracing – marked coins, collaborative attacks Bitcoin | Risks & Measures 22

Risk: Not so anonymous (continued) • Bitcoin usage in daily activities (Androulaki et al. 2012) – Metrics: address unlinkability, profile indistinguishability – Possible information leaks: • Key association: – Multi-input transactions – Shadow key created to receive change » Current implementation doesn’t pay multiple recipients • Behavioral clustering – geo-location, proximity to shops, user preferences – Mixers & exchanges can help, but centralized ?! Bitcoin | Risks & Measures 23

Risk: Skewed Distributions • Network characteristics (Ron & Shamir 2012) – Skewed distribution: account balance, # transactions, # keys – 73% transactions < 10 BTC – Few are using the system extensively • Easily recognizable when big? – Other result: 78% minted coins not used • Active circulation of small subset of Bitcoin => good for privacy? Bitcoin | Risks & Measures 24

Risk: Others • Botnet miners [22] • Denial of Service – Attack may not be profitable but can destroy trust => devaluation • Usability – Easy to make mistakes (or phished) with pseudonyms – Transactions irreversible Bitcoin | Risks & Measures 25

Economics & Society

Economics & Society: The Positive • Against uncontrolled money-printing / devaluation • Can cater for low-cost transactions (no credit card charges) • Incentive compatible – need miners (PoW), reward miners – New coins or transaction fees – But, miners may be incentivized not to propagate information (Babaioff et al. 2011) • Holding up information = time advantage to solve next PoW • Solution: Information propagator (previous solvers) should be rewarded Bitcoin | Economics & Society 27

• Information freedom: – WordPress accepts Bitcoin – make publishing democratic (Skelton 2012) • PayPal blocks access in 60 countries (CC companies similar) • Payment freedom: – Wikileaks gets Bitcoin donation (Matonis 2012) Bitcoin | Economics & Society 28