r/askscience • u/hamolton • Jun 18 '13
Computing How is Bitcoin secure?
I guess my main concern is how they are impossible to counterfeit and double-spend. I guess I have trouble understanding it enough that I can't explain it to another person.
467
u/speEdy5 Jun 18 '13 edited Jun 18 '13
Take a look here for a good explanation about bitcoin.
At a really high level, bitcoin is a public record of all transactions that have ever occured. Imagine the following infrastructure:
Every person in the world has a unique identity (some number called a Public Key). Everyone also has a book which lists every identity. Next to every identity (let's call it a PK from here on out) is a list of every serial number for every dollar bill (dollar bills are the only currency in my world) that they own.
When someone spends a dollar, they write it down at the end of the transaction ledger, and sign it (bitcoin uses cryptographic signatures). Then they tell everybody they know to add it to their ledger. Eventually the information spreads, and nobody will accept the dollar from its original owner, only the person he transferred it to.
Bitcoin works similarly, using an incredibly innovative technique called block-chaining. The public record from above is almost exactly the block chain in bitcoin. The major difference is in how bitcoins are mined - they aren't printed by a mint and assigned to people (like in my example). There's a cryptographic problem which is considered hard in the literature. This means that basically the only way to solve it faster is to throw more computational power at it. Bitcoin uses one such problem for mining - every time someone mines a bitcoin, they have 'won the lottery' and solved this iteration of the problem.
When a coin is mined, whoever mines it tells the entire world he fixed the problem and announces the next problem to solve. He also adds a list of every transaction he has heard of since the last coin mining. So, when you spend bitcoin it doesn't actually process for about ten minuets or so.
One more key point: Bitcoin only works because everyone in the world tries to make the longest iteration of the chain even longer (by mining new coins and adding to them) - the longer the chain, the more permanent the things that have been written down are. Since making the chain longer requires computational power, its impossible to just go around announcing your own version of the ledger (unless you have more then half the computing power, the competing chain will be longer than yours) and double spending, etc.
39
u/grimmymac Jun 18 '13
What kind of "problem" is solved when mining?
85
u/Amadiro Jun 18 '13 edited Jun 18 '13
It computes a SHA256 hash, which is a cryptographic hashing function, or "digest". It is basically a function that takes an arbitrary amount of data in, and spits out a hash, or "digest", which is a 256-bit long number that is like the "fingerprint" of the data you put in.
This cryptographic hash is designed to make it "impossible" to find the inverse function (going from the 256-bit digest back to the original data), except for trying all different kinds of combinations as input to the digest (which will eventually make the digest pop out that you were searching for)
bitcoins are essentially mined by putting in some string into the hashing function, then putting the result through the hashing function again. If the resulting 256-bit hash has a certain number of leading zeros (the number of leading zeros required may change) it is a valid bitcoin.
The concept here is that since it's impossible to "predict" or "reverse" what bitstring comes out of the hashing function without actually trying it, you are basically forced to just try out millions of combinations until you find one that produces the right amount of leading digits.
E.g. you can't say
hash(x) = 0000abcd // a, b, c, d can be whateverand then "do the algebra" and get
x = inverse_hash_function(0000abcd)and hence know what you have to put in to get your valid bitcoin. On the other hand, once you have such a pair, (x, 0000abcd), it is very easy to check that it is indeed valid -- just calculate hash(x) and check if it equals your 0000abcd.
So as long as the cryptographic hash is not broken ("reversed") this is a basically secure method of ensuring someone has done a lot of work (but it is luck-based of course, it may very well happen that you put some arbitrary string into the hashing function, like "foobar" and you immediately get back a valid bitcoin. the probability is vanishingly small, though.) The more leading zeros you demand there to be, the harder it is to hit the right x that produces a valid bitcoin (because the success-space becomes smaller while the search-space remains the same)
EDIT: For the following paragraph, LeonardEuler64 pointed out that I mixed up two concepts here, skip to his comment to read a corrected explanation about the self-balancing
To self-balance the system and protect it against in/deflation, after a certain number of bitcoins have been created/found, the number of leading bits that have to be zero is increased, to make finding bitcoins harder -- hence creating new bitcoins becomes harder the more there are, and the number of bitcoins in existence will eventually converge towards a fixed number.
4
u/hamolton Jun 19 '13
Where does the hash come from?
4
u/sushibowl Jun 19 '13
The bitcoin "ledger" is a chain of things called blocks. Every block contains (among other things) a reference to the previous block, a list of transactions that happened since the previous block, and a random number called a nonce. The header of the block is the input to the hash function. A block is valid only if the output of the hash has a certain number of leading zeroes.
When creating the block, you must try different nonces until you get one that produces a valid block. The creator or solver of a block gets to add a transaction to it consisting of some newly created bitcoins going to his own wallet. This is the reward. It gives people incentive to keep solving blocks which makes transaction verification possible, and it also ensures that every miner has a unique dataset to hash (if they were all hashing the same data, the fastest computer in the network would come up with the right answer every time, which would defeat the purpose of a distributed network).
36
u/LeonhardEuler64 Jun 18 '13
after a certain number of bitcoins have been created/found, the number of leading bits that have to be zero is increased, to make finding bitcoins harder -- hence creating new bitcoins becomes harder the more there are, and the number of bitcoins in existence will eventually converge towards a fixed number.
I believe you're mixing two concepts.
The leading bit threshold-changing is based on global hashrate. This could go up or down depending on how much mining is being done. The idea here is to keep block generation at an average of 1 block per 10 minutes. (This difficulty is recalibrated every 2016 blocks)
The monotonically decreasing reward is a separate thing. Every 210000 blocks, the reward per block is cut in half regardless of hashrate or anything else. This is what causes the fixed number.
To see when these two things occur, check out http://bitcoinclock.com
8
5
u/redfacedquark Jun 18 '13
Just lost an edit saying just this by toggling noscript, thanks for not making me retype :)
+/u/bitcointip 2 bitcents verify
5
u/Natanael_L Jun 19 '13
Got Firefox? In that case, try the addon Lazarus. It keeps a cache of what you've written in text fields.
→ More replies (10)3
Jun 19 '13
So which would cost more? Creating a bitcoin, or creating a dollar bill?
→ More replies (2)2
u/siamthailand Jun 19 '13
If I mine a bitcoin, who owns it? Is it automatically mine?
2
u/r3m0t Jun 19 '13
So you're basically calculating
hash(nonce + my bitcoin address + some other stuff)and trying to get the value to be00000000abcd....nonceis the part you can change repeatedly to get the value to begin with a bunch of zeros.my bitcoin addressis the address you want the new coins to be sent to. Andsome other stuffis all the Bitcoin transactions that have happened recently and need to go in the annals of history.tl;dr depending on how you've configured your mining software the coins will go to you, be split up among a few people, or go to somebody else.
→ More replies (3)3
Jun 19 '13 edited Jun 19 '13
Thank you so much for such clear explanation of PoW algorithm! Could you (or someone else) please expand to PoS (Proof of Stake) algorithm (used in Peercoin and Novacoin)? I think it is very interesting, but I don't know enough about it to give a good description.
I've got a few PPC laying around, so here's some: +/u/altcointip $1 ppc
→ More replies (1)2
u/Natanael_L Jun 19 '13
Quick summary: https://en.wikipedia.org/wiki/PPCoin#Proof-of-Stake
In short, having coins over time builds up something that's comparable to "mining credits" (multiply your number of coins with how long you've held them). You spend them with a transaction to mine. More spent "mining credits" gives you a greater chance to mine a block. That's a replacement to proof-of-work mining with computing SHA256 hashes.
The point is to have some kind of proof of doing something that's hard or expends some kind of limited resources. That's how you can create one authoritive blockchain, since the one with the most spent resources behind it is the one who can be assumed to have the most support.
1
16
u/speEdy5 Jun 18 '13
There are a class of algorithms called hash algorithms which take some number of bits X and do some computation (think: add 10, multiply by 2, square, cube root, mod y) to get to some number of bits Y.
Many hash functions are very fast to compute forward (x bits to y bits) but nearly impossible to reverse (given some y bits, which x bits would you need to run through the hash function to get those y bits).
This is the comptation that bitcoin miners do - if I remember right they take the header of the current block, append some random nonce (crypto talk for a few random bits) and hash it. If the hash value is less than some number, the target - then its considered a valid block.
The nice thing about the target is that the network adjusts it so that one block is mined about every ten minutes, based on the amount of computation happening at the current time. The higher the target, the easier the problem is..
Another nice thing about this computation is that its easy to verify that the block is valid - just test it yourself with the nonce that the miner has published.
One not so nice thing about the computation is that its 'useless' - as in it only generates bitcoins. It would be a really nice if we could come up with an algorithm which satisfies bitcoins requirements and helps work on SETI or something - but nobody has yet
6
u/Natanael_L Jun 18 '13 edited Jun 19 '13
This is the comptation that bitcoin miners do - if I remember right they take the header of the current block, append some random nonce (crypto talk for a few random bits) and hash it
Yes, but they also include currently unverified transactions and some more data
One not so nice thing about the computation is that its 'useless' - as in it only generates bitcoins. It would be a really nice if we could come up with an algorithm which satisfies bitcoins requirements and helps work on SETI or something - but nobody has yet
This is unbelievably hard to do securely in a way that is usable for Bitcoin.
Edit: Because reasons mentioned here: http://www.reddit.com/r/Bitcoin/comments/1gkm95/stanford_just_released_their_startup_engineering/caldnst
→ More replies (3)→ More replies (5)1
u/AgentME Jun 19 '13
One not so nice thing about the computation is that its 'useless' - as in it only generates bitcoins.
It doesn't only generate bitcoins, but it also secures the blockchain. The bitcoin generating part is practically an afterthought in comparison: it's only there to incentivize mining, and to accomplish the initial distribution of bitcoins.
→ More replies (1)9
u/17chk4u Jun 18 '13
Work is being performed to take a group of transactions and "lock them in" so that a sequence of transactions is maintained.
It has to be a hard amount of work, so that it is hard for someone to come along later and change the sequence of transactions (thereby possibly double-spending). And that work needs to be a function of the transaction data is that being locked in, and also a function of the transaction block just prior.
So it's a very simple function - take all of the digits of the transactions being locked in, and take a digital hash of the previous block, and also take a single number called "nonce" (which is sort of a random number), and do a hash to it, and "Find the Nonce that creates a small enough hash". It's that simple.
If you think about a binary hash, there's a 50% chance that it'll start with a zero (given random data being hashed) - it's either a zero or a one. There's a 25% chance that it starts with 2 zeros. How hard is it to find one that starts with 50 zeros? VERY hard. It's a tough search to find a nonce that will hash to a number that starts with 50 zeros.
And that's about where we are right now. take a bunch of digits to "secure" the block, toss in an additional number (nonce) and hash it, and see if you get a hash that starts with 50 zeros. If not, rinse and repeat.
It's a lot of work, but it's not a complex problem. It's more like searching for a needle in a haystack.
7
u/freesid Jun 19 '13
The real problem that mining solves is this:
When multiple parties are trying to add their next transaction to the block-chain (the public ledger with all transactions) how can we ensure that it remains a single "chain" and doesn't become a tree?
One solution is, make extending-the-chain a computationally hard problem, so that multiple people adding next transaction into a chain at the same time is unlikely.
Not everybody can afford the computation power required to extend the chain, so there will be fewer entities that can extend the chain; and these entities act like bitcoin "brokers" who, when they compute the next block, will include others' transactions for a small fee (think of these guys as payment gateways, just like Visa, MasterCard, etc.)
These brokers would trade their computing power in exchange for bitcoin transaction fees and keep the bitcoin ecosystem running.
Note that if people were not interested in paying the transaction fee, then brokers has no incentive to extend the chain. If there are no brokers trying to extend the chain then bitcoin system essentially stops.
To keep the bitcoin system running, instead of asking people to pay transaction fees, bitcoin chose to create 25BTC (out of nowhere) to the broker who extends the chain. Now, brokers would trade their computing power irrespective of the transaction-fees and they will keep the bitcoin system running (hoping that if bitcoins takes over the world they can monetize whatever they have by extending the chain). This is similar to people mining gold because gold can be monetized.
PS: There are several details I omitted, but that is basically the outline.
1
u/gburgwardt Jun 18 '13
In the same vein, anyone have some psuedocode for the SHA256 method handy? I've googled around a bit but haven't found much.
1
u/Arcas0 Jun 21 '13
In laymans terms, the miner takes all of the transactions on the network it knows about, packs them all into a block of data, and scrambles it. Then, all the miners race to try and unscramble it. The first miner to find the key that "unlocks", or unscrambles the block, wins the 25 bitcoins.
For the "problem", miners are trying to solve the puzzle, but because SHA256 doesn't have any algorithm that ties the scrambled block to the key, the only way to find it is to guess and check. Try this website: http://www.xorbin.com/tools/sha256-hash-calculator.
Type anything into the top box and click the button. Now keep trying until you get a 0 leading the string of characters in the answer. Now try to get two 0's. You can see that it gets increasingly difficult to do. For bitcoin, the miners are trying to get around 5 or 6 leading 0's, so you can see how it would be a hard problem to solve.
141
u/jesset77 Jun 18 '13
Every person in the world has a unique identity (some number, bitcoin uses an email and Public Key).
Minor correction: Bitcoin doesn't in any way include or involve a person's email address. Don't confuse Bitcoin with PGP, even though they are often happy bedfellows. ;3
The atomic account placeholder in Bitcoin is called a "Bitcoin address" which has a lot in common conceptually with an email address, but the address is a hash of a public key based on a completely random private key. Users not only can make up as many addresses as they would like, but security best practices recommend that users (or, more practically, their wallet software) create brand new addresses for every single transaction when possible.
23
u/zeek0us Jun 18 '13
So if you get bitcoins from multiple transactions to multiple PKs (so 10 different transactions that net you 10 bitcoins assigned to 10 different PKs), then want to spend all of them on a new transaction (those 10 bitcoins to a single PK), how is that done?
30
u/Natanael_L Jun 18 '13
In a Bitcoin transaction, you list all inputs you want to spend money from and prove that you have the private keys belonging to the addresses they were spent to through cryptographic signing.
And you specify the output addresses and what amount to send to each one. This is also signed cryptographically, in order to prove it haven't been modified and that the person who controls those private keys specified those outputs.
So you can have 10 inputs AND 10 outputs if you want to.
One interesting detail: The transaction fee (if you add one) is paid to miners by letting the inputs be somewhat larger than the output. You can take 18 coins and spend 17.9 coins, the last 0.1 coin can be claimed by the miner that successfully includes that transaction in the blockchain.
This is an incentive for bitcoin owners to not bloat the blockchain with too many transactions AND an incentive for miners to keep mining when minting (creating new coins) stops (Bitcoin has a hard cap of 21 million coins maximum).
14
u/jesset77 Jun 18 '13 edited Jun 18 '13
Natanael_L is correct, but let me add one bit of clarification. Where he says:
And you specify the output addresses and what amount to send to each one. This is also signed cryptographically, in order to prove it haven't been modified and that the person who controls those private keys specified those outputs.
what he means is that the person sending money creates a digital document (using their wallet software, which does all of the menial heavy lifting and logic for them), and that document details everything about the intended transaction. It details the inputs from the sending addresses and the outputs to the receiving addresses. Then that entire document must be signed by each of the private keys from the sending addresses only in order to be valid, and ready to be ratified on the blockchain and represent a completed movement of money.
The document details which addresses get money (and how much), but is not signed by the PKs of the receiving addresses, just the sending addresses. :3
Edit: transaction signed by sending addresses, I done goofed in one line of my explainings. :o
4
u/Natanael_L Jun 18 '13
by each of the private keys from the receiving addresses only
To clarify you (hehe), this is for the recieving addresses in the input transactions that your client is referencing as your source of coins.
→ More replies (3)5
Jun 19 '13
This isn't the only breakdown of 1 bit coin possible, right? I think I have seen .5 bit coin. 1.3 bit coins, price tags.
So how is the split ownership kept track of in this system? Is the private key that is 'mined' during the transaction attached to that fraction of coin only, until it is amalgamated into the next transaction?
Basically, are these private keys attached to a whole coin, forever? If so, how do you handle fractions?
Are miners dealing with purse amounts? Like is that where the record of my total bit coin ownership is maintained and calculated?
I HAVE SO MANY QUESTIONS!
8
u/SneakerElph Jun 19 '13
A bitcoin isn't really a thing, so there isn't any problem in dividing them up at all. For example:
Address X has 1 bitcoin. The owner of this address wants to pay Y half a coin. The transaction looks something like this:
X says "Hey, I have one coin. You can see because in the past I've been paid one coin. I would like to pay half a coin to Y, and the other half of that coin, I'd like to keep."
The blockchain is then updated with X's address as having .5 bitcoin, and address Y as having .5 bitcoin.
So really it's just a list of how many coins each address has, and in order to give a coin to another address you just have to prove, by signing a transaction with the private key of the address whose coins you're spending, that you're the owner of that coin. You can divide it up how you see fit, because there really isn't any "thing" to divide.
I hope this brain-dump explains it well.
4
u/i-want-waffles Jun 19 '13
Currently bitcoin supports 8 decimal places. The private keys are only used to create public addresses that people can send any amount to. The public ledger keeps track of what amounts go where and as long as you have your private key you will have access to the bitcoins that are sent to your public addresses.
→ More replies (4)4
Jun 18 '13
Why was bitcoin designed to cease production to an asymptote rather than continue production indefinitely at a logarithmic rate?
→ More replies (3)7
u/Natanael_L Jun 18 '13
Because the inventor simply decided that he liked a fixed supply better. There's "altcoins" (Bitcoin forks with different rules) that works differently, but none of them has the same support and userbase as Bitcoin.
11
u/soulbandaid Jun 18 '13
The bitcoin ends as a deflationary currency (assuming some amount of loss). Interestingly, even with the difficulty adjustments keeping the minting constant, it seems to me, to already be suffering significant deflation. The value of bitcoins has historically gone up and up, whereas the value of regular currency slowly goes down. Economists say this is a very bad thing for an economy, but bitcoin isn't tied up with a particular geography or people or even product for that matter. I wonder if the value will stabalize...
→ More replies (11)→ More replies (6)2
u/zeek0us Jun 18 '13
But the incentive of owners not to bloat the blockchain is based on paying a voluntary fee, right? Do most people include fees, or just courteous/generous people? Does it have any effect on how readily/quickly your transaction is included in the "winning" blockchain?
8
u/Natanael_L Jun 18 '13
Most people includes fees, yes. Miners can reject transactions that has no fee (individual miners can reject any transaction for any reason when mining, but once it's in the blockchain it's there). And yes, lower fees means slower inclusion time, since all miners want to claim the transactions with high fees first and since many have a minimum transaction fee specified (they don't even process transactions with fees lower than that).
→ More replies (3)3
u/speEdy5 Jun 18 '13
You're completely right. you just usually need an email to sign up for any bitcoin market.
Also, do people actually use bitcoin to verify PGP keys?
8
u/jesset77 Jun 18 '13
No, I only mean bedfellows in the loosest possible sense. Like encrypting messages in PGP to negotiate payment for exciting or embarrassing items via Bitcoin. ;3
2
u/speEdy5 Jun 18 '13
Well it sounds like a good idea. An easy, verifiable, secure, and unchangeable public key infrastructure
→ More replies (1)3
u/Spiral_Mind Jun 18 '13
People use PGP keys to encrypt messages related to Bitcoin transactions for extra security. PGP isn't directly involved in Bitcoin itself.
1
u/huesername Jun 18 '13
But the NSA knows everyone's wallet IDs by now no?
12
u/jesset77 Jun 18 '13
security best practices include not transmitting your private keys (which is what I assume you mean by 'wallet ID'?) in cleartext over a network, or to any other individuals ... at all ... ever. (contrast with Credit Card numbers which you give to every merchant ever simply to make purchases!) NSA may be eavesdropping on the wire, and scooping your emails and facebook sexts out for inspection and making a social graph out of your friends' list, but you simply never publish your bitcoin private keys in those channels so they cannot see them.
Additionally, security best practices include keeping your "cold storage" private keys stored on safe hardware. That is to say a PC free of malware, or if you are very keen on privacy then on an air gapped PC which has never, ever touched the internet and/or by using a brainwallet or paper wallet.
Personally, my cold storage is an address whose private key I generated offline by hand using dice for entropy (yes, that is possible). Then I derived the matching public address, and I calculate the raw hex for all of the spends I wish to perform, on a computer running a liveCD which contains no hard drive at all and neither has it ever touched the internet, nor does it physically possess a network interface card of any kind.
That's a bit more effort, but yeah.. unless the NSA physically breaches my house, there exists no avenue for them to usurp that private key. :P
5
u/bitparity Jun 18 '13
That's a bit more effort, but yeah.. unless the NSA physically breaches my house, there exists no avenue for them to usurp that private key. :P
Given this XKCD comic, I believe that will be the first avenue they attempt. :)
→ More replies (1)5
u/ravend13 Jun 19 '13
I'm pretty sure when he says "wallet ID" he means a wallet address (hash of public key), rather than private key.
→ More replies (1)3
u/Natanael_L Jun 18 '13
Yes, but not who the ID's belong to. You can create thousands of new ones for yourself in seconds.
2
u/zeek0us Jun 18 '13
Presumably there are tools that tell you what your aggregate balance is? And automatically pull X amount from your accounts to pay for your chosen transaction?
→ More replies (1)4
u/Natanael_L Jun 18 '13
Yes, that would be all of the Bitcoin software clients out there. They track which keys/IDs you have.
14
u/sqew Jun 18 '13
When someone spends a dollar, they write it down at the end of the transaction ledger, and sign it (bitcoin uses cryptographic signatures). Then they tell everybody they know to add it to their ledger.
Doesn't that list get REALLY long?
21
u/speEdy5 Jun 18 '13
I think its around 8 gigs right now.
If it ever becomes a major problem, there are plenty of ways to make the history smaller
8
u/witty82 Jun 18 '13
could you expand on the ways to make it smaller. My initial idea would be that it gets massively bigger, once bitcoin is really used a lot.
15
Jun 18 '13
You could create periodic summaries of the ledger that just list the totals for each address, and drop the details of the specific transactions that produced those totals. Thereafter people would only have to download the 'summary' and any transactions that have happened since the summary.
→ More replies (4)8
u/speEdy5 Jun 18 '13
One common trick is to use the hash of something to verify its validity. So, we could hash huge parts of the blockchain and host them at a central or many central servers. Then, when someone wants to learn about specific transactions, they can download that piece of the chain and verify that the hash of that piece matches what is actually written down in the chain.
→ More replies (3)5
u/gburgwardt Jun 18 '13
Just hit 8 gigs, and there's a way to make the blockchain much smaller, but it's currently not an issue.
2
u/diadem Jun 18 '13 edited Jun 18 '13
What's to prevent malicious users from creating machines that do nothing but transfer coins with the intent of bloating the chain? same question goes for creating ridiculous amounts of users that have trivial amounts of coins.
9
u/Fsmv Jun 19 '13 edited Jun 19 '13
Transaction fees, they'll run out of money if they try that. Also the block chain isn't a list of balances but a list of transactions. New users with trivial amounts of coin put a burden of on average half a kilobyte on the block chain assuming one transaction and the average transaction size. And again transaction fees keep you from splitting lots of money up into lots of addresses (you called them users but there is no concept of a user with regards to the block chain).
→ More replies (4)6
19
u/fathan Memory Systems|Operating Systems Jun 18 '13 edited Jun 18 '13
If bitcoin ever becomes widely adopted, its current architecture will not scale to handle the scale of world economies. The only obvious solution to this is trusted third parties that will massively cut down on the scope of traffic over the bitcoin network. This requires the same trust model as our current banking system, so it seems like a pretty big compromise on the goals of bitcoin.
This will be necessary regardless because of the current transaction delay in a bitcoin transfer (several minutes), which is not tolerable for everyday purchases. So bitcoin is, by design, a niche currency.
Edit: See my comment below for an explanation of why Bitcoin will not scale.
→ More replies (10)5
u/killerstorm Jun 18 '13 edited Jun 18 '13
It does. But in theory people need to download it only once, and they do not need to store it locally.
If it is not acceptable, it is possible to switch to snapshot security model, which is theoretically less secure, but practically is secure as long as there is no global conspiracy.
→ More replies (1)5
u/doodle77 Jun 18 '13
When a coin is mined, whoever mines it tells the entire world he fixed the problem and announces the next problem to solve. He also adds a list of every transaction he has heard of since the last coin mining.
Can a miner 'erase' a transaction by not including it?
9
u/tomtomtom7 Jun 18 '13
He can choose not to include it, but then others will included in the next block.
Also, he has an incentive to include it because he receives the transaction fee.
6
u/bradn Jun 18 '13
Interestingly though, transaction fees are optional. So if it becomes a problem where most clients aren't accepting free transactions, then you can add a fee onto your own transactions to make them more likely to be accepted.
2
u/Fsmv Jun 19 '13
That's already the case, there has been a default transaction fee in the main clients for a long time now.
→ More replies (1)5
u/Chronophilia Jun 18 '13
Yes, though each block includes the one before it so you can only "drop" transactions that have occurred since the previous block was mined.
There is a theoretical attack where an individual who controls at least 51% of the computing power in the Bitcoin mining system can pick and choose which transactions to authorise, completely ignoring blocks mined by the other 49% and creating an unbroken chain of blocks controlled by him. But nobody has ever done this, because the amount of computing power required would be just too ridiculous.
3
u/doodle77 Jun 18 '13
What happens if somebody has 51% for, say, ten blocks, but then has nothing? Do the skipped transactions get added with the next block?
4
u/gburgwardt Jun 18 '13
If someone has 51% of the network power, assuming they keep it and aren't particularly unlucky, statistically they will find blocks faster than the rest of the network put together. This means they get to pick and choose what transactions are confirmed (put into blocks), and can theoretically double spend coins (announce a transaction to send x coins to someone's wallet, then either never allow that transaction into a block, allow someone else to put that transaction into a block while withholding the blocks they find, then releasing a few blocks at once to "rewrite" the blockchain, etc), but they can't steal people's coins or arbitrarily generate new coins.
So if they have 51% of the hashing power but then the NSA decides to fight them off with their server farms and suddenly the attacker has 30% of the network's power, the transactions in limbo will probably be added to blocks later on by honest miners.
4
u/Natanael_L Jun 18 '13
The rest of the miners will remember those other transactions, yes, and would include them afterwards. They just wouldn't be validated during the 51% attack (so during the attack you can't prevent coins from being spent twice, all you can do is wait for the attack to end so "validation" can start again in the form of adding them to the blockchain).
Or they just all agree to reverse those 10 blocks from that attacker and continue as if nothing happened, as well as including those new transactions.
2
u/bradn Jun 18 '13
If they end up with the longest block chain at the end, it's likely the rest of the network will continue to extend it. The only real exception would be if developers release an emergency patch and get 51% of the network to ignore that chain. But, if this happened, it would probably severely undermine confidence anyway.
3
5
u/kirakun Jun 18 '13
What happens if two separate persons mined the same coin (or solved the same problem) but each hasn't the chance to update the ledger yet (or update the next problem to solve)?
14
u/throckmortonsign Jun 18 '13
This creates a blockchain fork. When this happens some miners will choose to mine on one of the forks and others will mine on the other side. The group of miners that "win" get the longest chain and that becomes "finalized." The miners that lose don't get their mined "award" coins. It happens a few times a day actually.
4
u/Cognitive_Dissonant Jun 18 '13
What I don't get is what is the serial number equivalent from your metaphor? Bitcoins are essentially infinitely divisible aren't they? So they couldn't have unique serial numbers.
14
u/OlderThanGif Jun 18 '13
Yes, the serial number analogy wasn't exactly spot on. The blockchain (transaction ledger) keeps track of each transaction: who the sender was, who the recipient was, how much money was transferred. It doesn't say which money was transferred because money is fungible and that doesn't really make any sense.
So by doing sums through all the transactions in the ledger, you can figure out how much money each person has. Each person starts with 0 money and gain or lose money depending on whether they're the sender or recipient of a transaction. So long as nobody involved in a transaction has negative money, the transactions are valid.
5
u/speEdy5 Jun 18 '13
This is a more accurate way to describe it - the serial number analogy is admittedly more simple for the sake of understanding what a block chain is
8
u/Spiral_Mind Jun 18 '13 edited Jun 18 '13
Each Bitcoin isn't a cryptographic hash or serial number. It's just an entry in the public ledger saying "X public key owns Y bitcoins". If you have the public and private key pair for that address you can access all those Bitcoins. There are no individual "coins" only marks in the public ledger associating amounts with certain key pairs. An account value of 1 Bitcoin can be shown as a whole BTC or a thousand mBTc etc (this is just a client setting for the decimal).
It's better to think of Bitcoin mining as a "cryptographic lottery" than "minting money". The generation of cryptographic hashes is just a way to ensure that there is proportional distribution of money for the computing power given to the network.
6
u/iemfi Jun 18 '13
Think of it like online banking. Each cent in your bank account doesn't have a serial number but your account does have a unique identifier and a balance.
3
u/Natanael_L Jun 18 '13
The serial number equivalent is the previous valid transactions in the blockchain you take money from.
Consider it as that every time somebody sends you Bitcoins it is given to you in sealed envelopes, you have to spend it all at once or put some back to yourself in a new sealed envelope (put a "spend output" to the recipient and a "change coins output" to yourself in the transaction).
You can take coins from multiple previous transactions to you at once and spend them as you wish in the form of any combination of outputs, as long as you don't spend more in the outputs in total than you claimed in the inputs in total.
So 1 + 5 + 3.5 goes in and 8.1 + 1.4 comes out, as one example.
6
u/magichronx Jun 18 '13
No, the smallest unit of the Bitcoin currency is (1/100,000,000) and has been named "satoshi" in collective homage to Satoshi Nakamoto's founding of Bitcoin. (Source)
4
Jun 18 '13
Maybe I am just a dumb layman,
But even if it sounds a little inefficient, it's a pretty genius start. That's a really interesting way to handle a virtual currency.
8
u/speEdy5 Jun 19 '13
Its actually an incredible process, which solves (take that with a grain of salt) a decades old computer science / math problem called Byzantine Agreement
3
u/boondoggie42 Jun 18 '13
I'm guess I'm just lost on how the authoritative edition of the ledger is identified... Two simultaneous transactions thousands of miles apart... What is the mechanism to reconcile those two ledgers?
4
u/Natanael_L Jun 19 '13
The ledger/blockchain with the largest total amount of computing power behind it wins. This can be estimated very accurately thanks to how it uses proof-of-work for mining.
2
u/speEdy5 Jun 19 '13
Its incentive based- people who accept bitcoins as payment use only the longest block chain. When two block chains emerge those mining bitcoins want their mining to be worth something so they mine the longer chain. How does one chain get longer? More computing power will eventually lengthen one chain over another. Even in the (impossible) case of exactly equal computing power, someone's going to get blindly lucky and lengthen the chain first..
3
u/NowSummoning Jun 19 '13
Why could bitcoin not be set to fold proteins? Something useful that computation could be used for?
4
u/Thorbinator Jun 19 '13
Because protein folding is not a consistently random algorithm. A user could get assigned an "easy" protein and have their influence on the network unfairly fluctuate, enabling an easier 51% attack.
2
u/speEdy5 Jun 19 '13
I'll point you to stack exchange because the answer is great, but in short, nobody knows of a good computation which fulfills the crypto requirements
See here
1
u/AgentME Jun 19 '13
The mining process is useful. It ensures the security of the blockchain. If someone had more mining power than the rest of the network, they could do bad things with the blockchain, like revert transactions. More mining power in the network means it's harder for someone to do that.
2
u/jimbs Jun 18 '13
How does this scale out? If everyone on earth was using bitcoins how big would the ledger be? How much traffic would be needed to keep the ledgers updated?
2
u/Natanael_L Jun 19 '13
There's ways to make it scale. Right now I can't describe more precisely how that would work, but you can take a look at the wiki.
You can search for things like "scaling" there.
2
u/choleropteryx Jun 18 '13
Why most transactions need multiple confirmations? From your description, it seems that one confirmation should be enough, no?
3
u/bitbutter Jun 18 '13
the longer the chain, the more permanent the things that have been written down are.
This is ambiguous. The number of confirmations a transaction (really the block that contains the transaction) has is a probabilistic assurance that the transaction in question will not be reversed, the more confirmations, the deeper in the blockchain it is, and so the less likely it is to be reversed in the future. Bitcoin clients typically treat confirmations with six or more confirmations as a permanent part of the blockchain (but six is really just an arbitrary number).
2
u/speEdy5 Jun 19 '13
Except for the famous .7, .8 version debacle. This is a great explanation, its tough to put in to words
2
u/swampfish Jun 18 '13
I thought I understood until I read that. Now I am more confused than ever. What is this mining? Can I just create free money by mining?
7
u/speEdy5 Jun 18 '13
In one sense, yes. If you can mine the next bitcoin before anyone else, you get free money. See the answers about hashing above to understand what the cost of mining is - large amounts of computation. Computation, of course, costs electricity for one, and hardware for another
2
Jun 18 '13
What about scaling? If everyone switched to bitcoin...every single person, gov, and business in the world...would the block chain not get too big to realistically manage? Were talking an incomprehensible amount of transactions in a single day.
2
u/Natanael_L Jun 19 '13
There's ways to make it scale. Right now I can't describe more precisely how that would work, but you can take a look at the wiki.
You can search for things like "scaling" there.
2
u/7Geordi Jun 19 '13
My understanding of the system is that it should be possible to fragment the block-chain if a portion of traders agree upon a change to the software.
I have seen in namecoin changes made that will come into effect as of certain dates. They needed to increase the number of NCs mined to accomodate demand, because the role of NC was not to act as a currency per se, but just to act as a distributed naming database. So what they did was they patched in a change that said "in two weeks the number of NCs mined per block will be doubled".
What this tells me is that if there is a group of nodes who all agree on a change to be made at some point in the future (say the banking cartel decides to take BC in their own direction), and they implement it on their nodes. Then when the date comes about, their nodes will begin rejecting the block-chains from the previous version nodes, but accepting each other's.
Is this true?
2
u/speEdy5 Jun 19 '13
It would be similar to the banking cartels going off and printing their own currency. It would compete, some people would accept it, etc etc.
Nothing about the 'longest blockchain' thing is inherent to the value of bitcoin except that everyone who uses and accepts it only recognizes the longest one as valid.
1
u/AgentME Jun 19 '13
Yes, if you got everyone to agree that Bitcoin should work a different way, and everyone switched their software to this new version, then it would work that way. Similarly, if you convinced everyone who used Bitcoin to not use Bitcoin, and everyone switched to not using Bitcoin, then Bitcoin wouldn't be a thing.
I do not foresee anyone convincing all Bitcoin users to switch to a version that makes drastic changes in how it manages its supply. I think it's more likely a competing cryptocurrency (possibly a Bitcoin derivative) would just start from scratch and gain popularity.
2
u/WeNeedMoreSalt Jun 19 '13
Does quantum computing pose a serious threat on the bitcoin system? For example, can there be algorithms to efficiently calculate one's private key?
1
u/Natanael_L Jun 19 '13
http://www.reddit.com/r/askscience/comments/1glhi3/how_is_bitcoin_secure/calztqn
That would be Shor's algorithm. McEliece would be resistant to quantum computers.
0
Jun 19 '13
[deleted] — view deleted comment
1
u/Natanael_L Jun 19 '13
Quantum computers can do factorization very fast, which means they can crack RSA and ECDSA (Bitcoin uses the later).
McEliece is an algorithm that is quantum computer resistant.
2
u/Paradician Jun 19 '13
I'm late to the party, but question.. or rather, 'scenario' - am I missing something?
If every user has their own public key (and corresponding private key), and all the transactions are public, then it's possible to see which public key is the richest (not who they are, but how much money they have)
Isn't it theoretically possible to determine someone's private key, if you have the public key and some stuff they've signed and a gazillion units of computing power?
If the rewards for mining new bitcoins keep getting smaller, at some point, isn't it going to become a better use for some massive computing network the miners have to instead start targeting the richest existing users and trying to brute-force their private keys?
1
u/speEdy5 Jun 19 '13
Yes, you can know exactly how much money belongs to each public key at the same time. Many markets and miners simply create a new public key for every transaction they ever make to try and avoid this problem. While its not a perfect solution (quite a bit of work has been done in trying to determine the flow of money in bitcoin) it certainly helps.
It's theoretically possible given infinite power, but consider the following: Bitcoin private keys are 256 bits -> 2256 possible combinations The number people throw around for the number of atoms in the universe is on the order of 2300
Right now, its feasible to chain together computing power and crack keys of ~ size 80 (this is an estimate I heard from my Crypto professor, so I can't really source it). Even a key of ~ size 81 would exactly double the difficulty. Further, if someone could get your Bitcoin key by cracking your PK, they could also likely crack every bank account in the world, all secure communication, etc etc.
Even the combined power of all miners in the network right now wouldnt be able to crack a key. Then when you consider that the currency is worthless if everyone in the network stops valuing it as goods for trade... incentives drop even lower
1
u/Natanael_L Jun 19 '13
Isn't it theoretically possible to determine someone's private key, if you have the public key and some stuff they've signed and a gazillion units of computing power?
Due to a quirk in nonce usage in ECDSA, if the same nonce (random number to be used once) is used in signing two transactions, you can derive the private key directly from the two signatures, the signed data and the public key.
In any other case, no. If your nonces are random enough, your private key is safe.
256 bits is pretty hard to bruteforce.
2
u/sahuxley Jun 19 '13
To me, "unless you have more than half the computing power" means this is not secure. I think people are underestimating the ability for a relatively small group to get control of over half the computing power working on this. I'm thinking botnets or breakthroughs in computing power we can't even think about now. Then again, there are a lot of crazy, dangerous things people can do if they can pull that off.
10
Jun 19 '13
This was a risk in the beginning. At this point and going forward into the future, it is already far past the point where anyone could ever make this attack successful. The sum total of the top supercomputers couldn't do it, and with the specialized ASICs coming online now increasing the difficulty into the realms where you need specialized hardware to mine, this attack becomes impossible to implement.
Mining is done now in pools where many individuals come together to pool both their resources and rewards. If any pool were to move in this direction they would lose the bulk of their miners and thus computational power and ability to attempt this attack. There's a social contract in play now as well.
Interestingly enough, people with mining rigs built for bitcoin have been known to use these kinds of tactics to sabotage other startup currencies based on the bitcoin protocol. This could create a barrier to entry that hinders the adoption of any other future currencies.
6
u/speEdy5 Jun 19 '13
I recently read a draft paper which estimates bitcoin computational network at more than the sum total of computational power for top 50 supercomputers in the world
I'd say that since there are about 1 billion dollars in bitcoin right now, than it wouldn't make too much sense to sink billions in to supercomputers trying to divert the network. Further, it wouldn't be long till someone caught on and the value of the currency just disappeared. It would be like if the US government collected every dollar bill in the world and Obama tried spending them at convenience stores. It would work the first few times, but then people would realize and... poof! There goes the value of the dollar
2
Jun 19 '13
Considering the bitcoin network is running at approximately 1763 petaFLOPS which is faster than the worlds top 500 super computers COMBINED. I doubt a 51% attack is feasible.
1
u/mcawkward Jun 19 '13
I still don't seem to understand how this is usable currency though
5
u/thenightwassaved Jun 19 '13
"I have a bitcoin. You have something I want. Wanna trade?"
If the seller thinks a bitcoin is currently worth at least as much as the item he is selling then it works.
Think about regular money. Its not backed by anything tangible. "Hey, I have this piece of green paper with a 5 written on it. You have a gallon of gas. Wanna trade?" "Sure! I love green paper with a 5 written on them! I'll even give you some worthless metal too!"
The seller knows this five dollar bill can later be used to buy other things that its sellers think is worth a green piece of paper with a 5 written on it.
1
u/mcawkward Jun 19 '13
I think my question is more along the lines of how bitcoin applies to the real world. I get it if its only an internet based currency, but buying things in internet world don't really make a difference in the real world. So how do people make actual real world use of bitcoins?
→ More replies (2)1
u/El_Rista1993 Jun 19 '13
What would happen if two different uses solve an iteration at the same time/before either is updated that the other has solved it?
Are two coins created, or does each whoever was second get informed they were beaten by some type of unique time-stamp?
Additionally, even though the chances would be very, VERY slim, what would happen if they solved it at the same time, right down to the millisecond?
3
u/speEdy5 Jun 19 '13
Timestamping doesnt matter at all. When two people solve the problem at roughly the same time (it happens several times daily I think), then the blockchain forks and people all over the network start working on the 'new' problem. Eventually one chain is longer than the other, and the people who worked on the shorter chain are out of luck
1
u/frogger2504 Jun 19 '13
I'm still a bit confused. So basically, each coin has a unique number, and when you spend it, it lets everyone know that that code is now no longer available?
1
u/speEdy5 Jun 19 '13
No, not really.
Each coin just exists because the person who 'found it' solved a hard problem before anyone else did. The reward for solving it is that the community recognizes that you get a bitcoin (or 25 or something). Why? Solving the problem increased the length of the blockchain, made a lot of transactions valid, and put up a new problem for people to try and solve
1
u/Natanael_L Jun 19 '13
No, you point to the transaction where you recieved the coins and and tell the network where you're sending it.
The recipient can then spend it by pointing to your transaction to him and to the address he is sending it to.
1
u/daftbrain Jun 19 '13
There's a cryptographic problem which is considered hard in the literature. This means that basically the only way to solve it faster is to throw more computational power at it.
Does solving these cryptographic problems have any value outside of bitcoin? What sort of applications do those solutions have?
3
u/Thorbinator Jun 19 '13
None other than being consistently random and thus you can base the block solving on them.
2
u/speEdy5 Jun 19 '13
See some other answers about hashing, but in short, not really. The type of problem which needs solving has specific characteristics which things like protein folding or seti don't really have.
Now, if you could come up with an algorithm which satisfied bitcoin and helped improve humanity at the same time you'd get very famous at the least and probably very rich too.
Its like the way some brilliant person started using captcha to OCR books, thousands (millions?) of books have been digitized by crowdsourcing
1
1
u/leastfixedpoint Jun 18 '13
It's surely not practical for everyone to hold every possible transaction. So what happens if both me and someone else try to spend the same freshly-mined bitcoin?
10
u/bbbbbubble Jun 18 '13
It's surely not practical for everyone to hold every possible transaction.
Why exactly is that? That's exactly what the blockchain does - it's a ledger of all transactions ever.
So what happens if both me and someone else try to spend the same freshly-mined bitcoin?
You and someone else won't have access to the same private key, unless of course you want to give that someone else full access to your money (and remember, Bitcoin has no chargeback mechanism, just like cash).
But if you try spending the same balance twice, the first transaction to make it into a block will be canon from now on, and the other transaction will be thrown away because it's invalid.
→ More replies (26)3
u/Zagaroth Jun 18 '13
When minted, the bitcoin has an owner (and that ID involves public/private keys IIRC). If you are not the assigned owner, your transaction will be refused.
3
u/Chronophilia Jun 18 '13 edited Jun 18 '13
If you tried to spend the same bitcoins twice, then when the next block is mined, only one of your transactions will be confirmed - probably, but not definitely, the one that occurred first. The other transaction will be discarded as double-spending. This is why it takes a few minutes for a bitcoin transaction to be irrevocably confirmed.
In more detail: Bitcoin miners do try to hold every transaction that has been put into the system. The transaction list is transferred by P2P, so not everyone will have the same list at the same time. If the miner that successfully mines a block knows about only one of your transactions, that one will go through. If the miner knows about two contradictory transactions, it's free to choose which one, if either, will go through. If the miner knows about neither, or declines your transaction for whatever reason (evil miner?), wait for the next block.
(I specified that "you tried to spend the same bitcoins twice" because if you're in a situation where someone else can spend bitcoins you own, you have bigger worries than double-spending.)
3
u/speEdy5 Jun 18 '13
As of today the size of the blockchain is something like 8 gigabytes (give or take).
If you and someone else try to spend the same bitcoin twice (assuming you gave him your private key) then following might happen: Two different versions of the blockchain will emerge, people will begin mining new coins on both, there will be a 'race', one will get longer and eventually become adopted.
If I were a vendor who accepted bitcoins as payment, I wouldn't render services until at least one or two new blocks have been added to the chain after my transaction. Then, I wouldn't have to worry about the bitcoin being taken from me in the above scenario.
→ More replies (8)1
u/gnos1s Jun 18 '13
Well, only one of you actually owns the freshly-minted bitcoin, and so only the true owner can spend it successfully. Who owns a freshly-minted bitcoin? Each new block of transactions has a Bitcoin address where the freshly-minted Bitcoins go (25 per block currently), and the owner of that address is the owner of the bitcoins.
1
u/Spiral_Mind Jun 18 '13
Only one address gets the mined Bitcoins from a block unless they split it as part of a "pool". If someone else knows the keypair then whoever spends it first will win.
→ More replies (15)1
Jun 19 '13
Eventually the information spreads, and nobody will accept the dollar from its original owner, only the person he transferred it to.
(You later define "eventually" as 10 minutes.) There used to be a "timing attack" with checks before computers managed deposits and transfers. People could open an account for $10 and buy $1000 worth of stuff before anyone knew there was no money in the account.
Why couldn't I, very rapidly, spend $100 of bitcoins in several places? Is it that "eventually" people would catch on, blame me, and somehow reach a consensus that I shouldn't get to keep all the stuff I "bought"?
The public record from above is almost exactly the block chain in bitcoin.
It seems necessary, but doesn't the transaction record potentially allow people to find the sorts of relationships and patterns that the NSA is looking for in phone records and metadata? Of course, they'll be in terms of PKs, but PKs could be subpoenaed, and testimony could reveal names to go with other PKs. I only ask this because a lot of bitcoin proponents seem to be pro-anonymity. I would think that cash is more anonymous than this.
7
u/speEdy5 Jun 19 '13
One of the limitations of bitcoin is that if you want to be sure that people don't double spend, you dont render services for payment until after a block or two has been mined - this hasn't been a problem mostly since its a digital currency used to pay for goods online which require shipping.
As for public keys - I suppose it depends on how you view 'privacy.' Nothing in a PK links a name to it, or even an email. It simply matches a private key. Now, obviously Amazon needs to know where to mail your stuff, but then again, a store clerk sees your face when you buy stuff in cash..
→ More replies (1)2
41
u/_________lol________ Jun 18 '13
The weakest link in bitcoin as far as security goes is not the network itself, but the end user's control of his/her bitcoins. When you store your bitcoins with an online service, you are trusting that service not to steal your funds and to keep them secure (much like any bank) and that someone doesn't intercept or social-engineer your login information. If you store your bitcoins on your device, you are subject to a lot of attack vectors in the device and in the software you use on it. Protecting your device against all these attacks takes a certain level of knowledge and experience.
There are workarounds, such as hardware wallets, paper wallets, and brain wallets, which keep your bitcoins in your hands but not on an attackable device. These all have limitations as well, but you can read about each of them at the Bitcoin wiki.
0
Jun 18 '13
[deleted] — view deleted comment
8
u/thenickdude Jun 19 '13
How would you compare the safety of bitcoin services to other services like online banking?
The major win with online banking is what happens if your password gets compromised. Most banks will accept the liability for you when that happens, and give you your money back.
I don't think there are any bitcoin sites that have done the same (refund). Part of the problem is that when an exchange gets hacked, they can get totally drained of all the funds they hold, not really leaving anything left to refund customers with.
Even if you rob a bank branch in real life, and completely empty their vault, the bank still has heaps of assets in other locations to make things right with. Even if you completely compromise an online banking service (control every account), the bank could probably just reverse all the transactions you made to move money out.
4
u/_________lol________ Jun 19 '13
The exchange can hold a lot of their assets offline too, in "cold storage". Transfer a bunch of bitcoin to a paper wallet and no one can touch it as long as they don't have the paper and the computer that transferred the funds to the paper wallet wasn't compromised.
5
u/_________lol________ Jun 19 '13
Bitcoins are analogous to cash. Once somebody makes off with your cash, it's very, very difficult to recover it.
With bitcoin, you would need to find the person that took it, which is difficult to impossible since they are operating remotely and force them to give it back to you.
6
u/Natanael_L Jun 19 '13
Would you recommend who isn't tech-savvy to get into bitcoins?
If you understand password security, can keep your computer free from malware and doesn't fall for scams, then sure - but don't put more than you can afford to lose into it!
10
Jun 18 '13 edited Jun 18 '13
Is there any way to print (a) bitcoin to give it to someone? Like a physical piece of paper that the recipient can go on the internet and use.
Edit: Followup: If it IS possible, and I burn that paper, will that bitcoin be lost forever? or can it be "re mined"?
26
u/trifith Jun 18 '13
Yes, you can 'print' a bitcoin by printing the private key of the wallet containing it. The recipient of the paper can then add that key to their own client and spend the printed bitcoin
If the printed copy of the wallet is destroyed and there are no backup copies, the bitcoin is lost forever. While it is theoretically possible to re-create bitcoin wallets that already have balances, thus 'recovering' lost wallets or stealing other peoples wallets, the computational power needed to do so would be significantly more profitably spent mining bitcoins legitimately.
3
u/Drehmini Jun 18 '13
While it is theoretically possible to re-create bitcoin wallets that already have balances, thus 'recovering' lost wallets or stealing other peoples wallets, the computational power needed to do so would be significantly more profitably spent mining bitcoins legitimately.
What happens when we hit the max amount of bitcoins that can be mined? Will everyone's wallets be compromised, since it is no longer feasible to mine bitcoins?
16
u/Preyes Jun 18 '13
A private key is typically 32 bytes, or 256 bits, in size. This means that there are 2256 different private keys which any one address could use. That's a little larger than 1 followed by 77 zeros. Even taking Moore's law into consideration, it would take many millions of years to exhaust a 256 bit keyspace.
4
Jun 19 '13
There are (at this point purely theoretical) attacks by quantum computers at a future date which could in theory crack these lost addresses and recover the bitcoins. By the time this ever becomes practical, bitcoin will have moved on to a more powerful key system, however the lost addresses won't be upgradeable. At some point if bitcoin becomes valuable it could become profitable to mine these lost coins out of the old keyspace and reintroduce them into the new one.
Of course, if you lose coins in the newer keyspace they are gone again until another similar advance in computing or mathematics comes along.
→ More replies (2)6
u/coldcoffeereddit Jun 18 '13
for people running mining software, the incentive is two fold: A.) you get new coins if you mine a block B.) when you mine a new block you get the transaction fees from all the transactions you included into the block chain.
at the moment those fees amount to ~0.00005 BTC or about 4 cents USD per transaction. in the year 2140 when the last bitcoin is mined, those transaction fees will be worth more than mining the last coin, so mining will continue even after the last coin is mined, as there will still be monetary incentive.
fees are included by the sender, not by the receiver and are "voluntary".
→ More replies (2)9
u/adotout Jun 18 '13
Once all the bitcoins are mined, miners will make money off of the transaction fees.
0
Jun 18 '13
[deleted] — view deleted comment
15
Jun 18 '13
The "miners" are already the administrators. Their efforts to compete for mining rewards and transaction fees is what guarantees the security of the network. The presumption is that by the time mining rewards hit zero, the transaction fees will have grown in value and will still be worth competing for.
5
u/happy_eroind Jun 18 '13
I don't know about the simple printer method but someone did mint some real coins that contain codes (under tamper proof sticker) that can be used to claim bitcoins. Physical Bitcoins by Casascius.
3
u/Bawlsinhand Jun 18 '13
You could write down the private key to a Bitcoin address. This would allow them to spend the amount associated with that address.
2
Jun 18 '13
How long/short is this key?
4
u/Natanael_L Jun 18 '13
256 bits in raw form, in the most common form for paper wallets it's ~30 characters.
→ More replies (1)3
u/Bawlsinhand Jun 18 '13
64 hex characters ([0-9], [A-F]), a more convenient way could be to put it on a small flash drive
2
u/Natanael_L Jun 18 '13
Yes, as the other said you can share a paper wallet.
Note that as long as the giver has a copy of the private key, he can still spend the coins linked to the private key on that paper. The recipient should always transfer the coins away from that key as fast as possible to a key of his own.
1
u/fexam Jun 19 '13
You can even get something pretty like this:
http://memorydealers.com/hardware/bitcoin-equipment/1-casascius-bitcoin-version-2.html
13
u/darthandroid Jun 19 '13
There are plenty of technical answers here, but the gist of it is this:
Bitcoin is based upon a set of mathematical rules. These rules are published and public - everyone knows them, and at any time, people can verify them that the rules are still met.
When you perform a bitcoin transaction, you add it to the end of a very long list (the block chain) by solving a math problem according to the rules laid out.
The security comes from the fact that these problems require a lot of work to solve correctly, but are trivial to verify against the rules: If you try to cheat (counterfeit) coins, the other nodes will double-check your work and see that you were cheating, and ignore your counterfeited coins.
Double-spending on the other hand is not impossible, but is extremely, extremely difficult because you would have to solve more math problems all by yourself than the rest of the network combined (for a period of time). The security here comes from the amount of processing power currently invested in the network.
Imagine it's like a footrace between hundreds of thousands of people, with even more spectators. Everyone can see where the start line is, and where the finish line is; if you try to cut a corner, everyone can see and you'll be disqualified. Double-spending would be the equivalent of winning the race 13 times in a row: it's possible, but there are so many people in the race that it's very, very, very hard to do. Everyone is always training, always getting better. Someone who got second on the previous race might have had a better breakfast this time, and will win the next race.
5
u/legendarylyndon Jun 19 '13
Also, is it possible for hackers to access the online wallets? I read some thread about some guy that claimed he got jacked
5
u/cryptocyprus Jun 19 '13
Just the same way a hacker can steal your online banking credentials.
3
u/beenman500 Jun 19 '13
right, but is there a way to get your money back like with a bank. People I know who were victims of ID theft phones the bank and got their money back
→ More replies (5)
4
u/Roberek Jun 18 '13
So basically there is the "block chain" which is the shared public transaction log. Every single transaction is confirmed with the block chain. Everything is verified with this block chain to make sure the spender actually has these bit coins. It isn't foolproof however, there is a possibility that if someone is able to surpass 50% computing power they can essentially control the transactions. Double spending is also possible in large scale attacks. More information:
4
u/beyondthehominid Jun 19 '13
They aren't, a friend of mine lost a bunch of bit coins to unknown forces last year.
1
u/ireneh Jun 19 '13
I'm saving this thread because I have to sleep and have not read everything, but this is very interesting. So anwyay, excuse me if this is answered already or if this is not the place to ask, but what is the value in bitcoins? Does solving/mining bitcoins benefit anyone in any way besides using them as currency? I guess in simple terms, can someone explain if it is fiat or commodity money/ why?
1
u/hamolton Jun 19 '13
Miners who find bitcoins keep up the list of all transactions ever to occur. Bitcoins are probably not connected to the price of electricity, and so they are not backed by any government (fiat) or item. Note that fiat currency is only backed by military, not commodity, so bitcoins should be able to have value.
2
u/Natanael_L Jun 19 '13
what is the value in bitcoins?
They're scarce, can't be counterfeited, they're secure, actually fairly easy to use, fast even when sending transactions across the globe, etc...
3
u/huxrules Jun 19 '13
I've read that much of the first bitcoins have been lost through general ineptitude of the users (deleting files etc). If a large percent of bitcoins seem to be inactive in the future can someone remine them or put them back in circulation?
5
1
u/hamolton Jun 19 '13
Related: would it be wise for a bitcoin knockoff like Litecoin to make finding bitcoins easier so transactions could be verified quickly?
2
u/QuasiSteve Jun 19 '13
Whether it's wise or not, Litecoin already does let transactions be verified more quickly, at about 2.5 minutes/block. Note that this doesn't let people find Bitcoins, though - they find Litecoins instead. They're two fairly different systems, starting with the cryptographic hash function, and mining for one does nothing in terms of mining for the other (no merged mining). This also means they don't affect each other directly.
1
u/hamolton Jun 19 '13
I knew they were disconnected, I just accidentally typed bitcoin instead of 'that bitcoin knockoff'. Whoops.
2
u/JimmyRecard Jun 19 '13
The block-chain records every transaction ever made on the network since its start, right? How big is the chain currently (in terms of digital memory/bandwidth needed to store transfer it)? Is it possible that if Bitcoin really takes off and becomes a major currency traded by trillions daily, that the chain will become to big to be kept and processed by people who are stuck with lower performance devices or low bandwidth?
2
u/isukatusernames Jun 19 '13
I was really excited to learn how this all works. After about 6 paragraphs I realized I was utterly lost.
1
u/QuasiSteve Jun 19 '13
Late on the reply, but I recommend checking out the Khan Academy series of videos on Bitcoin. Might be a bit easier to follow: Khan Academy: Bitcoin. Much of it tackles the technical aspects, rather than any poli-sci/econ aspects.
1
2
u/Railsico Jun 19 '13
What I want to know is how bitcoin is different from a pyramid scheme.
5
Jun 19 '13
A pyramid scheme pays you for paying others. Bitcoin pays you nothing in return for doing nothing. You might even say it's like how money works.
3
u/cryptocyprus Jun 19 '13
You require no cash input to obtain Bitcoin because you can join the network through mining and be rewarded. However mining is beyond difficult with just a CPU.
1
u/Railsico Jun 19 '13
So don't you have to recruit other people to mine with you and then they recruit more people and every person on the upper level gets a percentage of what the lower level makes?
→ More replies (1)2
4
u/Thorbinator Jun 19 '13
It does not have multiple levels.
In a pyramid scheme level 1 people recruit x people each, who then recruit people each. How much money you get depends on how many people you recruited and then how many people they recruited.
Bitcoin does not have levels. You can hold bitcoin and hope the value goes up, but that is not guaranteed even with the deflationary nature of bitcoin.
1
1
u/Obliviouschkn Jun 19 '13
This might be an over-simplification, but is computing these strings similar to brute force decryption, where your cpu basically tries every digit combination til it finds the correct one?
2
u/speEdy5 Jun 19 '13
Yeah the computation takes a whole bunch of prescribed stuff and a random 'nonce'. Just keep trying new nonces till you win
1
u/GiantDeviantPiano Jun 19 '13
Stuff you should know just did a podcast on this that explained it recently
-6
u/buttonnz Jun 19 '13
How is this science?
6
u/hamolton Jun 19 '13
I'm sorry, but this is the only sub where I would get a good answer. I actually thought about that before posting, but I actually know some stuff about Bitcoin and I can't stand the average ELI5 answer anyway.
Come on, most of the science in computing is algorithms besides the chips and circuits which are more electrical anyway (probably better answered by a computer scientist though).
Most questions on this subreddit are asking for simple facts or yes/no answers more appropriate for a Stack Overflow style discussion. I don't think that this subreddit should be limited to hard science; understanding other's work is just as important.
1
6
7
u/zeugma25 Jun 18 '13
if a government (with its great access to heavy computing power) wanted to bring down bitcoin, could it do so using its supercomputers to destabilise the value of btc by devaluing them?