Some Thoughts On Bitcoin

Some Thoughts On Bitcoin
Dan Kaminsky

If You’re Smart
Leave the room right now
“Bitcoin turns nerd forums into libertarian forums”
This is true
Bitcoin is a particularly effective DoS against security professionals
Why?

Security Inversion
Normal Code
Looks like it might be OK up front
Scratch the surface, it’s actually really bad
BitCoin
Looks really bad up front
Scratch the surface, it’s actually surprisingly good
We aren’t used to systems with these characteristics
This code has the mark of having been audited by People Like Us
And quants

The basic summary
BitCoin is absolutely not anonymous
BitCoin clearly does not scale
In the long term
It does work for now though
This isn’t 0day stuff, this is basically declared almost entirely up front

What Is BitCoin
A really strange use of cryptography
“Strange” is not a sufficient, interesting, or even vaguely competent way to mark a system as insecure
It’s a decent way to say “this is not the normal way things are put together”
Two systems mated together
A peer to peer network that does a best case effort to synchronize data (loose “transactions” and solved “blocks”) across as many nodes as possible
A Chinese Lottery that canonicalizes subsets of synchronized data, using the difficulty of finding partial hash collisions

The Basic Idea (In A Nutshell)
1) I’m hearing about all these transactions going on – Alice is paying Bob, Bob is paying Charlie, etc
2) I hash all the transactions I’ve heard about, with some random information, and the hash of the last time someone did that, until there’s a partial collision
First n bits equals 0
N is automatically determined based on how hard it has to be for one block to be found about every 10 minutes
This is a block
3) I send everyone my “block” – transactions plus hash of previous block plus random data. This gives me 50 bitcoins (for now).
4) I can now “sign over” those bitcoins, from my private key, to other people’s (or my) public key.
5) Repeat until there’s lots of people with lots of BitCoins
Possibly purchased instead of “mined”

Interesting Traits
The basic concept is actually relatively solid
Assuming partial collisions are predictably hard to find
Assuming ECDSA works
Basic Idea 1: Money can’t be created from nothing – hashing is needed
Basic Idea 2: Transactions can’t be blocked or reversed by a central entity – “is none”
It makes security engineers talk like monetary scientists
That’s sort of OK, economists pretend to do that too…
Seriously, that’s silly– lets just talk tech, OK?

Epic Scalability Quote 1(https://en.bitcoin.it/wiki/Scalability)
“The core BitCoin network can scale to very high transaction rates assuming a distributed version of the node software is built. This would not be very complicated.”
Because there’s nothing easier to do, than make a system distributed
This is totally not one of the Hard Problems Of Computer Science
By “Distributed” they mean “Centralized”
WhyBitCoin is uniquely hard to audit
It claims the advantages of its present architecture, and its future architecture, while rebutting the disadvantages of one with the advantages of the other
Instead of saying, “We don’t do that”, they say “Something else could do that”

Scalability Costs: Network Bandwidth
“Let's assume an average rate of 2000tps, so just VISA…. Shifting 60 gigabytes of data in, say, 60 seconds means an average rate of 1 gigabyte per second, or 8 gigabits per second.”
:O

Up and Down
Going up
“Let's take 4,000 tps as starting goal. Obviously if we want BitCoin to scale to all economic transactions worldwide, including cash, it'd be a lot higher than that, perhaps more in the region of a few hundred thousand transactions/sec.”
And the need to be able to withstand DoS attacks (which VISA does not have to deal with) implies we would want to scale far beyond the standard peak rates.
TB/sec
Going down
Even at 1/100th of VISA, that’s still 10MB/sec

Are There Future Optimizations?
“Because nodes are very likely to have already seen a transaction when it was first broadcast, this means the size of a block to download would be trivial (80 bytes + 32 bytes per transaction). If a node didn't see a transaction broadcast, it can ask the connected node to provide it.”
Potential 50% savings!
Could go from 1GB to 500MB/sec

What About Storage?
In order to validate a transaction, you need all blocks up to the present one
Joining BitCoin today == downloading 200+MB history all the way to the start of time
That only increases
“ A 3 terabyte hard disk costs less than $200 today and will be cheaper still in future, so you'd need one such disk for every 21 days of operation (at 1gb per block).”
So you get to participate directly in BitCoin, at the low low cost of $200 a month
Assuming zero costs of running a storage array

CPU?
”A network node capable of keeping up with VISA would need roughly 50 cores + whatever is used for mining (done by separate machines/GPUs).”
In the long run, that’s what it takes to participate (assuming no DoS, which would take 5000 cores)
(You actually need to validate all historical transactions too)

OK, so you end up with supernodes and normal nodes
What are the characteristics of supernodes?
They’re banks
“Welcome to the new boss, who looks suspiciously like the old boss”
I’m not saying banks are bad or anything
The “peer to peer” model of BitCoin eventually goes away; as soon as the thing gets big, the entire thing switches to a banking model

Reality of Banking
As the network gets bigger, fewer and fewer nodes can be banks
Only so many parties can exchange a gigabyte a second.
The 50% threshold is inevitable
BitCoin banks still can’t gin up money
BitCoin banks can’t forcibly take money
Unless they hold the private keys for the user, which they might
BitCoin banks can refuse to accept blocks with “undesirable” transactions
Don’t need 50% -- just need enough to inconvenience 50% to accept your opinion
Can block undesirable transactions
Can recompute blocks w/o certain transactions (reversal)
This offers a host of ugly semantics

Already Suffering This
BitCoin’s security model is base on the idea that nobody can control more than 50% of the network
Exact PetaFlop count unclear, but >40 and <200
Weird metric, given that crypto uses integer operations when FLOPS are floating point
Several times more than largest supercomputer
Pools are breaking this
#1 pool has 41%
#2 pool has 30%
“Security through ostracism” to Pitchfork Security
DDoS against #1 pool

Bad Choice Of Hash Standard
Existing model can be accelerated massively with GPUs
Just 2x SHA-256
Could have been bcrypt or the like, in which performance does not scale with pure processing speed
Basically adds memory and serialization dependencies
Wasn’t implemented, so now we have shortages of GPUs…

What About Anonymity?
The full worldwide transaction history is stored and shared, forever and ever
Everyone has names like:
1MQbbWUi2scKdZ4KtMMSUSvVmxi6XtEeaC
How do you know who you’re paying? You don’t
Everyone is encouraged to make up new names for every transaction
Actually how you can tell why someone is paying you
Out of band, you tell someone “to pay me, pay this address”
When that address is paid, you can dereference to your own private transaction
Do lots of random names equal anonymity?

Names Are Linkable (see blockexplorer.com)
All FROM sources are effectively the same person (or linked IDs)
Almost all TO destinations are payee and payor

Reality of Anonymity
As BitCoin “fights fragmentation”, it merges identities
As it merges identities, it…well, merges identities
There are other models of using BitCoin in which money goes in, stays, and then presumably goes back out
Again, it’s amazing how much this looks like a bank.
Not saying banks are bad, just don’t tell me BitCoin doesn’t morph into the banking system

So, with this all being said
BitCoin is working, today
That counts for a lot
It will not work this way forever
It will not have today’s security properties forever
If you define the loss of today’s properties a serious loss of value, then there are Ponzi-ish characteristics in plain view
I’m not going to make that claim, however

Conclusion
This was just a quick summary
BitCoin is actually well designed, if you accept that anonymity and scaling forces the entire present model to be shifted into something that effectively looks like banking
I’ll talk about more another time

http://dankaminsky.com	40701
http://niebezpiecznik.pl	2893
http://translate.googleusercontent.com	62
http://www.slideshare.net	58
http://www.newsblur.com	32
https://twitter.com	27
http://webcache.googleusercontent.com	16
http://liuxinyang.posterous.com	8
http://us-w1.rockmelt.com	8
http://posterous.com	8
http://newsblur.com	6
http://www.redditmedia.com	5
http://207.46.192.232	5
http://www.twylah.com	4
http://a0.twimg.com	4
http://dakami1.wordpress.com	2
http://nuevospowerpoints.blogspot.com	2
http://dev.newsblur.com	2
http://twitter.com	2
http://wonder-tonic.com	2
http://cache.baidu.com	1
http://translate.google.com.br	1
http://dankaminsky.com.	1
http://dankaminsky.com HTTP	1
http://www.feedblitz.com	1
http://courtneybolton.parasoup.de	1
http://www.xakep.ru&_=1324018959523 HTTP	1

Some Thoughts On Bitcoin

by dakami

Accessibility

Categories

Upload Details

Usage Rights

27 Embeds 43,854

Statistics