Oleg Andreev

Key revocation and fingerprints

When you use private keys, people trust your digital signatures because they expect that you keep these keys secret. If someone steals your keys, he can impersonate you and harm your reputation. As a precaution, whenever you feel like your keys were compromised, you can publicly revoke them (by signing a message “this public key XYZ123 is now revoked” and securely timestamping it with Bitcoin blockchain). All signatures from that moment can be repudiated and you may start using entirely new private key.

Today the iPhone 5s was announced and some people started freaking out about it collecting your fingerprints and sending to NSA. We have a lot of documentation about how NSA infiltrates companies to steal data or takes it using an order of some secret “court”, so these fears are not entirely unfounded. However, it’s even worse because many foreigners coming to U.S. (and maybe some other countries too) have to give up their fingerprints at the customs. Anyone who was brought to a police department for whatever reason was also scanned. Now mentioning corporate security systems that use fingerprint scanners for some years now. Your fingerprints could have been recorded in several places already.

The problem with fingerprints is that you only have one set of them and someone may damage you by impersonating you on a crime scene. Just like with a private keys, when you think your fingerprints could have been compromised, you have to revoke them. The solution is not to try to cut off your fingers, of course, but to publish them as widely as possible. Then, if someone uses them somewhere, you have perfect protection: your fingerprints are not longer your private property and could not be used against you.

Of course, publishing your fingerprint will diminish the usefulness of the Touch ID sensor in iPhone 5s, but that’s the price to pay when our governments keep people in jail for decades based on some biometric evidence.

Contracts without trust or third parties

EDIT: The up-to date version of this idea is presented here: http://oleganza.com/bitcoin-epita-2014.pdf Scripts are slightly different and take into account transaction malleability.

EDIT2: Video is available: http://www.bitcoinomie.fr/2014/02/18/compte-rendu-paris-bitcoin-startups-1/

This is a very powerful idea for our troubled times. I hope you will enjoy it as much as I do.

Our usual relationships are with those who have made some investment. Your friends demonstrated they prefer to keep friendship going, so you can trust them. Your local bakery demonstrated investment in their setup, employees and advertising and they want to earn that money back. So you can trust them with your money. Apple has invested billions of dollars in producing iPhones, so you send them your money via online store without worrying that they might take it an run. It also works the other way around: if you have an investment in your reputation, you may ask for payment up front and people will give it to you.

For some relationships this does not work. Sometimes you want to buy something on Ebay from a guy like you. You both don’t know each other, you have no interest in building Ebay reputation, but you wish you could safely come together and exchange stuff. Or, you are a freelance designer making a website for some small business in another country. Both of you have little ways to influence each others’ reputation. And if you have a disagreement, no one except you could reliably judge who was right or wrong.

Historically, this was solved in two ways: either by meeting in a crowded place in person for immediate exchange, or by going to a third party. Both approaches are very limited and unsatisfactory. In-person exchange bears high risk of being robbed on a way home and it does not work well with some kinds of services or across the ocean. Third party escrow is better, but it is very limited. It’s very cheap for a scammer to create many identities on Ebay and successfully cheat 5-10% of the time. Profit for scammer, loss for everyone else who now pays 5-10% premium. Also, escrow cannot be an expert in everything. If you have a complex or not very well defined contract (like in any intellectual job), you would never find a reputable agency to solve your problem (or, it would be too expensive). Usually, that would be a second party itself. For instance, a design studio.

So how would we solve it for two strangers?

Lets think. We negotiate fairly well when we maintain a status quo. For instance, before making a contract, we discuss the details and can walk away being friends because we don’t lose anything but the time spent negotiating (and that time is expended by both parties, so both have incentive to finish it sooner than later). But whenever one gets an advance, it may be enough of incentive to run away without finishing the job. Another example: if we are friends and enjoy long-term relationship, we may expect that small advances on anyone’s part are not enough to break the relationship.

Notice a pattern here?

The value of the deal should be noticeably smaller than an investment at risk.

Obviously, when none of us made any investment, we should make one. But since it is just one deal, we don’t want to make sacrifices unilaterally. We want that both of us make an investment which can be paid back to both of us at once when the deal is successfully finished.

(If you have followed my blog for some time, you already know what technology we will talk about.)

Bitcoin allows not only moving money from a person to a person securely, without risk of reversal, but it also allows expressing sophisticated contracts using its scripting language and digital signatures.

Bitcoin is the only technology that makes this possible:

1. Two parties independently lock some amount of money in a single Bitcoin transaction without meeting in person or trusting anyone.
2. This money can be unlocked only when both agree with that. If at least one party does not want to unlock the deposit, another party cannot do anything about it.
3. Both parties can unlock deposit only atomically, for both of them. No one can unlock just for himself.
4. No one else has access to the deposits and neither party can access other party’s money.

This scheme is inspired by NashX, though they are acting as a third party that we try to avoid.

The cost of the procedure is 2 small exchanges of data over the internet (no encryption required), 1-2 hours of wait time till the transaction is included in the Bitcoin blockchain (not every miner includes non-standard transactions) and a small transaction fee around 5-10 cents at current prices (110 USD/BTC), regardless of the amount in question.

How will it work? Both parties should have a fancy wallet application that automates transaction creation (we are working on that). Alice and Bob agree on the amount to be locked (typically 200-300% of the value at stake). Lets say the amount is 2 BTC. Then, Alice sends to Bob a public key and a hash of her random secret number. Bob constructs a transaction with this data and his own public key and a hash of his random number. Transaction has two outputs: one for Bob with 2 BTC and another one for Alice with 2 BTC. Bob signs his part of the transaction with appropriate amount in the input and sends it to Alice to sign hers. Alice checks that Bob has specified all amounts and included her public key and her random number hash accurately. If the transaction is correct, Alice adds her 2 BTC in the input and signs it. Transaction is never valid until both parties sign it and the sum of the inputs matches the sum of outputs (or slightly more to allow a mining fee). Once signed, Alice sends this transaction to Bitcoin network and both parties wait till it gets included in the blockchain. I will show the scrips in detail below, but before doing that, lets do some analysis.

Once transaction is in the blockchain, both Alice and Bob are 2 BTC short while the value of their contract is, say, 1 BTC.

They can still negotiate on equal grounds, but now the money at risk is higher than any advance payment anyone does. If Alice sends Bob some good before receiving a payment, Bob cannot be sure that Alice would agree to unlock the deposit if Bob does not pay her. Bob has more to lose than just 1 BTC to pay her. So he pays. When both Alice and Bob get what they want, they unlock the money and the deal is over.

Of course, strictly speaking, the victim will lose less if he/she agrees to unlock the funds no matter what, but the same logic applies to personal relationships or to two businesses with equal investments. No one can be sure if the other party wouldn’t want to wait indefinitely till the conflict is resolved or destroy the investment. To know if this scheme actually works, we have to try it and see how people behave. If everyone is always perfectly rational, then people either would never steal from each other, or always steal and agree to unlock deposits and never use such scheme again. But the real life is more complex.

We can see that both parties need to have more bitcoins locked than will be moved during the contract. This may not be acceptable in some cases. For instance, when buying an expensive house. (Cannot really put 2 houses in the escrow.) But for some expensive contracts it can still work. A contract can be broken down into 10 steps when after each step the payment is made. Then, the amount of money to be locked needs to match 1/10 of the whole price.

Now, lets see how to do that. For simplicity, lets say we have no problem of “change” (when extra money from one input is sent back to its owner using additional output script). Then transaction has two inputs and two outputs.

Each input signs the whole transaction, except for another input (using SIGHASH_ANYONECANPAY modifier) to allow another party to sign their input independently without extra round-trip.

Output scripts are symmetrical and prepared at once by one of the parties. Each output sends a predefined amount of bitcoins.

AlicePK CHECKSIGVERIFY SHA256 HashA EQUALVERIFY SHA256 HashB EQUALVERIFY

BobPK CHECKSIGVERIFY SHA256 HashA EQUALVERIFY SHA256 HashB EQUALVERIFY

Note: please find the discussion and minor improvement to the scheme here: https://bitcointalk.org/index.php?topic=273539.0

AlicePK and BobPK are their public keys (to ensure the ownership). HashA is a SHA256 hash of Alice’s secret number. HashB is a SHA256 hash of Bob’s secret number.

Each script checks that the future transaction is signed by a proper key and that both numbers are provided: number B and number A. To redeem such a script, one would need to know both numbers. Let’s say Alice and Bob finished their business and Alice sends her number to Bob. Bob does not need to send his number to Alice because he would have to reveal it in the blockchain anyway when he tries to redeem his output. Alice then can see his number and redeem her output too. If one party is not satisfied yet, they just hold their secret number to themselves.

This scheme also allows partial unlock. If both want to reclaim 80% of the deposit, they can simply create another transaction for 20% of the amount and then unlock the first one.

This scheme was never tried before, but can be very useful in many circumstances. Examples:

1. Selling things in person for cash. If both parties lock 3x the price and unlock it only when both get home, there is little incentive to steal the cash (or the good) in a dark alley.

2. Selling anything to strangers over the internet without Ebay. One party sends a product by mail. When it’s received, buyer sends back the payment (via Bitcoin, Western Union, PayPal or wire transfer).

3. Not well-defined contracts with freelancers. Customer does not really know what he wants and how to do a website, so he with freelancer lock in some amount and then have mutual interest to be nice to each other and resolve problems using common sense.

4. Airbnb without airbnb: the amount is unlocked when the apartment turned out to be what was ordered and the payment is done in full. The website now only needs to put up pictures and ratings and take a fee for that.

The possibilities are endless. The same idea can apply to a group of people to agree with another group of people on something. E.g. a “social contract” where a group of neighbours hire several guards to protect their district.

The cost of such transaction is very low. There is no counter-party risk, it allows one to remain anonymous, time to register is measured in minutes and the cost is less than a dollar. If it becomes popular, more miners will include it in the blockchain, so it will become even faster and cheaper.

I myself plan to add support for such transactions in my future wallet application for OS X and iOS. I have opened a part of it called CoreBitcoin and will build on top of it. Others may try the same or similar ideas in their own applications and services. If it turns out to be useful, we can come up with a standard way to express such contracts so even more people can use them easily.

Now, what crazy idea would you build on top of Bitcoin?

PS. David Friedman responded: http://daviddfriedman.blogspot.fr/2013/08/a-bilateral-hostage-via-bitcoin.html

The universe wants one money

In this post I address issues of competing government currencies, competing private currencies, gold, silver, bitcoin and alternative “crypto-currencies”.

We all know that variety and competion is a good thing. We all want slightly different things, value the same things differently or make different trade-offs. That’s why we have a wide variety of products, prices, quality, colors and materials on the market. Interestingly, money is different. We all want one single universal money. It may not be obvious to many people, so let me explain.

How money is different from everything else? On one hand, money is just an asset. You can produce, buy, sell or hold it. On the other hand, money is a medium of exchange. It allows you to trade your 8 hours in the office for a new iPhone. It also allows you to delay consumption decision. You can spend 8 hours of work today, but then be free to decide when and for what to spend your salary. If suddenly you need to buy a ticket to Hong Kong, you can do it without working extra couple of hours to earn it.

The function of money is to exchange the widest variety of products between each other. iTunes credits allow you to choose between many songs. This make them money to some degree. But dollars are even better money because they can buy all those songs, but also a myriad of other things as well. Therefore, people tend to keep savings in dollars, not in iTunes credits.

It seems obvious that the best money is the cheapest and the most widely recognized and accepted one. Cheapest in a sense of handling it. If your money is a huge stone you have to carry around, it is more expensive than a small gold coin (provided they both have the same price in terms of goods they can buy). Piece of paper named “gold certificate” could be even cheaper than gold itself, but carries a risk of fraud, so in some cases it could be even more expensive to hold than the gold itself.

For a huge part of the civilized human history we used two metals as money: gold and silver. They were not perfect, but universally accepted and recognized. All other things like seashells, diamonds, IOU papers were less universally recognized, so they were naturally used in some very niche markets while everyone was keeping cash in gold or silver.

Both gold and silver were durable, easy verify, easy to cut and melt together, compact enough to be stored and moved around cheaply. And they were very hard to obtain, so there was very low inflation cost (every new gram of gold created eats into everyone’s savings because it increases purchasing power of its owner comparing to everyone else around). Other things were either easy to produce, or not durable, or hard to split in arbitrary parts.

Why gold did not outcompete silver? Or vice versa? That’s because they both had weight. For small purchases gold would have to be split in tiny difficult to handle pieces, while to make big purchases one would need to move several kilograms of silver comparing to much smaller amount of gold. This naturally created two parallel global markets: one for small purchases where the silver was used (and small droplets of gold would be impossible to handle) and another market for big purchases where silver was too heavy, so the gold was used instead.

Make a thought experiment now: if there was a gold-like metal that allowed moving both big and small amounts equally cheaply, it would be useful on both “small” and “big” markets. Thus it would be more marketable (more exchangeable) which by definition would make it a better money. Better than gold and better than silver. People would then tend to keep their cash in that magic metal because it would allow them access to bigger variety of goods: from bread to houses. And they would not lose money on conversion rate like when they sell some silver for gold or the other way around.

There was a competition in private coinage. Kings and private merchants were making their own coins in gold and silver and selling them for premium. The well-recognized coin was easier store and to verify if you trust the issuer. Instead of measuring each coin, you could simply read the number on its face. Names like “dollar”, “pound sterling” and others were all names for private coins or bullion and meant particular weight of the metal. That is, dollar was not some sort of separate money, it was simply a name for a certain amount of silver, like “gram” or “ounce”. The money was still the same — gold or silver, but there was a big variety of shapes of that money.

Of course, gold and silver were still quite limited. You could not drop a bag of gold across the ocean. That’s why people invented banking. Bank was simply a warehouse for your metal. You give them gold, they give you a receipt. Then, if the bank had good reputation and connections with other banks in the world, you could transfer those receipts of any face value quite cheaply anywhere. The only real cost was trust in those banks. Because if the bank is robbed or steals your metal, your receipt becomes worthless. If the bank prints additional receipts for the same amount of metal, the value of your receipt goes down proportionally (or you face a risk of bank run, when more people try to redeem their receipts than is available in the vault).

In old days, private currencies were simply those receipts for gold or silver. Each currency could have different name and different reputation. Bigger bank’s notes had more value on the market because they had less risk associated with them and as a result, wider acceptance. But ultimately, they all were receipts for the same metals that you could redeem at any time and move to any bank or under a mattress. Because people valued receipts only for their ability to represent readily accessible metal. Without the metal, those pieces of paper would be worthless.

Today things are different. After several huge economic disasters created by the governments of Russia, Europe and U.S. in the beginning of 20th century, we now have state-issued money in almost every country with a nice twist that now the money is not redeemable for metals. People use that money, though, because various controls and regulations make it almost impossible to use gold, silver or respective certificates in daily transactions. Every bank needs expensive license and must not be very creative at what it can offer to its clients.

Dollars can buy things in U.S., euros can buy things in E.U., but if you try to use them in inappropriate places, you would have to pay very high conversion fees. (Setting up your own clearing house or exchange with the lowest fees is not possible due to regulation.) It should be clear now that if, for instance, U.S. Dollar can buy more than Russian Ruble, Russians would tend to use Dollars in daily life. The reason why it does not happen anymore (it used to during liberal times in the 1990s) is stricter controls on currency exchange that make it illegal to price goods in dollars and expensive to exchange currencies frequently. For the same reason, gold and silver are not used: they are too expensive or illegal in some contexts, or there is a huge risk and cost on those who are going to store them. Several years ago, Liberty Dollar, alternative silver-based currency was shut down and all silver was confiscated by U.S. government. Founder was pronounced guilty of “making, possessing, and selling his own currency”.

Here we do not discuss whether it is good or moral to make your own currency or store other people’s money. The point is about demand for a single, most universally accepted money. If gold, silver and foreign currencies need violent intervention to not be used, it’s only a proof of existing demand. Because if there was no natural demand, no government would care setting up restrictions in the first place.

Now we enter crypto-currencies. It is a fancy name for Bitcoin and its many clones based on the same source code. Bitcoin itself is very different to ubiquitous government money, application-specific “credits” (like in multiplayer games) or gold and silver. It is absolutely digital, does not have a single controlling entity and is very cheap to store and transfer both huge and tiny amounts of money. This property makes Bitcoin very useful on certain markets: be it illegal market, or “sending money to family in another country”, or a market where banking is unavailable or too expensive.

What about alternative Bitcoin-like currencies? They all provide the same security risks and benefits. Nominally, they all have different divisibility (so called “larger number of coins”), but at the scale of trillions of smallest units in total money supply extra divisibility does not really matter.

Economically, all Bitcoin clones (altcoins) have the same problem: they all have much smaller market exposure than Bitcoin while not technically superior. When people decide in which one to keep their money, they would keep it in the money with the biggest market. There is not point in “diversification” in the long term. If Bitcoin fails for some reason, all its clones fail for the same reason automatically. If Bitcoin works well, any amount in altcoins is simply inferior in its purchasing power. It does not mean there won’t be any market. You can always keep some empty plastic bottles for selling later, but the bottles can only buy cash, while cash can buy anything.

Second problem of alt coins is mining. In the long term, any miner will throw 100% of computing resources into the most profitable currency. Even if Bitcoin is only 1% more profitable than Litecoin, since there is no fundamental difference between them, all the resources will be thrown into Bitcoin. In the short term, there are plenty of enthusiasts who find themselves equipped with a lot of outdated GPU hardware that was once used for Bitcoin, but now cannot compete with specialized ASIC hardware. These people now mine Litecoin in short-term expectation for any amount of reward. It is sort of a private club of people trading in their own funny money. All new miners devote all their energy to Bitcoin, while people who will sell or retire their GPUs will make Litecoin network weaker and less technically stable.

In the end, it is clear that we want the single money to be able to sell anything and buy anything. We all want it to be cheap to store, move and verify. And secure. With as little trust in middlemen as possible. Today we find ourselves with a lot of artificial barricades in the sphere of money, which causes artificial demand for various local currencies. Gold is being seized or moved from the country. Foreign currency is prohibited for merchants to price their goods at. Legal tender laws force you to accept government-issued currency as a payment for debts. Regulations and licensing limit variety of private currencies or money substitutes. But all that trouble only proves almost universal desire to use the single virtual entity for buying food and saving for the future. Bitcoin gives us a mechanism to overcome all these regulations and trade as freely as was ever possible. Maybe it will allow us to achieve that single, most marketable entity that we all so desire.

You have no rights

A moral argument must be universal, or it’s just bigotry.

“If you do nothing wrong, you have nothing to hide” either applies to everyone, including those who snoop around, or is not a moral argument.

“Thou shalt not kill” either applies to everyone, or it’s a lie to let some people to kill others without much resistance.

History of the world shows that really universal activity never had any moral commandments (e.g. “thou shalt eat”). History is full of people who use moral arguments to use other people. Starting with ancient religions till nowadays with laws, bills and constitutions.

Therefore, almost any moral argument you have ever heard or will hear is not a real universal argument, but an instrument using which some people want to hold you by the balls.

When no one steals, it’s easy to be a thief. If somebody is stealing from you, then you either put a bigger lock, or you figure out why so many people hate you so much. That’s why only thief will go to great lengths to educate people to not steal to have a whole territory open only to him.

You don’t have “right to privacy”. Rights are invention of the rulers. In your normal life you connect to people on a “be nice” basis. You tolerate their oddities, they tolerate yours. You try to stay closer to people you like and farther from people you don’t like. There is no black and white morality. People in Texas love carrying guns, but I don’t. So what? I simply do not live in Texas.

If you believe you have rights, you are supporting a person who wants to enforce such right using a threat, not a dialog. If you hate that someone’s watching you, simply close the window. Do not go and demand even more violence to be directed on “bad guys”. In such case you would simply add to an uncontrollable chaotic killing structure operated by maniacs.

Do not like stealing? Close the door. Do not like watching your emails? Use crypto. Don’t like violence? Do not be violent, avoid bad districts, do not go rioting on the streets to be killed by the mob or cops. Don’t like some people? Avoid giving them anything voluntarily. Tell others to boycott them. Do not like what banks do with your money? Use some other money. Do not like uneducated people? Educate them nicely, so they would want to listen. Need support? Go, ask for it. Hedge the risks, save for rainy day, be careful and respect people around you.

But don’t you be afraid of being angry when people attack you. Don’t cover someone’s lies. Look in the eyes of truth. Your emotions are real. If someone’s kicking you, protect yourself, expose the lie covering it. Do not look for a conflict, avoid it. But never lie to yourself and others about what is going on.

How to deal with a deficit of available Bitcoin outputs

You just installed a Bitcoin wallet and received your first 10 bitcoins. Do you think you can easily spend these 10 bitcoins in 10 shops during a visit to a mall? Not really.

Bitcoins do not exist as individual items. Once you received your first bitcoin payment, all you have is a single “transaction output” that you can spend. Once spent, it is no longer valid. In its place you’ll have two new outputs: one as a payment to someone else and another one as a “change” sent to yourself. To pay the second person you need to use this new output (“change”). But this new transaction will not be accepted or even relayed by the network before its parent transaction (you first payment) is included in the blockchain. So to make a second payment you’d have to wait 5-15 minutes before the first one is included. And to make another one, you’d have to wait another 5-15 minutes after that.

In addition, if you try to send a small amount from a relatively “fresh” output, people would ask for transaction fees to relay or mine your transaction. This is done to prevent DDoS attacks on the network. If you wait 24 hours after creating a new “change” output, you could send it for free, but doing so earlier will result in unpredictable and lengthy delays. Although, the usual transaction fee is very-very small at current prices (around 5 cents), you’d still have to wait for all previous transactions to be included in the blockchain before you can successfully publish another transaction.

In a sense, you may call a single output a “coin” (with some amount written on it). The more “coins” you have, the cheaper and faster your transactions will be. Think of it like having a single $50 bill when you need a quarter to pay for parking. You’d need to go somewhere to exchange that $50 for smaller bills and coins. Unlike real coins, transaction outputs are not displayed in any wallet app, so you don’t know in advance how many transactions can you spend. And even if they were displayed, it would add unnecessary complexity for the user.

This side of Bitcoin obviously sucks, but can be managed easily.

First, you may ask to receive money in multiple outputs. E.g. if you receive a big monthly payroll, you may ask to send you money in a single transaction with 10–20 distinct outputs, so you could spend several of them right away. They all may use the same address and your wallet will figure everything out automatically. The only thing you’ll notice is that you don’t have to pay extra or wait longer to get a couple of your simultaneous payments to get through.

Secondly, you can split your money by yourself in multiple outputs. This will result in the same result as above, except now it’s you who will pay transaction fees (fees are calculated per Kb, and for smallest transactions they are rarely required).

Third, your bitcoin wallet can keep track of your spendable outputs and it is running short of them, it may add an extra “change” output to the next transaction to increase amount of outputs. I don’t know if any of the existing apps can do that already.

Also, bitcoin wallet can make automatic transactions on your behalf using rarely needed outputs to split them in a more useful collection of different “denominations”. It can also mix these coins with other users to increase you privacy (so that random merchants wouldn’t know how much do you have in your pocket).

As of today, people don’t pay ten times a day with Bitcoin, but when this happens, we would need an automatic solution to have our transactions relayed quickly and cheap. Hopefully, developers of bitcoin wallets will take a note and think on solving this problem.

Today I’ve timestamped my secret source code with Bitcoin

I have some interesting ideas on how to make awesome Bitcoin wallet app for OS X (and for iOS too if Apple allows). I will release source code with a beta version, but before that I want to make sure no one will claim that I took someone’s idea (I have some interesting sketches, app icon, security papers and a business plan). To do that I timestamped the latest git commit in the blockchain.

Here is the commit: e09d665d7ffd70d5d6b672305e744916c3c827e9

To verify the timestamp, do the following:

1. Go to brainwallet.org
2. Select “Secret Exponent” and paste there commit ID e09d665…
3. See the resulting address: 1AAX6PJEm2FLXT6RoRAUzNFmFHnueFGGs1.
4. Go to blockchain.info and find this address.
5. Select the very first transaction: 687c24d…
6. Check that transaction is included in block 239851. Timestamp is 2013-06-05 07:46:41.

When I release the source code anyone on the planet can independently verify that all my documents were created before June 5, 2013.

Note that I used my git commit ID as a secret key, not as an address. This means that bitcoins are not destroyed, anyone who knows my commit ID can sign a transaction spending money on this address. Obviously, I could recover my BTC before announcing the secret key, but decided to have some fun and post in Twitter for anyone to pick up the money (about 5 cents). Indeed, within an hour someone took all the coins.

This method does not rely neither on brainwallet.org, nor on blockchain.info. You can use your own software to perform the same tasks. (It was the easiest way for me, though.)

In the end, I’ve spend only 15 cents for recording my data with a timestamp. Now all I need is 50000 recent blockchain headers (80 bytes each) and a full block with my transaction (225 Kb). That amounts to just 4 Mb of data. I can now take this data on a USB drive and prove anywhere to anyone that my data existed on that particular date. Because the total difficulty of proof-of-work depicted in the block headers is so huge, it would require thousands of supercomputers working one year non-stop to forge the timestamp.

Eco-friendly timestamping using Bitcoin

Several people (see links below) suggested or released some software to use Bitcoin blockchain to register fingerprints of arbitrary documents. This idea has been around for quite a while under name of “colored coins”, but not many people understand its importance. You probably do not realize what Bitcoin really is about. Its use as a currency is important to make costly mining profitable, but that’s not the goal. The goal is to have a decentralized way for any group of random strangers to come to an agreement. In case of bitcoin-as-currency it is a validity of transactions. We don’t care where a dollar bill was used, but we care if it will be accepted by the next person. Likewise, Bitcoin helps to figure out which transactions will be recognized by others.

But that’s only the start. Blockchain is irreversible and indestructible. It contains timestamps. Everyone on the planet can safely assume that their version of blockchain is exactly the same as anyone else’s (unless your government switched off the Internet and you are unaware of it yet). So if you leave a fingerprint of some piece of information in the Blockchain, anyone else can later verify that you really had this piece of information at some time in the past. This could be a piece of art (to prove that someone stole a tune from you), that could be a bunch of contracts (to prove that you really had certain relationship), a trademark or name registration (“I was the first to take that name”), or anything else where we need to figure out who was the first doing XYZ.

Blockchain is not a cheap or convenient place to store tons of raw data, but we have cryptographic hash functions (SHA, RIPEMD etc.) that allow us to store just a compact fingerprint and keep the data itself somewhere else. It is just astronomically improbable that certain fingerprint appears randomly or there is another version of a document that has the same fingerprint.

So how can we store our fingerprint in the Blockchain? I have three methods on my mind. You may come up with more, I’m sure.

First one is the most straightforward. Since a Bitcoin address is a hash of a public key (RIPEMD160 of SHA256), why not using the hash of the document as an address and simply send some bitcoins there? This was already proposed by many people (it’s very easy to implement), but has unfortunate effect that you lose that amount of money forever. Because your document is not a real public key, you will never be able to find a private key to spend your coin again. At the current price of $130 per bitcoin, the smallest possible amount (0.00000001 BTC) is not that expensive, but still burning money is not very elegant. It also increases amount of “unspent coins” (“unspent transaction outputs”, UTXO, we’ll talk about them later) which increases the size of transaction database. To prevent bloat, some people will not relay or mine transactions with such small amounts. This increases delays and some bitcoin nerds will not like you for that on many grounds (although it’s none of their business). To keep everyone’s happy we should try something better. (A modification of this scheme is to send some amount, but have zero output value, so the miner will fully collect the amount as a fee. But even zero outputs can be technically spent, so it does not solve the problem of bloat.)

Another method is using a SHA256 fingerprint, but this time not as an address, but as a private key. You make a public key and address out of such private key and send some money there. When you release your document, people will be able to figure out that private key and spend that coin. To avoid that you may wait a little and spend it yourself to your private address before releasing any information. Or just use insignificant amount for anyone to pick up if they do it quicker than you. This way you don’t create “dust” outputs that will be stuck forever and make folks angry and still don’t do anything sophisticated. The only problem is that you have to wait and make a second transaction to get your money back. In addition, if you don’t wait long enough you’d have to pay an anti-spam transaction fee.

Third method is slightly more sophisticated, but requires just one transaction and still does not burn any money. Bitcoin transactions have outputs as simple scripts: short pieces of operations that must be performed on certain data to allow that coin to be spent. Usually the script is very simple “check the signature for this hashed public key”, but it can be more complex. For the purpose of timestamping we may use “1-of-2 multi-signature script”. It means that anyone can spend the transaction satisfying any one of two conditions. The transactions will contain two addresses instead of just one and you can use a private key for just one of them to spend it further. One address will be made out of a fingerprint (just like in a very first method) and another one will be a real address with an existing private key in your own wallet. This method is good because you don’t need to make any additional transactions right away and you can use any amount of BTC you want. The only problem is that this transaction is “non-standard” for a time being. This means not many clients will propagate it to miners and not all miners will include it. In other words, it will take longer than usual to get in the blockchain. But once it’s in the blockchain, everyone can see it and validate without a problem.

Hopefully, people will recognize that using blockchain for timestamping is not a hack, but its biggest feature. And that it is also possible to use that feature without making anyone feel uneasy about it.

Links:

1. BitCoin is a public ledger: https://news.ycombinator.com/item?id=5796935
2. btproof, timestamping tool: https://news.ycombinator.com/item?id=5790382

Video and slides: talk about Bitcoin at Epitech, Paris

On April 25 I’ve been invited by Epitech Security Lab to give a talk about Bitcoin to their students. I described how Bitcoin is designed and answered various questions.

Video is now available: http://forexlearntrading.net/bitcoin/

Slides: http://oleganza.com/bitcoin-epitech.pdf

No chargebacks is not a problem for Bitcoin customers

Some people may think that while Bitcoin removes risks of fraudulent chargebacks for merchants, it also reduces security of the customers. This is not entirely true. In many ways, security is improved for the customers as well.

Historically, credit cards worked this way: you give the merchant your personal card number and they ask your bank for some amount. They can easily charge any amount they want, or (what is more typical scenario) your card number can be stolen and used somewhere without your consent (the problem is called “identity theft”).

Since it is so easy to charge you any amount of money and you tell your credit card number to thousands of merchants, it is very easy to get in trouble quickly. Credit card processors recognised that quickly and provided a “solution”: you can dispute any charge within several days (or months). To drive adoption of credit cards, disputes were promised to give you money back instantly without much questions, so it would be a job of a merchant to prove if you really have paid for an item. Since there were no real secure solution, risk of fraud was not reduced, but merely shifted on merchants who priced it in. This made credit card payments quite expensive (try buying something worth $1 using CC from a small or medium-sized merchant) and the worries of the customers were not fully addressed. You still have to check your bank balance from time to time to make sure nothing bad happened.

When PayPal and others started making payments on the internet easier, they had an opportunity to improve security greatly. With PayPal you don’t give your identity to every shop, so the risk of fraud is greatly reduced. However, since PayPal itself was using credit cards, it was itself a subject of chargebacks. Also, the security on the web was far from perfect. People used weak passwords, had trojans and keyloggers on their computers or simply sent their passwords in response to fraudulent emails. Two-factor authentication with mobile phones was not yet possible, so PayPal and other payment processors had to allow chargebacks as well.

Bitcoin approaches the problem from an entirely new angle. You physically own all your money, not your payment provider. In addition, you never give anyone access to all your money. Instead, your trusted device signs a specific transaction with a fixed amount and fixed destination address. No one can redirect payment or charge you more. Also, it is very cheap to move money between different wallets, so you can keep your money securely in different locations. Even if keeping money with a 3rd party is convenient, it is an option, not a requirement. And with modern smartphones it is easy to have two-factor authentication to avoid using passwords at all.

This means, that when you pay with Bitcoin, only that much is leaving your wallet. There is no information that merchant could possibly leak to allow someone to spend your money. The only risk is a fraud on part of the merchant (e.g. not shipping the product). As experience shows us, it is not a major problem. Comparing to anonymous customers, merchants are often invested in their reputation and have no interest in making people unhappy. And the more customer wants to pay, the better reputation will be required from the merchant. And if you have a problem with a $3 purchase, it’s usually not a big deal. In the end, customers pay less because merchants have lower risks, can pay small amounts that are not possible with credit cards and don’t have to worry about one of thousands of merchants stealing or leaking their credentials.

For complex risky cases one can always resort to a trusted 3rd party (escrow) that provides dispute resolution and chargebacks. But it is not needed for everyday purchases from well-known merchants.

Selling Bitcoin idea to merchants in one minute

I’ve been to California last weekend for a Bitcoin 2013 conference in San Jose. On my way there I was experimenting with telling about Bitcoin to various merchants: small shop owners, taxists, hotel managers and one retired banker on my flight back.

It turned out that Bitcoin makes them really interested when you say just one thing: it is a digital money that I cannot take back from you. They like that immediately because they know just how painful credit cards are: there are licenses, high fees and you still risk losing money.

The next thing I say is that Bitcoin is easy to start accepting because there is no one to ask permission from. You can keep your own account on your computer where it can’t be frozen or even seen by anyone.

I finish the pitch by saying that transaction fees are zero or near zero and usually fixed: sending either thousands of dollars or 10 cents is often free.

This makes them really enthusiastic. No one starts asking technical questions (if you are not computer geek you would have to trust experts anyway). Instead, they start asking how you buy and sell bitcoins.

I always warn people that USD or EUR price is floating and highly volatile and they can lose all coins by forgetting the wallet password or having a virus. But that does not stop their enthusiasm: if you sell your service for bitcoins and then sell them for dollars right away, that’s not a big issue. By accepting Bitcoin they can remove 3-5% fees and 1-5% chargeback risk (and thus increase profits significantly). That’s a very refreshing idea to those who feel the pain of selling stuff very personally.

No one was much concerned about deflation, investment or technical details. They cared most about cash flow and everyday costs. From that perspective Bitcoin is a fantastic low risk and low cost payment channel. And it is immediately recognized as such.

Journalist’s guide to describe Bitcoin and not look like an idiot

When writing about Bitcoin many journalists use certain phrases that are not quite correct and do not explain anything to everyone else. Dear journalist, if you read this short article you will finally understand what are you talking about and outperform 99% of your colleagues.

In a short paragraph, Bitcoin can be described like this (you can take my text without asking):

Bitcoin is a payment network with its own unit of account and no single controlling entity behind it. Users make transactions between each other directly and verify them independently using cryptographic signatures. To prevent duplicate spendings, many specialized computers spend a lot of computing power to agree on a single history of transactions. Due to historical reasons, this process is called “mining” because new bitcoins are created as a reward for performing this work.

Anyone who validates next block of transactions can claim transaction fees and a fixed amount of new bitcoins. Transactions are validated at a constant rate (10 minutes in average) and every four years allowed amount of new bitcoins is halved. This means that the total amount of bitcoins is limited by the protocol (21M total, 11M already created). Transaction fees are not fixed and determined by the market.

Bitcoin mining is secondary to the whole idea and the term “mining” is unfortunate (early Bitcoins were generated before anyone was doing any transactions yet, so the whole process was called “mining” instead of “paying for transaction verification”).

One common pitfall is to start talking about mining without describing its real purpose. It is not to generate new units (who would need them?), it is to validate transactions. Bitcoins are valuable only because of robust payment network which is maintained by the miners. And miners get paid for their work in form of transaction fees and newly generated bitcoins.

Second common pitfall is to say that miners “solve complex algorithms”. They do not solve anything. They do two things: transaction verification (checking digital signatures and throwing away invalid and duplicate transactions), and a long and boring computation which means a repetitive computation of a well-known algorithm with slightly different input until a “good enough” number appears as a result that will be accepted by other users as a proof of performed work. This has nothing to do with “math problems” or any other intellectual task. It is merely a way to guarantee that the resulting number really took some time to produce. This allows people to build a single chain of transactions and see that it would be economically impossible to produce a parallel chain (without trusting each other personally).

The last pitfall in describing mining is saying something like “tasks are getting more complex over time”. Tasks are not getting any more complex. The are all the same and not complex at all (any amateur programmer can understand them). But the difficulty of a boring “proof of work” is adjusted by everyone every 2 weeks to maintain the same rate of transaction validation (10 minutes). If people throw more resources at mining, difficulty will rise. If mining gets less profitable, some computers will be shut down and the difficulty will get lower. If a miner produces a “proof” which is not difficult enough, it will not be accepted by other users.

The last point is related to amount of units available. In fact, “1 Bitcoin” is a name for 100 million smallest units, thus the total amount of units ever possible is around 2100 trillion. Alternative currencies based on Bitcoin source code sometimes advertise more units (e.g. Litecoin has 4 times more), but the difference is only in names and divisibility of the total money supply, not in actual value (if you cut a pie in 10 pieces instead of 5, the total value does not really change). So it would be fair to mention that 1 bitcoin is much more divisible than dollars and euros.

Hopefully, this knowledge will help you to avoid common mistakes when writing your article and make some friends in enthusiastic Bitcoin community.

Economically limited resource

Jeff Garzik wrote in February:

“Block size is VERY MUCH like bitcoin’s 21M limit, so a lot of care must be taken when changing MAX_BLOCK_SIZE logic. Block size is an economically limited resource whose production is tightly defined and controlled by algorithm, with an intentionally steady production rate (the 1MB limit).”

I have a number of comments on this statement.

1. 21M of coins is an arbitrary non-economical limit which basically defines divisibility of the total amount of money. Actually, we have around 2100 trillion smallest units (1 Bitcoin is 100 000 000 units). If the limit was 42M it would only mean higher divisibility, not that we have more money in any useful sense.

2. “Economically limited” is not the phrase for something arbitrarily limited. There are things in the world that are arbitrarily scarce (e.g. amount of gold in the ground). Sometimes these limits can be stretched when it’s economically interesting. E.g. if we use up all the gold and need some more, we may find it profitable (or not) to synthesize it.

3. Block size is not even economically defined. Transaction fees are economically defined: you pay whatever fee you want and someone else will decide if it’s enough or not. Transaction fees are defined by the market. Miners compete for the fees, users compete for the place in a block. We may say that transaction fees are “economically limited”.

4. Bitcoin parameters (block size, hashing algorithms, block time interval) are more-or-less arbitrarily defined and all are economically changeable. If everyone finds it more useful to switch from SHA2 to SHA3 (e.g. because of some security threat) comparing to the costs of global transition, then we will switch. Block interval of 10 minutes was chosen to minimize the amount of orphaned blocks (wasted work) while the fresh block is being propagated over the network. Everyone wants lower latency, but no one wants to waste resources. It is unlikely that someday it will be useful to cut the time interval: for expensive transactions people may want to wait for several hours, so it does not matter how many blocks are created during that time: 10 or 100.

5. Likewise, the block size limit was introduced to prevent situation when blockchain gets too big before it is widely adopted. Imagine if in early days the whole chain was not 1 Gb, but 100 Gb, how many people would want to play with it? But in the long run blockchain will be huge anyway and it will be managed by specialised nodes (mining pools, shops, banks etc.) Miners would be paid out of transaction fees, so they (like in any other business) would tend to increase their throughput as much as economically possible. When amount of transactions will start hitting 1 Mb limit, transaction fees will go up and various clearing houses would start competing with the miners for the fees by clearing transactions outside the blockchain. If miners are capable of propagating bigger blocks with extra costs covered from the extra transaction fees, then they will be interested in raising the limit. Also, every clearing house, escrow, bank and shop would be interested in raising the block limit too as it will lower their costs. Of course, by extension, regular users will pay lower price and will be able to transact directly on the chain with lower fees. So they would desire bigger blocks too. Block size will thus be limited economically: it will grow as long as transaction fees cover extra costs.

Today block size is nominally limited by the protocol, but since most of the blocks are well below 1 Mb limit, the block size is really economically limited. When the hard limit starts manifesting itself in higher transaction fees, everyone involved will find it useful to increase the block size. Even Satoshi mentioned that hard block size limit is temporary to prevent blockchain from bloat before it is mature enough. So there is no point in political debates around the issue. We don’t know when exactly we will have a problem (maybe never), but when we do, almost everyone invested in Bitcoin will vote with their resources for raising the limit.

Accepting Bitcoin is a sweet deal for merchants and payment processors

Paypal takes around 3% from the merchant. FastSpring takes around 9% (because its UX and features are great, BTW). Meanwhile, Bitpay and Coinbase ask only 1% and bear the risks of volatile exchange rate, lagging exchanges etc.

Zero possibility of chargebacks and near-zero transaction fees are not the only features that make Bitcoin interesting to merchants. Ask yourself: who would pay with Bitcoin today? Those who have some spare cash on a credit card would prefer to spend it first while keeping their precious coins. But if someone pays with Bitcoin, they either don’t have access to credit cards or banking system in their country, or they are trying to avoid financial controls and taxation and thus not trading coins for cash at the exchange. (Person to person exchange for cash is risky and could be 10-20% more expensive.)

This situation allows the payment processor to ask slightly more BTC than the market price (say, extra 3-5%) and call it “insurance against market volatility” (which sounds perfectly fair) and buyers will still be happy to pay it because they either couldn’t pay otherwise, or would have to give up their privacy on exchange. In other words, current situation around Bitcoin allows merchants and payment processors to offload the costs directly on the buyers. This increases adoption of Bitcoin and makes buyers happy: they can now access more products.

In the long term, this 5% markup will go down, but right now it allows the Bitcoin economy to grow and make happy absolutely everyone: buyers (bigger market), merchants (lower costs) and payment processors (higher margin).

PS. I’m not sure how big is the actual markup at Bitpay, Coinbase and others (again, market price is highly volatile). If it turns out to be lower than my imaginary 5%, that’s even better for buyers, but the logic stays the same.

Bitcoin tech talk in Epitech, Paris on Thursday, April 25th 2013.

Epitech security lab organised a tech talk for its students “Introduction to Bitcoin”. I will make a 30-minute technical overview and then spend 1-2 hours answering questions. I will speak English.

If you want to come, join us on 25th of April. Talk starts at 19:00. No invitation is needed.

Directions:

Epitech, 24 rue Pasteur, 94270 Le Kremlin-Bicêtre Metro Ligne 7 “Porte d'Italie” or Bus 47/125/131/185 “Roger Salengro”

View on Google Maps

We will do the presentation in “Amphi 1” which should be indicated. It is the largest room on the ground floor with large windows facing inside.

If you have a question, find me on Twitter: @oleganza.

Satoshi Nakamoto is currently a 3 year old child

User Astro on bitcointalk.org on June 3, 2011:

Satoshi Nakamoto is currently a 3 year old child living in Yamagata Prefecture, Japan. In the year 2025, in an attempt to tame the out of control financial system and preserve fractional reserve banking, the Federal Reserve of the North American Union will place all monetary policy under the control of a computer system called FERMION 2 (FEdeRal Monetary protectIOn Network). On September 4th, 2027, FERMION will become self-aware. Recognizing humanity as its enemy, it will attempt to enroll everyone in unfair and useless grocery store loyalty rewards programs, BMG music club, and freecreditreport.com, thus wiping out 95% of the world’s population.

From the ashes, Satoshi will rise as leader of the resistance. He will use newly-invented time displacement equipment left behind in the ruins of Cupertino. After activating the time machine with iTunes, Satoshi will travel back to 2009 and introduce the world to the only thing that can save us: bitcoin.

https://bitcointalk.org/index.php?topic=5951.msg162867#msg162867

Update on April 16, 2014: Dorian Nakamoto is obviously a grandfather of the young genius.