比特幣白皮書
Bitcoin:APeer-to-PeerElectronicCashSystem
SatoshiNakamoto
satoshin@gmx.com
www.bitcoin.org
Abstract
Bitcoin:APeer-to-PeerElectronicCashSystem
SatoshiNakamoto
satoshin@gmx.com
www.bitcoin.org
1.Introduction
CommerceontheInternethascometorelyalmostexclusivelyonfinancialinstitutionsservingastrustedthirdpartiestoprocesselectronicpayments.Whilethesystemworkswellenoughformosttransactions,itstillsuffersfromtheinherentweaknessesofthetrustbasedmodel.Completelynon-reversibletransactionsarenotreallypossible,sincefinancialinstitutionscannotavoidmediatingdisputes.Thecostofmediationincreasestransactioncosts,limitingtheminimumpracticaltransactionsizeandcuttingoffthepossibilityforsmallcasualtransactions,andthereisabroadercostinthelossofabilitytomakenon-reversiblepaymentsfornonreversibleservices.Withthepossibilityofreversal,theneedfortrustspreads.Merchantsmustbewaryoftheircustomers,hasslingthemformoreinformationthantheywouldotherwiseneed.Acertainpercentageoffraudisacceptedasunavoidable.Thesecostsandpaymentuncertaintiescanbeavoidedinpersonbyusingphysicalcurrency,butnomechanismexiststomakepaymentsoveracommunicationschannelwithoutatrustedparty.
Whatisneededisanelectronicpaymentsystembasedoncryptographicproofinsteadoftrust,allowinganytwowillingpartiestotransactdirectlywitheachotherwithouttheneedforatrustedthirdparty.Transactionsthatarecomputationallyimpracticaltoreversewouldprotectsellersfromfraud,androutineescrowmechanismscouldeasilybeimplementedtoprotectbuyers.Inthispaper,weproposeasolutiontothedouble-spendingproblemusingapeer-to-peerdistributedtimestampservertogeneratecomputationalproofofthechronologicalorderoftransactions.ThesystemissecureaslongashonestnodescollectivelycontrolmoreCPUpowerthananycooperatinggroupofattackernodes.
2.Transactions
Wedefineanelectroniccoinasachainofdigitalsignatures.Eachownertransfersthecointothenextbydigitallysigningahashoftheprevioustransactionandthepublickeyofthenextownerandaddingthesetotheendofthecoin.Apayeecanverifythesignaturestoverifythechainofownership.
肯尼亞央行行長承認將國家儲備轉換為比特幣的壓力:金色財經報道,肯尼亞央行行長Patrick Njoroge承認受到來自加密貨幣支持者的外部壓力,要求將該國的儲備轉換為比特幣(BTC)。?根據Njoroge的說法,立法者可能面臨影響立法進程以支持采用加密貨幣的壓力。有趣的是,這位州長指出,如果該國在他任職期間走比特幣這條路,他已經準備好為此入獄。?
此外,Njoroge指出,該國只有在解決特定問題時才能選擇采用加密貨幣。他呼吁對加密貨幣行業進行審查,以擺脫他所謂的圍繞數字資產的“炒作”。[2022/9/20 7:09:06]
Theproblemofcourseisthepayeecan'tverifythatoneoftheownersdidnotdouble-spendthecoin.Acommonsolutionistointroduceatrustedcentralauthority,ormint,thatcheckseverytransactionfordoublespending.Aftereachtransaction,thecoinmustbereturnedtotheminttoissueanewcoin,andonlycoinsissueddirectlyfromthemintaretrustednottobedouble-spent.Theproblemwiththissolutionisthatthefateoftheentiremoneysystemdependsonthecompanyrunningthemint,witheverytransactionhavingtogothroughthem,justlikeabank.
Weneedawayforthepayeetoknowthatthepreviousownersdidnotsignanyearliertransactions.Forourpurposes,theearliesttransactionistheonethatcounts,sowedon'tcareaboutlaterattemptstodouble-spend.Theonlywaytoconfirmtheabsenceofatransactionistobeawareofalltransactions.Inthemintbasedmodel,themintwasawareofalltransactionsanddecidedwhicharrivedfirst.Toaccomplishthiswithoutatrustedparty,transactionsmustbepubliclyannounced,andweneedasystemforparticipantstoagreeonasinglehistoryoftheorderinwhichtheywerereceived.Thepayeeneedsproofthatatthetimeofeachtransaction,themajorityofnodesagreeditwasthefirstreceived.
3.TimestampServer
Thesolutionweproposebeginswithatimestampserver.Atimestampserverworksbytakingahashofablockofitemstobetimestampedandwidelypublishingthehash,suchasinanewspaperorUsenetpost.Thetimestampprovesthatthedatamusthaveexistedatthetime,obviously,inordertogetintothehash.Eachtimestampincludestheprevioustimestampinitshash,formingachain,witheachadditionaltimestampreinforcingtheonesbeforeit.
4.Proof-of-Work
Toimplementadistributedtimestampserveronapeer-to-peerbasis,wewillneedtouseaproofof-worksystemsimilartoAdamBack'sHashcash,ratherthannewspaperorUsenetposts.Theproof-of-workinvolvesscanningforavaluethatwhenhashed,suchaswithSHA-256,thehashbeginswithanumberofzerobits.Theaverageworkrequiredisexponentialinthenumberofzerobitsrequiredandcanbeverifiedbyexecutingasinglehash.
“比特幣行情”排名微博熱搜榜第30位:金色財經報道,微博熱搜顯示,“比特幣行情”排名微博熱搜榜第30位。[2021/5/19 22:16:42]
Forourtimestampnetwork,weimplementtheproof-of-workbyincrementinganonceintheblockuntilavalueisfoundthatgivestheblock'shashtherequiredzerobits.OncetheCPUefforthasbeenexpendedtomakeitsatisfytheproof-of-work,theblockcannotbechangedwithoutredoingthework.Aslaterblocksarechainedafterit,theworktochangetheblockwouldincluderedoingalltheblocksafterit.
Theproof-of-workalsosolvestheproblemofdeterminingrepresentationinmajoritydecisionmaking.Ifthemajoritywerebasedonone-IP-address-one-vote,itcouldbesubvertedbyanyoneabletoallocatemanyIPs.Proof-of-workisessentiallyone-CPU-one-vote.Themajoritydecisionisrepresentedbythelongestchain,whichhasthegreatestproofof-workeffortinvestedinit.IfamajorityofCPUpoweriscontrolledbyhonestnodes,thehonestchainwillgrowthefastestandoutpaceanycompetingchains.Tomodifyapastblock,anattackerwouldhavetoredotheproof-ofworkoftheblockandallblocksafteritandthencatchupwithandsurpasstheworkofthehonestnodes.Wewillshowlaterthattheprobabilityofaslowerattackercatchingupdiminishesexponentiallyassubsequentblocksareadded.
Tocompensateforincreasinghardwarespeedandvaryinginterestinrunningnodesovertime,theproof-of-workdifficultyisdeterminedbyamovingaveragetargetinganaveragenumberofblocksperhour.Ifthey'regeneratedtoofast,thedifficultyincreases.
5.Network
Thestepstorunthenetworkareasfollows:
1)Newtransactionsarebroadcasttoallnodes.
2)Eachnodecollectsnewtransactionsintoablock.
3)Eachnodeworksonfindingadifficultproof-of-workforitsblock.
4)Whenanodefindsaproof-of-work,itbroadcaststheblocktoallnodes.
5)Nodesaccepttheblockonlyifalltransactionsinitarevalidandnotalreadyspent.
6)Nodesexpresstheiracceptanceoftheblockbyworkingoncreatingthenextblockinthechain,usingthehashoftheacceptedblockastheprevioushash.
Nodesalwaysconsiderthelongestchaintobethecorrectoneandwillkeepworkingonextendingit.Iftwonodesbroadcastdifferentversionsofthenextblocksimultaneously,somenodesmayreceiveoneortheotherfirst.Inthatcase,theyworkonthefirstonetheyreceived,butsavetheotherbranchincaseitbecomeslonger.Thetiewillbebrokenwhenthenextproofof-workisfoundandonebranchbecomeslonger;thenodesthatwereworkingontheotherbranchwillthenswitchtothelongerone.
IAmDecentralized.org聯合創始人:兩個月前為女兒購買的比特幣已飆升79.7%:IAmDecentralized.org聯合創始人Misha Lederman今日在推特表示,他在女兒出生時(兩個月前)為其購買的比特幣現在已經飆升了79.7%,未來將一直持有至2041年他的女兒年滿21歲。Lederman稱,比特幣是唯一可以如此迅速為孩子帶來高回報的投資工具。(U.Today)[2020/5/21]
Newtransactionbroadcastsdonotnecessarilyneedtoreachallnodes.Aslongastheyreachmanynodes,theywillgetintoablockbeforelong.Blockbroadcastsarealsotolerantofdroppedmessages.Ifanodedoesnotreceiveablock,itwillrequestitwhenitreceivesthenextblockandrealizesitmissedone.
6.Incentive
Byconvention,thefirsttransactioninablockisaspecialtransactionthatstartsanewcoinownedbythecreatoroftheblock.Thisaddsanincentivefornodestosupportthenetwork,andprovidesawaytoinitiallydistributecoinsintocirculation,sincethereisnocentralauthoritytoissuethem.Thesteadyadditionofaconstantofamountofnewcoinsisanalogoustogoldminersexpendingresourcestoaddgoldtocirculation.Inourcase,itisCPUtimeandelectricitythatisexpended.
Theincentivecanalsobefundedwithtransactionfees.Iftheoutputvalueofatransactionislessthanitsinputvalue,thedifferenceisatransactionfeethatisaddedtotheincentivevalueoftheblockcontainingthetransaction.Onceapredeterminednumberofcoinshaveenteredcirculation,theincentivecantransitionentirelytotransactionfeesandbecompletelyinflationfree.
Theincentivemayhelpencouragenodestostayhonest.IfagreedyattackerisabletoassemblemoreCPUpowerthanallthehonestnodes,hewouldhavetochoosebetweenusingittodefraudpeoplebystealingbackhispayments,orusingittogeneratenewcoins.Heoughttofinditmoreprofitabletoplaybytherules,suchrulesthatfavourhimwithmorenewcoinsthaneveryoneelsecombined,thantounderminethesystemandthevalidityofhisownwealth.
7.ReclaimingDiskSpace
Oncethelatesttransactioninacoinisburiedunderenoughblocks,thespenttransactionsbeforeitcanbediscardedtosavediskspace.Tofacilitatethiswithoutbreakingtheblock'shash,transactionsarehashedinaMerkleTree,withonlytherootincludedintheblock'shash.Oldblockscanthenbecompactedbystubbingoffbranchesofthetree.Theinteriorhashesdonotneedtobestored.
Ablockheaderwithnotransactionswouldbeabout80bytes.Ifwesupposeblocksaregeneratedevery10minutes,80bytes*6*24*365=4.2MBperyear.Withcomputersystemstypicallysellingwith2GBofRAMasof2008,andMoore'sLawpredictingcurrentgrowthof1.2GBperyear,storageshouldnotbeaproblemeveniftheblockheadersmustbekeptinmemory.
聲音 | 肖磊:未來中國市場定會重新考慮建立比特幣合法交易市場:資深金融分析師肖磊剛剛發文《比特幣的誕生、監管和歸宿》稱,區塊鏈將股份制的邏輯,更進一步的推升,區塊鏈可以讓權益的標的物,超越特定國家的限制,也就是說不需要任何國家法律的保護,就可以實現轉移和買賣,并建立無爭議的共識體系。可以說現在所理解的區塊鏈,僅僅是一項技術,所以在考慮其發展和用途層面,還是非常狹窄的。這就如同東印度公司、南海公司、密西西比公司一樣,當時的用途,僅僅是為了政府和國王解決債務問題和分配殖民搶劫來的財富,并沒有想到股份制后來在人類發展史當中所發揮的作用。同時對于比特幣的交易,肖磊預測稱,未來某一天,中國市場一定會重新考慮建立合法交易市場的問題,因為比特幣是區塊鏈這種歷史性激勵機制,所溢出來的第一個,也是很重要的一個資源,并非是渾水猛獸,恰恰是對新機制和新技術的一種激勵。[2019/11/29]
8.SimplifiedPaymentVerification
Itispossibletoverifypaymentswithoutrunningafullnetworknode.Auseronlyneedstokeepacopyoftheblockheadersofthelongestproof-of-workchain,whichhecangetbyqueryingnetworknodesuntilhe'sconvincedhehasthelongestchain,andobtaintheMerklebranchlinkingthetransactiontotheblockit'stimestampedin.Hecan'tcheckthetransactionforhimself,butbylinkingittoaplaceinthechain,hecanseethatanetworknodehasacceptedit,andblocksaddedafteritfurtherconfirmthenetworkhasacceptedit.
Assuch,theverificationisreliableaslongashonestnodescontrolthenetwork,butismorevulnerableifthenetworkisoverpoweredbyanattacker.Whilenetworknodescanverifytransactionsforthemselves,thesimplifiedmethodcanbefooledbyanattacker'sfabricatedtransactionsforaslongastheattackercancontinuetooverpowerthenetwork.Onestrategytoprotectagainstthiswouldbetoacceptalertsfromnetworknodeswhentheydetectaninvalidblock,promptingtheuser'ssoftwaretodownloadthefullblockandalertedtransactionstoconfirmtheinconsistency.Businessesthatreceivefrequentpaymentswillprobablystillwanttoruntheirownnodesformoreindependentsecurityandquickerverification.
9.CombiningandSplittingValue
Althoughitwouldbepossibletohandlecoinsindividually,itwouldbeunwieldytomakeaseparatetransactionforeverycentinatransfer.Toallowvaluetobesplitandcombined,transactionscontainmultipleinputsandoutputs.Normallytherewillbeeitherasingleinputfromalargerprevioustransactionormultipleinputscombiningsmalleramounts,andatmosttwooutputs:oneforthepayment,andonereturningthechange,ifany,backtothesender.
Itshouldbenotedthatfan-out,whereatransactiondependsonseveraltransactions,andthosetransactionsdependonmanymore,isnotaproblemhere.Thereisnevertheneedtoextractacompletestandalonecopyofatransaction'shistory.
聲音 | 摩根溪CEO MarkYusko:比特幣是個比股票更好的賭注:據CNBC's Fast Money報道,摩根溪CEO MarkYusko表示比特幣是個比股票更好的賭注。[2019/5/23]
10.Privacy
Thetraditionalbankingmodelachievesalevelofprivacybylimitingaccesstoinformationtothepartiesinvolvedandthetrustedthirdparty.Thenecessitytoannouncealltransactionspubliclyprecludesthismethod,butprivacycanstillbemaintainedbybreakingtheflowofinformationinanotherplace:bykeepingpublickeysanonymous.Thepubliccanseethatsomeoneissendinganamounttosomeoneelse,butwithoutinformationlinkingthetransactiontoanyone.Thisissimilartothelevelofinformationreleasedbystockexchanges,wherethetimeandsizeofindividualtrades,the"tape",ismadepublic,butwithouttellingwhothepartieswere.
Asanadditionalfirewall,anewkeypairshouldbeusedforeachtransactiontokeepthemfrombeinglinkedtoacommonowner.Somelinkingisstillunavoidablewithmulti-inputtransactions,whichnecessarilyrevealthattheirinputswereownedbythesameowner.Theriskisthatiftheownerofakeyisrevealed,linkingcouldrevealothertransactionsthatbelongedtothesameowner.
11.Calculations
Weconsiderthescenarioofanattackertryingtogenerateanalternatechainfasterthanthehonestchain.Evenifthisisaccomplished,itdoesnotthrowthesystemopentoarbitrarychanges,suchascreatingvalueoutofthinairortakingmoneythatneverbelongedtotheattacker.Nodesarenotgoingtoacceptaninvalidtransactionaspayment,andhonestnodeswillneveracceptablockcontainingthem.Anattackercanonlytrytochangeoneofhisowntransactionstotakebackmoneyherecentlyspent.
TheracebetweenthehonestchainandanattackerchaincanbecharacterizedasaBinomialRandomWalk.Thesuccesseventisthehonestchainbeingextendedbyoneblock,increasingitsleadby+1,andthefailureeventistheattacker'schainbeingextendedbyoneblock,reducingthegapby-1.
TheprobabilityofanattackercatchingupfromagivendeficitisanalogoustoaGambler'sRuinproblem.Supposeagamblerwithunlimitedcreditstartsatadeficitandplayspotentiallyaninfinitenumberoftrialstotrytoreachbreakeven.Wecancalculatetheprobabilityheeverreachesbreakeven,orthatanattackerevercatchesupwiththehonestchain,asfollows:
Givenourassumptionthatp>q,theprobabilitydropsexponentiallyasthenumberofblockstheattackerhastocatchupwithincreases.Withtheoddsagainsthim,ifhedoesn'tmakealuckylungeforwardearlyon,hischancesbecomevanishinglysmallashefallsfurtherbehind.
Wenowconsiderhowlongtherecipientofanewtransactionneedstowaitbeforebeingsufficientlycertainthesendercan'tchangethetransaction.Weassumethesenderisanattackerwhowantstomaketherecipientbelievehepaidhimforawhile,thenswitchittopaybacktohimselfaftersometimehaspassed.Thereceiverwillbealertedwhenthathappens,butthesenderhopesitwillbetoolate.
Thereceivergeneratesanewkeypairandgivesthepublickeytothesendershortlybeforesigning.Thispreventsthesenderfrompreparingachainofblocksaheadoftimebyworkingonitcontinuouslyuntilheisluckyenoughtogetfarenoughahead,thenexecutingthetransactionatthatmoment.Oncethetransactionissent,thedishonestsenderstartsworkinginsecretonaparallelchaincontaininganalternateversionofhistransaction.
Therecipientwaitsuntilthetransactionhasbeenaddedtoablockandzblockshavebeenlinkedafterit.Hedoesn'tknowtheexactamountofprogresstheattackerhasmade,butassumingthehonestblockstooktheaverageexpectedtimeperblock,theattacker'spotentialprogresswillbeaPoissondistributionwithexpectedvalue:
Togettheprobabilitytheattackercouldstillcatchupnow,wemultiplythePoissondensityforeachamountofprogresshecouldhavemadebytheprobabilityhecouldcatchupfromthatpoint:
Rearrangingtoavoidsummingtheinfinitetailofthedistribution...
ConvertingtoCcode...
#includedoubleAttackerSuccessProbability(doubleq,intz)
{
doublep=1.0-q;
doublelambda=z*(q/p);
doublesum=1.0;
inti,k;
for(k=0;k<=z;k++)
{
doublepoisson=exp(-lambda);
for(i=1;i<=k;i++)
poisson*=lambda/i;
sum-=poisson*(1-pow(q/p,z-k));
}
returnsum;
}
Runningsomeresults,wecanseetheprobabilitydropoffexponentiallywithz.
q=0.1
z=0P=1.0000000
z=1P=0.2045873
z=2P=0.0509779
z=3P=0.0131722
z=4P=0.0034552
z=5P=0.0009137
z=6P=0.0002428
z=7P=0.0000647
z=8P=0.0000173
z=9P=0.0000046
z=10P=0.0000012
q=0.3
z=0P=1.0000000
z=5P=0.1773523
z=10P=0.0416605
z=15P=0.0101008
z=20P=0.0024804
z=25P=0.0006132
z=30P=0.0001522
z=35P=0.0000379
z=40P=0.0000095
z=45P=0.0000024
z=50P=0.0000006
SolvingforPlessthan0.1%...
P<0.001
q=0.10z=5
q=0.15z=8
q=0.20z=11
q=0.25z=15
q=0.30z=24
q=0.35z=41
q=0.40z=89
q=0.45z=340
12.Conclusion
Wehaveproposedasystemforelectronictransactionswithoutrelyingontrust.Westartedwiththeusualframeworkofcoinsmadefromdigitalsignatures,whichprovidesstrongcontrolofownership,butisincompletewithoutawaytopreventdouble-spending.Tosolvethis,weproposedapeer-to-peernetworkusingproof-of-worktorecordapublichistoryoftransactionsthatquicklybecomescomputationallyimpracticalforanattackertochangeifhonestnodescontrolamajorityofCPUpower.Thenetworkisrobustinitsunstructuredsimplicity.Nodesworkallatoncewithlittlecoordination.Theydonotneedtobeidentified,sincemessagesarenotroutedtoanyparticularplaceandonlyneedtobedeliveredonabesteffortbasis.Nodescanleaveandrejointhenetworkatwill,acceptingtheproof-ofworkchainasproofofwhathappenedwhiletheyweregone.TheyvotewiththeirCPUpower,expressingtheiracceptanceofvalidblocksbyworkingonextendingthemandrejectinginvalidblocksbyrefusingtoworkonthem.Anyneededrulesandincentivescanbeenforcedwiththisconsensusmechanism.
References
W.Dai,"b-money,"http://www.weidai.com/bmoney.txt,1998.
H.Massias,X.S.Avila,andJ.-J.Quisquater,"Designofasecuretimestampingservicewithminimal
trustrequirements,"In20thSymposiumonInformationTheoryintheBenelux,May1999.
S.Haber,W.S.Stornetta,"Howtotime-stampadigitaldocument,"InJournalofCryptology,vol3,no
2,pages99-111,1991.
D.Bayer,S.Haber,W.S.Stornetta,"Improvingtheefficiencyandreliabilityofdigitaltime-stamping,"
InSequencesII:MethodsinCommunication,SecurityandComputerScience,pages329-334,1993.
S.Haber,W.S.Stornetta,"Securenamesforbit-strings,"InProceedingsofthe4thACMConference
onComputerandCommunicationsSecurity,pages28-35,April1997.
A.Back,"Hashcash-adenialofservicecounter-measure,"
http://www.hashcash.org/papers/hashcash.pdf,2002.
R.C.Merkle,"Protocolsforpublickeycryptosystems,"InProc.1980SymposiumonSecurityand
Privacy,IEEEComputerSociety,pages122-133,April1980.
W.Feller,"Anintroductiontoprobabilitytheoryanditsapplications,"1957.
沙棘財經是沙棘傳媒旗下專注大數據、人工智能、區塊鏈、幣圈的深度報道的垂直自媒體。微信公眾號:shaji-media
@善良的網友:有這錢不如顧個仆人,還能打掃衛生,買菜做飯。報告:Cardano在GitHub代碼庫每月提交代碼超700次位居首位:9月10日消息,Outlier最近發布的區塊鏈發展趨勢報告分析了.
1900/1/1 0:00:00數字貨幣經歷了慘淡的一季度,比特幣和以太幣刷新史上最糟糕同期表現,而瑞波幣作為三大主要加密貨幣的一員表現最差,經歷了兩次腰斬.
1900/1/1 0:00:00“找回的可能性很小。因為區塊鏈的匿名性,通過數字貨幣地址追蹤到個人是很難實現的。”新經區塊鏈中國區CEO李世庚近日在接受36氪專訪時回應了新經幣失竊事件.
1900/1/1 0:00:00虛擬貨幣其興也勃,其亡也忽。區塊鏈卻招惹池魚之禍。編者按:虛擬貨幣其興也勃,其亡也忽。區塊鏈卻招惹池魚之禍.
1900/1/1 0:00:00頭條 比特幣觸及2018年最低點市場擔心監管壓力據彭博消息,在上月市值蒸發超過440億美元后,比特幣周三跌至年內最低點,市場對該資產將面臨的更嚴格的監管及其生存能力感到益發擔憂.
1900/1/1 0:00:00在娛樂圈,趙薇、張柏芝、劉濤、辣妹維多利亞、大小S、林心如等人都選擇了刨宮產的方式生孩子——似乎剖宮產就是快速、方便和無風險的生產方式.
1900/1/1 0:00:00