Bitcoin Forum

Someone should post it here.

Someone should post it here.

http://www.mail-archive.com/cryptography@metzdowd.com/msg09980.html

I actually did this kind of backwards.  I had to write all the code before I could convince myself that I could solve every
problem, then I wrote the paper.  I think I will be able to release the code sooner than I could write a detailed spec.

Satoshi trivia: he wrote Bitcoin's code and THEN he wrote the paper.

It is actually quite interesting on a number of levels.

Normally such a paper would be frowned upon, because most of the citations are at least 10 years out of date and as for going back to 1957 for reference material... very dodgy..... esp. as there has been a lot of work in probability theory since then.

It is as if the citations were 'thrown' in as an afterthought with an underlying lack of research.

I found that mailing-list thread to be as good a read as the white-paper. A must-read in bitcoin-land, IMO.

Edit: The whole thread, starting with:  http://www.mail-archive.com/cryptography%40metzdowd.com/msg09959.html

James A. Donald wrote:
> It is not sufficient that everyone knows X. We also
> need everyone to know that everyone knows X, and that
> everyone knows that everyone knows that everyone knows X
> - which, as in the Byzantine Generals problem, is the
> classic hard problem of distributed data processing.

The proof-of-work chain is a solution to the Byzantine Generals' Problem.  I'll
try to rephrase it in that context.

A number of Byzantine Generals each have a computer and want to attack the
King's wi-fi by brute forcing the password, which they've learned is a certain
number of characters in length.  Once they stimulate the network to generate a
packet, they must crack the password within a limited time to break in and
erase the logs, otherwise they will be discovered and get in trouble.  They
only have enough CPU power to crack it fast enough if a majority of them attack
at the same time.

They don't particularly care when the attack will be, just that they all agree.
 It has been decided that anyone who feels like it will announce a time, and
whatever time is heard first will be the official attack time.  The problem is
that the network is not instantaneous, and if two generals announce different
attack times at close to the same time, some may hear one first and others hear
the other first.

They use a proof-of-work chain to solve the problem.  Once each general
receives whatever attack time he hears first, he sets his computer to solve an
extremely difficult proof-of-work problem that includes the attack time in its
hash.  The proof-of-work is so difficult, it's expected to take 10 minutes of
them all working at once before one of them finds a solution.  Once one of the
generals finds a proof-of-work, he broadcasts it to the network, and everyone
changes their current proof-of-work computation to include that proof-of-work
in the hash they're working on.  If anyone was working on a different attack
time, they switch to this one, because its proof-of-work chain is now longer.

After two hours, one attack time should be hashed by a chain of 12
proofs-of-work.  Every general, just by verifying the difficulty of the
proof-of-work chain, can estimate how much parallel CPU power per hour was
expended on it and see that it must have required the majority of the computers
to produce that much proof-of-work in the allotted time.  They had to all have
seen it because the proof-of-work is proof that they worked on it.  If the CPU
power exhibited by the proof-of-work chain is sufficient to crack the password,
they can safely attack at the agreed time.

The proof-of-work chain is how all the synchronisation, distributed database
and global view problems you've asked about are solved.

Can someone post an accurate précis please so I can bluff my way through this question the next time I'm asked?

It's 9 pages... how lazy are you?

I skimmed it through but I'm not a mathematician or a programmer so I didn't understand half of it.

It's amazing though that he only needed 9 pages to present his idea. Quite refreshing in a time where the average college thesis is over 100 pages and the average government report is 1000+ pages long.

I'm quoting this wonderful piece of text from the mailing list:

...and indeed we have to
build a layer on top to bring the transaction cost down
to the level that supports agents performing micro
transactions, as needed for bandwidth control, file
sharing, and charging non white listed people to send us
communications.

No, it is very attractive to the libertarian if we can
design a mechanism that will scale to the point of
providing the benefits of rapidly irreversible payment,
immune to political interference, over the internet,
to very large numbers of people. You have an outline
and proposal for such a design, which is a big step
forward, but the devil is in the little details.

[To Satoshi]
BTW, could you please learn to use carriage returns??

There is no reliance on identifying anyone.  As you've said, it's
futile and can be trivially defeated with sock puppets.

The credential that establishes someone as real is the ability to
supply CPU power.

I also find it frankly shocking that it seems like nobody in the world
has heard of a password manager.

too damn long.. i was done after the first paragraph lol

So is it safe to assume you're never read a book?

I was wondering that, I'm into Bitcoin since 2012 but didn't actually read it.

Yes i have read it  :)