Bitcoin Forum

Hello everyone,

I've been working on my master thesis for almost a year now and today I passed my exam. So, if anyone is interested in reading my dissertation, it's available here:

https://dl.dropbox.com/u/3658181/PiotrPiasecki-BitcoinMasterThesis.pdf

Its topic is “Design and security analysis of Bitcoin infrastructure using application deployed on Google Apps Engine.”. It mostly considers various security strengths and weaknesses of the Bitcoin protocol, standard client, third party apps and even Bitcoin users.

I'll upload the code I developed for it some other time (it's not really that amazing).

Hope you'll enjoy the reading. I'd like to apologize for the use of polish at the start (it was a requirement), and for some boring introduction of basic things (also a requirement).

Donations welcome:
18zRT8jaHJUZe3foLcHkocV468dZ9sGiBq

EDIT 2017-03-20:

If the above link is not working, try:
https://www.dropbox.com/s/i9i5bbaaa8wlj23/PiotrPiasecki-BitcoinMasterThesis.pdf?dl=0

Wonderful. While academically it seems the intended focus was security analysis, it is comprehensive enough to be used as a reference general introduction to Bitcoin, to those willing to take the time to study it seriously.

A few nitpicks:

1. "Bitcoin" and "satoshi", as units of currency, should only be capitalized if at the beginning of a sentence. "Dollar" isn't capitalized either. Bitcoin as the name of a project, a protocol, a software, an ecosystem and a community is of course capitalized. Also, I'd avoid using "bitcoins" in reference to the system - e.g., instead of "(b)Bitcoins offer much lower cost of transferring money" I'd say "Bitcoin offers".

2. You use http://pastehtml.com/view/awb1vg03r.html as a reference for currently used mining pool reward systems, but it's badly out of date, and even for its time it was vague at best - SMPPS pools are listed as PPS, different varieties of score-based methods are lumped together in a single category, etc.

Wow, that was genuinely a really good read, and whilst it does provide great academic depth into the subject, it is also a great explanation of how the whole system works, giving new users a good understanding of it. I was thinking of heading into a PhD in Computing as i have already gained my masters in cryptology, so this subject around the security of bitcoins is fascinating to me.

in the very first paragraph i find something i would've stated differently:

"It relies on cryptographic algorithms in order to prevent abuse of the system."

shouldn't it say "...cryptographic and hashing algorithms..."?

i'm not an academic in this particular area so correct me if i'm wrong.

"Cryptography" is a general field encompassing encryption, digital signatures, hashing and more.

my turn to nitpick.  he used a small "c".

"Cryptography" isn't capitalized when in the middle of a sentence.

hmmm, this is confusing.

"Hash functions" can also be defined as a broad category with "cryptographic hashing functions" as a subset.   http://en.wikipedia.org/wiki/Hash_function

if you use "Cryptography" as you defined it, i would think you'd capitalize it even in the middle of a sentence.

even more confusing is that in my discussions with theymos, as well as has been commented here on this forum by several prominent members, it's been said that Bitcoin does not rely on "encryption" per se.  i always understood this to mean that the SHA-256 hashing algorithm effectively makes miners "guess" at the target solution which reduces the process down to mathematical probabilities vs. certain miners having insider information, ie, a "cryptographic key solution".

this is what makes Bitcoin "fair" to the masses that care to mine, like me, and would be analogous to the lotteries run by States.  even the little guys line up around the block to buy their tickets despite knowing that larger players can buy up huge numbers of tickets for the ultimate prize.  at least they have an equal chance on a ticket by ticket basis.

Scientific fields aren't capitalized.

Encryption is a one-to-one transformation for which the inverse can be computed by, and only by, someone who has the proper key. It is used to conceal data from everyone but intended recipients. That isn't used anywhere in the Bitcoin protocol, but it is used in wallet encryption in the client.

Hashing is a transformation that is in general not one-to-one, and which ideally cannot be inverted by anyone. The ostensibly random nature of such transformations is used in making block finding artificially difficult (and directly proportional to computational power).

cryptography isn't capitalized, trust me, my masters degree was in cryptography

It is when in the beginning of a sentence.

I agree of course but that's not really evidence, ThePiachu's master's thesis was in Bitcoin and he still didn't properly capitalize "bitcoins".

I wonder if "bitcoinology" should be capitalized?

How did this thread turn into a language discussion?

Thank you all for your comments.


As for the capitalization - I decided to capitalise every Bitcoin-related term for clarity. It works quite well in a lot of circumstances (especially when talking about Bitcoin Addresses and IP addresses in the same sentence, it should be there somewhere). As for the singular and plural, I guess I should review my uses of them.


Hmm, didn't know it wasn't too accurate, but it was used only once as a general view of the pools. Unfortunately, I haven't found any other such wide comparison.




"Cryptography" is quite a general term that encompasses a lot of thing - encryption, hashing, message signing and so forth.


Bitcon Protocol does not rely on encryption. The Standard Client uses encryption for wallet encryption and bitcoind calls (SSL/TSL). You can use Bitcoin without encryption, but they are not necessary for Bitcoin Network to work.


Check around post number 4 ;).

Section 5.3 Finney Attack

I think you described a regular double spend attack, where is Finney attack involves pre-mined block, and it is not detectable.

the only reason i bring up the distinction btwn cryptography and hashing is for what i believe are public perception issues.

to me, the more we can describe Bitcoin as being based on "mathematics", which more aligns with the broader concept of hashing, the better it will be perceived, as opposed to being based on "cryptography" which is not only hard to understand but possibly convey a negative perception as if we have something to hide.

my two cents.

Cryptography is mathematics.

Even if "cryptography" is assumed to mean "encryption", the public should be well aware of the important role of encryption in online commerce and banking.

sure.  but when you're explaining how Bitcoin works to an average Joe, its much simpler to say it it based on math where 2+2 always equals 4. 

try explaining it using "cryptography".  the discussion all of a sudden gets way more complicated to the point of the listener giving up.

I shall be reading this :)

Where is the accompanying CD?

I read a part of it, I enjoyed it.
Will read further tomorrow!
Good job.

Yeah, now that I reflect on it for a long while I believed that Finney attack is a double-spend attack, and that there are just two variations of it, which made things a bit confusing.


Well, it's not an article aimed at general public, but rather people that know a bit about computer science, or want to know more and are ready to look into some things they have doubts with.

This kinda reminds me of this article:
http://blogs.discovermagazine.com/badastronomy/2011/10/19/scientists-are-from-mars-the-public-is-from-earth/



The accompanying CD is in my school's archive, and with three other printed copies of the thesis. As I said in the original post, I'll upload its contents eventually (it's mainly a lot of code in Google Go, a bit messy).

Brilliant master thesis, I have a feeling you'll feel more criticism from your peers here than whom marked this paper (teacher).
Not because you really got anything wrong, but damn we can be picky.

Yes, I knew what I was getting myself into when posting it, and well, it will allow me to write some small follow up addressing all the nitpicks to make the dissertation all that more valuable.

My supervisors weren't generally picky with it, most I got was "remove long quotes, add some basic explanation of the gist of what Bitcoin is and a chapter describing how different people view Bitcoin from their perspective". I don't think the reviewer had any problems with it either. Overall I got the highest grade for my thesis.

Congrats then! Well done on achieving that grade. Any big plans now you've got your masters?

Find some job, earn some money, work on some side-projects, move eventually. I should give the vanity pool website some attention, and I've also got an idea for another Bitcoin-powered website for artists (although I'll probably have to incorporate Paypal into this as well).

great work!

Looks like a really useful - and accessible - read. Looking forward to browsing this alongside Bitcoin Magazine :)

great! reading it right now.

don't assume just because we find some errors in it the work is not excellent. you face some of the most critically thinking individuals here.

Is this research for your doctoral dissertation: Study in social engineering - willingness of users to download and use a file format with a history of multiple security exploits and remote code execution vulnerabilities onto their personal computers containing digital currencies?

lol, that is not the best reason to hate pdf though. The main reason is the format itself.

Apparently Polish universities consider Master's theses on actual content and not just weight as American universities do. Less than 100 pages with citations? You got off easy there! I had to cough up 312 pages for "Comparative Models of Worker Housing - Failure in the American Entitlement Model of Subsidized Housing". And I'm guessing you have had at least 20X the readers that I have had in 30 years less time.

Well done, Scholar.

For the same amount of content explained in a similar level of quality and clarity "less is more" is definitely valid.

“I have only made this letter longer because I have not had the time to make it shorter.”

Blaise Pascal

Yes, I'm aware of that. Thanks to such scrutiny I'll be able to write some small follow up to my thesis explaining what things I got wrong in it, to allow future readers not to make the same mistakes.

Hmm, sounds interesting. But sadly, no, I'm not that smart to pull some stunt like that off;). Heck, I didn't even know there were any problems like that with PDFs...


Ouch, that is a bit harsh. I think there might be even be some amount of pages here that is considered too much, and that would be about 100. After that the reviewers might scowl (although there is no strict formal limit of pages).

Heck, when I was writing my bachelor's thesis on an erasmus exchange in UK and then used it again in my polish university, I had to increase my page count from 46 to 54 with just some basic theory (also removing all project management pages).

It might be due to the fact that for a long while getting a master's degree over here was considered a standard for a lot of people - I think the bachelor's degrees have been introduced not long ago, before that it was either master's or getting some work education. So I doubt too many people would be getting that degree if it took so much effort, while in other countries it might be considered more uncommon, thus requiring more work.

i finished it yesterday.  well done.  learned alot about the various attacks possible.  i'm not sure there's another work out there as complete as yours. :D

From what I read, no, unless you count the Stack Exchange as a whole.

Two things that jumped out at me reading the first few pages:

Page 17: 


I think you mean D = TMin/T as TMin is actually a larger number.


I don't think you mean that.  You mean it's computationally infeasible to find a collision.   Collisions
are guaranteed for any shortening hash function such as SHA256, which isn't considered broken.

I lightly skimmed and this could be a great resource. Great work, and thank you. This really adds value and depth to the Bitcoin community.

bumping in case some of you missed this topic (1st post especially)

Grammar errors, my friend.

I'm glad you were so specific.

I'm sorry! Just got to work. Here's a glaring example:

Page 8 - Introduction

"Moreover, during the design of the application, the security features of the Bitcoin network and infrastructure is to be analysed."

it should be

Moreover, during the design of the application, the security features of the Bitcoin network and infrastructure are to be analysed.

edit:

Page 10 - 2.1

"Cryptography is the discipline of writing a message in ciphertext with the aim of protecting a secret from malicious or unauthorised parties."

"Professional cryptography protects not only the plaintext, but also the key and the cryptosystem as a whole."

2.1.1

Encryption and decryption – algorithms focusing on the mapping of plaintext into ciphertext and vice versa [1], used mainly to ensure data confidentiality.

Thank you for your proofreading. English isn't my native language.

I couldn't make it much further than that, due to this silly stupid thing called work, but it wouldn't hurt to get someone to proofread the whole thing for you.

Thank you anyway. Before submitting it I got my wife to read it once or twice (she's Canadian). I guess it's not 100% perfect, but when I'm correcting my supervisor correcting my English, I think there isn't much more need for more proofreading.

ThePiachu: what do you think about this (https://bitcointalk.org/index.php?topic=122240.0) solving "Partial address collision" problem?

Hmm, it could solve some issues, providing the image collisions are improbable.

I guess if one would incorporate the images into a website and a client it could make address substitution less likely. Say, the client would be displaying the image once the user would enter the address into the client. Without an integration into the client it might be a bit hard - I doubt most of the users would bother checking the website by themselves and one could always temper with some third party checks.

Yes, your right. If it would be a part of payment process it's more likely there will be any use of it. Maybe developers will find the idea to be good and include it in a new version of client. We will see...

+1  :o

I added your thesis to https://en.bitcoin.it/wiki/Research.

It was already there;).

I'm sending a little for page count alone, even if much of it was index and references.. Someday when I have time to read it, maybe I'll send more if it's good ;)..

Thanks for the donation. Have a good read when you get around to it ;).

I am writing my Bachelors thesis regarding Bitcoin. It would be much shorter and less detailed than yours obviously. On page 20, you talk about the Bitcoin ecosystem. Where did you get this definition from? I thought it referred to businesses,institutions etc which exist/thrive due to Bitcoin. You can get some idea on what i'm talking about:

https://www.secondmarket.com/education/landing/bitcoin-ecosystem

BTW your thesis has been pretty useful, since you have explained the working of Bitcoin quite well. I will give credit to your work when my thesis is complete. Thanks :)

It's easy to pick holes in other peoples work especially when you just put on the grammar Nazi hat. I'd like to see one of your pieces of work.

As far as I remember I defined the "Bitcoin ecosystem" term myself, I don't remember seeing it being used anywhere before I published my thesis.

I personally don't mind a good spell checker. If I ever want to update my thesis PDF I will have all the typos and mistakes in one place for easy reference ;).

You are replying to someone who is criticizing a year-old post.

Still, the most interesting part of this thread was the language discussion. :)

Indeed! I didn't realise it had been dug up. Just seemed interesting.

Because, without the Grammar Police, the world would implode, and any currency would become irrelevant.

Holy crap, why did I do a masters degree in the physical sciences? I'll be in the nearest corner, crying to myself.

Nice academic work!

Thanks for sharing it.

It's going right to my collection of bitcoin related articles and researches.

Congratulations for your effort!

Cheers.

Thanks.

Nice piece, I'm also working hard on my dissertation ;D ;D

I hope it goes well for you! What is it about?

Great research by op......

http://www.youtube.com/watch?v=8Gv0H-vPoDc