HMD 283, 49. Jahrgang, Februar 2012
http://hmd.dpunkt.de/283/09.php
Bitcoin - das Open-Source-Geld
Clemens H. Cap
Zusammenfassung

Im Mittelpunkt des Beitrags steht das Open-Source-Währungsprojekt Bitcoin. Beleuchtet werden die zugrunde liegenden konzeptuellen Elemente, die technische Umsetzung dieser neuen Form von elektronischem Geld sowie die Bitcoin-Community. Zudem erfolgt eine erste Bewertung der Aktivität. Besonders spannend erscheint aus technischer Sicht die völlig dezentrale Peer-to-Peer-Architektur. Ökonomisch und projekttechnisch bemerkenswert ist der Ansatz eines offenen, freien und demokratischen Währungssystems, das allein aus der Akzeptanz im Peer-to-Peer-Tausch heraus lebt.
Inhaltsübersicht

    Das Open-Source-Prinzip auf Geld angewendet
    Elektronisches Geld im Überblick
        Kontenbasiertes elektronisches Geld
        Tokenbasiertes elektronisches Geld
    Die Grundidee von Bitcoin
    Die Konzepte von Bitcoin
        Geld als Netz von Transaktionen
        Ist Bitcoin anonym?
        Abstrakte Beschreibung des Bitcoin-Algorithmus
        Der Blockkettenmechanismus
        Vermeiden von Double Spending und Laufzeiteffekten
        Skalierung
        Bitcoin und das CAP-Theorem
    Akzeptanz und Bewertung
        Stand des Projektes
        Technische Bewertung
        Weitere Perspektiven
    Literatur

In my interpretation of affairs it is important to understand that Bitcoin does not reach consensus, does not stabilize (in a common sense interpretation of the word, as in "eventually reaches consensus") and does not solve the Byzantine Generals problem.

Bitcoin is a highly probabilistic, random algorithm which "only" guarantees a certain probability distribution over time - which, admittedly, after a number of blocks is so centered, that we can treat the outcome as having reached consensus for practically all reasonable expectations.

This fine distinction explains, what otherwise could be seen as contradiction between classical results on Byzantine consensus and results (seemingly) achieved by Bitcoin.

Of course, Bitcoin by all means is a very interesting algorithm for academia.

AH. That's a good argument!

I was considering a world with a large number of alt-chains (1000 and more) and a large number of miners (some 100M) and I was studying the theoretical stability. Of course these are unrealistic assumptions. With some 10 alt chains and some 12 guys working on them, social inertia is way large enough to stabilize the system. We'll see down the road if this changes as soon as bounty drops to 1 BTC or lower. Then, probably, new incentives could come up, if Bitcoin does not pick up as fast as most of us hope.

Define crime. 

Short of unauthorized login and stealing keys - what could possibly define "criminal" behavior for Bitcoin? Deviation from the official protocol standard? And, btw, what would that be?

The more I think it over, BTC looks to me like an interesting form of speculation on future behavior of other people. At a more close look, every economic endeavor probably is like that 

Yes. Agreed. Fine. That's not the point where we lost our communication. 

Our discussion starts where your posting ends. If you want to provide some kind of mathematical model for maximizing wealth - you need a unit to measure wealth in. There is none - or, rather, it is arbitrary or dependent on the miner.

You could chose a gold standard, a dollar standard, a whopper standard, whatever. It will always be relative and different from person to person. And this is EXACTLY the problem I see here.

So, let us pick some mathematical model for the behavior of a miner (whoppers or Zimbabwe dollars - your choice). The wealth function (and thus the function the miner wants to maximize) will not only depend on todays conversion rate into your chosen wealth standard but also on his belief how this conversion rate will change during the near future. Again, the concept of "near future" is different from miner to miner.

Coming back to the original example: Some miners will be conservative and considerate of inflation - they will not switch to a 51 BTC per block chain. Others are more greedy - they will not switch to a 80 BTC per block chain but might consider switching to a 55 BTC block chain, giving it a try. So what we are likely to see is an interesting form of random mixture (and the same, as another poster pointed out, will be the case for the non-mining participants in the system).

The question I am interested is no one of structural stability. IF all miners are strictly conservative and refuse to change...the system will be stable. IF all miners are stupid and ignore inflation...the system will drift to chains with higher and higher block bounties. Some where in between these two extremes we will find the "real" Bitcoin network. What can we say about this real Bitcoin network? Right now we are (as we can observe daily) in a stable domain. How far away are we from an unstable area? Or, is the beginning of the instability domain ridiculously far away? I do not know. I probably will set up a simulation on this if a have a bit more time during summer. the ongoing discussion stimulates my curiosity.
 


 

  Oops. Since I am a non native speaker of English I might not completely catch the subtle context of this remark. But, yes, I am convinced that theory and thinking is fun and pays off (at least it did so far in my life).


Exactly ! I think we now reached the same conceptual framework (the lack of which was the reason for a bit of misunderstanding in some postings).

My issue is the following:

Let's assume we model Bitcoin swarm behavior with game theory. In this case 1 BTC is the payoff and if I increase it to 2 BTC this is a more attractive payoff. If I program a Bitcoin miner to maximize his BTC profits, he will opt for the 2 BTC chain.

Of course, you are completely right that Bitcoin miners do not work that way. They are human beings and not just game theoretical agents. They know about dilusion and inflation and therefore will not readily switch to the 2 BTC or the 11 quadrillion BTC chain. Thus, we cannot model Bitcoin swarm behavior with game theory alone. We must look at human consensus and at economic aspects. So let us do so...

However...we now realize that this provides no final answer as well. Most states, share holders, companies, federal reserve banks know about dilution and inflation, nevertheless they, as human beings, still decide to accept a MINOR form of if...a bit LARGER form...since it worked out...again a bit LARGER...and...ooops...we have a financial crash.

So, wy should Bitcoin be more stable than the dollar, when the Bitcoin system inherently has the same problem (human beings making bad decisions) as the dollar.

I must admit that I get some pleasure from thinking about this theoretical issue and trying to find an answer which Bitcoin mining cannot compensate. I am interested whether this model is correct or my line of reasoning has a flaw. I am interested which mathematical / behavioral mechanism could eventually provide for some ultimate stability in Bitcoin (which, as mentioned above, it does not have in it's current form). Compare with the dollar: It HAD a gold standard - until the president / fed abolished it. What would prevent miners to abolish the current limitation system in BTC...and opt for a 51 BTC per block chain (or, rather, 14 quadrillion in the end).

Very strong argument, especially from a methodological point of view. 

I agree, that THIS attack is probably useless. I understood the OP differently (he only had the 51% part in his question).


Agree again. "They can't cash out the coins they're creating!". Where do you take this assumption from? The 51% miners would, in my version of the attack, switch to a chain, which is more profitable for every participant (eg. they add 1 BTC to every address) - and they would continue to include transactions nto the chain. So there is a monetary incentive to switch to the spawned chain. It may take a while, until all wallet users switch to the new chain, of course. So it is a matter of speed of adoption.

Why would nobody accept those BTC?

The new block chain honors all BTCs mined in the old block chain. However, it offers more attractive conditions to every miner which adopts the new block chain. Therefore there is a clear incentive to switch to the new block chain. Even worse: If you stay in the old chain, under the assumptions of the attack made above, the old chain will lose 99% of its hash power and will be V-E-R-Y slow.

I agree, that this will not happen in reality, since (1) the assumptions on which this attack is based are unrealistic and (2) miners will not base their decisions only on maximizing their profit, but also on a social consensus on how Bitcoin should work. This is good news.

The thought experiments of  a theoretician often sound silly from a practical point of view :-).

 

In the logic of the attack I would not mind when they notice. Since I have 99% percent of mining power I do not care what the remaining 1% of the mining power does.

I suppose we have a misunderstanding with regard to the phrase "subvert 99% of the mining power" as it was used in an earlier posting. I understand it as "I own 99% of the mining power". It looks like you understand it as "99% of the miners are in my pool and they might also leave my pool".

I agree completely: If "my" 99% of mining power just is derived from miners in "my" pool - the miners might notice and might leave my pool. And still, even in this situation: Would they do so if they realize that their payoffs are larger in my version of the algorithm? They are getting 51 BTC (or 500 BTC) in my version. Is it tempting to move from a 500 BTC per block operation to a 50 BTC per block operation? ;-)

There will be a Bitcoin tutorial and workshop in Braunschweig as part of the German computer scientists meeting. It will be mixed language (English and German).

http://bitcoin.uni-rostock.de

The results of the workshop will be published as a special issue of Future Internet.

http://www.mdpi.com/journal/ajax/events/futureinternet

This is an interesting issue. However, I do not yet fully understand your line of reasoning.

Assume I subvert 99% of the mining power and use it to mine an incompatible block chain. The effect is that the "old" chain speed will drop to 1% (rendering it essentially useless - and staying useless during at least several difficulty adjustment periods) whereas "my" chain will continue mining at more or less full speed.

Now a social effect kicks in. Numerous other users will notice that their clients cannot get any transaction done (since chain speed is too slow). On my website they will read this dossier about the Bitcoin 2.0 protocol. They will checkout Bitcoin 2.0 block explorer and will witness how the new chain is working (remember, I have 99% of hash performance, so I will of course also generate a lot of transactional traffic between all kinds of new bitcoin addresses). Quite soon users will be convinced that Bitcoin 2.0 is the arena where the show goes on and that "old" chain no longer is attractive nor active. So, more and more users will use my Bitcoin 2.0 client and will be happy.

You are, of course, perfectly free to stay with your Bitoin 1.0 client and with a chain, which not only lacks hashing power but also rapidly uses users. You also can fight back by writing forum articles that I am a bad guy and all kinds of stuff - and of course you will be right with that. However: I will claim that you are just trying to ruin Bitcoin 2.0 - and my proof will be a nicely working block chain 2.0 with lots of transactions going on.

Maybe there is a flaw in my thoughts. I would be happy if you pointed it out.

In my understanding of system security, trust in a system is increased with the number of (virtual ie. thought experiment, as well as real) attacks on a system which the system successfully survives (either by a good counterargument or by real life defense). So all this effort is increasing the security of Bitcoin.

Gavin, I am sure that there are MANY more important things on the TODO list. My personal understanding of this (and several similar) threads is about theoretical aspects. The block chain is now running for some time...that's the best proof of its success. But until we have better formal and simulation tools for discussing all the if's could's and probably's some of the community will keep trying to work on Bitcoin theory. :-)

I meant the party which in the above scenario wants to defend Bitcoin against the mentioned attack.


I do not know. Maybe it depends on the exact attack and defense modes and all the remaining assumptions we make on the attacks.

For example: Let us assume we have 100 different chains and a centralized attacker (let's say the Fed) owning 51% of the hash and attempting an attack where he never adds transactions to the chain. Initially, the chains are all exact copies. With 49% of the hash and with 100 different chains there is a non-negligible chance that the good guys might at least in 1 or 2 of these chains win the block earlier than the attacker. So - under these assumptions - I am not sure if this claim is correct. I would agree, if attack modes also comprise double spending attacks (but still, I do not know - for lack of an appropriate model).

AFAIK we do not have the proper abstract models in place yet to be able to calculate and derive all the answers...

I wouldn't do this in a "Visual *" or in a "* Basic" type of language.

You should check out libbitcoin. I studied the source and they are using modern and modular c++ concepts. IMHO this is the way to do it. Also their approach to asynchronous communication and concepts like continuations / completions / futures is very nice.

That said, I think Bitcoin (the reference implementation) is too complicated for an OOP module approach to produce working and correct algorithms unless we do a major refactoring of the code base - and here probably a reimplementation from scratch is the best thing.

This is a very interesting attack and similar to scenarios I had in mind as well. May I brainstorm on a defense?

We open up a second block chain with a fresh genesis block. We build the genesis block with lots of coinbase transactions which restore the account values as they were in the old block chain. Now we have a copy of the block chain. If the good guys have 49% and the attacker has 51% of hash power on ONE chain, the attacker wins. With two chains and hash power switching back and forth between two chains, there probably once in a while will be the chance to be head on at least in one of the chains for the good guys. However, I am not sure whether a disrupting attacker still is in the same situation as with a single block chain.

Now assume we have a large number of parallel chains, competing with each other (if we use chain identification codes, this could even be done as part of the same software and the same data structure). I have some hope that there are scenarios where an attacker cannot stop all chains from progressing.

Let me compare this to PirateBay and email. Stopping filesharing in the PirateBay model is easy, in the email model it cannot be stopped. So: Could a world with a large number of parallel Bitcoin chains be more resilient than a world with a single Bitcoin chain?


Never saw it that way. It could be a valid point.

I do not see a confusion and it is not intentional. The OP asked about how bitcoin could be destroyed and how we could protect it against it; attacks involving large amounts of hash power IMHO are only one of the possibilities; I see others, which is the reason I contribute to this thread.


This is true when you measure payoff in number of coins. The argument probably does not apply when you measure it in USD or EURO, since the coins of the other chains have much lower exchange rates or smaller acceptance or less trust due to smaller community and so on.


Sorry. Is this your thread? Did the OP ask me to leave? Where? Should I be violating some rule of the board, I apologize. Please point out the rule, so I can follow it. Part of my interaction here is exactly the attempt to reach your level of expertise so that my contributions are less boring ;-) Why are you making it more difficult to learn?

Yes. It does. It is very helpful indeed.

That's certainly true for one version of the attack (the one which continues with 100BTC). It is not true for the version which continues with the 50BTC. And: I trust more in the greed of the people than in their rationality. No, I am not happy about this. 


The alternative chains we saw thus far were based, to the degree I know and IMHO, on changes which did not produce visible benefits to the user and thus were not able to activate the greed reflex.