400 Hal Finney - prebitcoin
13 subscribers
96 photos
5 videos
6 files
202 links
Hal Finney
RPOW - Reusable Proofs of Work
2004
https://t.me/Hal_Finney

@Hal_Finney

https://ramonquesada.com/english/telegrams-channels/

Created Jun 2018
Download Telegram
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com


From hal at finney.org Sat Jan 10 21:22:01 2009
From: hal at finney.org (Hal Finney)
Date: Sat, 10 Jan 2009 18:22:01 -0800 (PST)
Subject: Bitcoin v0.1 released
Message-ID: <20090111022201.C084C14F6E1@finney.org>

Satoshi Nakamoto writes:
> Announcing the first release of Bitcoin, a new electronic cash
> system that uses a peer-to-peer network to prevent double-spending.
> It's completely decentralized with no server or central authority.
>
> See bitcoin.org for screenshots.
>
> Download link:
> http://downloads.sourceforge.net/bitcoin/bitcoin-0.1.0.rar

Congratulations to Satoshi on this first alpha release. I am looking
forward to trying it out.

> Total circulation will be 21,000,000 coins. It'll be distributed
> to network nodes when they make blocks, with the amount cut in half
> every 4 years.
>
> first 4 years: 10,500,000 coins
> next 4 years: 5,250,000 coins
> next 4 years: 2,625,000 coins
> next 4 years: 1,312,500 coins
> etc...

It's interesting that the system can be configured to only allow a
certain maximum number of coins ever to be generated. I guess the
idea is that the amount of work needed to generate a new coin will
become more difficult as time goes on.

One immediate problem with any new currency is how to value it. Even
ignoring the practical problem that virtually no one will accept it
at first, there is still a difficulty in coming up with a reasonable
argument in favor of a particular non-zero value for the coins.

As an amusing thought experiment, imagine that Bitcoin is successful and
becomes the dominant payment system in use throughout the world. Then the
total value of the currency should be equal to the total value of all
the wealth in the world. Current estimates of total worldwide household
wealth that I have found range from $100 trillion to $300 trillion. With
20 million coins, that gives each coin a value of about $10 million.

So the possibility of generating coins today with a few cents of compute
time may be quite a good bet, with a payoff of something like 100 million
to 1! Even if the odds of Bitcoin succeeding to this degree are slim,
are they really 100 million to one against? Something to think about...

Hal https://www.metzdowd.com/pipermail/cryptography/2009-January.txt
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com


From hal at finney.org Sat Jan 24 11:48:03 2009
From: hal at finney.org (Hal Finney)
Date: Sat, 24 Jan 2009 08:48:03 -0800 (PST)
Subject: Bitcoin v0.1 released
Message-ID: <20090124164803.A3B7414F6E1@finney.org>

Jonathan Thornburg writes:
> In the modern world, no major government wants to allow untracable
> international financial transactions above some fairly modest size
> thresholds. (The usual catch-phrases are things like "laundering
> drug money", "tax evasion", and/or "financing terrorist groups".)
> To this end, electronic financial transactions are currently monitored
> by various governments & their agencies, and any but the smallest of
> transactions now come with various ID requirements for the humans
> on each end.
>
> But if each machine in a million-node botnet sends 10 cents to a
> randomly chosen machine in another botnet on the other side of the
> world, you've just moved $100K, in a way that seems very hard to
> trace. To me, this means that no major government is likely to allow
> Bitcoin in its present form to operate on a large scale.

Certainly a valid point, and one which has been widely discussed in
the debates over the years about electronic cash. Bitcoin has a couple
of things going for it: one is that it is distributed, with no single
point of failure, no "mint", no company with officers that can be
subpoenaed and arrested and shut down. It is more like a P2P network,
and as we have seen, despite degrees of at least governmental distaste,
those are still around.

Bitcoin could also conceivably operate in a less anonymous mode, with
transfers being linked to individuals, rather than single-use keys. It
would still be useful to have a large scale, decentralized electronic
payment system.

It also might be possible to refactor and restructure Bitcoin to separate
out the key new idea, a decentralized, global, irreversible transaction
database. Such a functionality might be useful for other purposes. Once
it exists, using it to record monetary transfers would be a sort of side
effect and might be harder to shut down.

> I also worry about other "domestic" ways nasty people could exploit
> a widespread Bitcoin deployment:
> * Spammer botnets could burn through pay-per-send email filters
> trivially (as usual, the costs would fall on people other than the
> botnet herders & spammers).
> * If each machine in a botnet sends 1 cent to a herder, that can add
> up to a significant amount of money. In other words, Bitcoin would
> make botnet herding and the assorted malware industry even more
> profitable than it already is.

It's important to understand that the proof-of-work (POW) aspect of
Bitcoin is primarily oriented around ensuring the soundness of the
historical transaction database. Each Bitcoin data block records a set
of transactions, and includes a hash collision. Subsequent data blocks
have their own transactions, their own collisions, and also chain to
all earlier hashes. The result is that once a block is "buried" under
enough new blocks, it is essentially certain (given the threat model,
namely that attackers cannot muster more than X% of the compute power
of legitimate node operators) that old transactions can't be reversed.

Creating new coins is indeed currently also being done by POW, but I
think that is seen as a temporary expedient, and in fact the current
software phases that out over several years. Hence worries about botnets
being able to manufacture large quantities of POW tokens are only a
temporary concern, in the context of Bitcoin.

There have been a number of discussions in the past about POW tokens as
anti spam measures, given the botnet threat. References are available from
"Proof-of-work system" on Wikipedia. Analyses have yielded mixed results,
depending on the assumptions and system design.
If POW tokens do become useful, and especially if they become money,
machines will no longer sit idle. Users will expect their computers to
be earning them money (assuming the reward is greater than the cost to
operate). A computer whose earnings are being stolen by a botnet will
be more noticeable to its owner than is the case today, hence we might
expect that in that world, users will work harder to maintain their
computers and clean them of botnet infestations.

Countermeasures by botnet operators would include moderating their take,
perhaps only stealing 10% of the productive capacity of invaded computers,
so that their owners would be unlikely to notice. This kind of thinking
quickly degenerates into unreliable speculation, but it points out the
difficulties of analyzing the full ramifications of a world where POW
tokens are valuble.

Hal Finney
https://www.metzdowd.com/pipermail/cryptography/2009-January.txt
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com


From hal at finney.org Tue Jan 27 14:35:43 2009
From: hal at finney.org (Hal Finney)
Date: Tue, 27 Jan 2009 11:35:43 -0800 (PST)
Subject: Proof of Work -> atmospheric carbon
Message-ID: <20090127193543.67F9314F6E1@finney.org>

John Gilmore writes:
> The last thing we need is to deploy a system designed to burn all
> available cycles, consuming electricity and generating carbon dioxide,
> all over the Internet, in order to produce small amounts of bitbux to
> get emails or spams through.

It's interesting to consider the ultimate technological resolution to this
issue. Will a global-scale proof-of-work based system inherently consume
substantial amounts of energy? Or are there ways of doing computing
which would allow such a system to use only moderate energy consumption?

This question relates to the thermodynamics of computation. It has
long been known that logically reversible transformations can be done
with arbitrarily low energy dissipation. Hence attention is focused on
irreversible transformations, particularly those that require bit erasure.
Erasing a bit dissipates approximately energy of approximately kT where
k is Boltzmann's constant and T is temperature.

The question is whether a POW system inherently involves a great deal
of irreversible logical transitions, causing bit erasure and dissipating
energy? Or could a POW token be created using solely reversible logic?

One note is that any algorithm can in principle be made reversible except
for the size of the output: compute it using reversible logic, possibly
creating many excess bits which will allow the reversal, until we get
the answer; then make a copy of the output; then reverse the calculation,
consuming all the excess bits until we get back to the original value. The
only irreversible step was saving the output. However this is impractical
for large calculations like we are talking about, because the number of
excess bits would dwarf the size of the calculation.

The hash collisions used in systems like Bitcoin or Hashcash (technically
not collisions, rather searches for pre-images of hash values with many
leading zero bits) seem inherently irreversible. The algorithm typically
sets up a pre-image that includes a counter value, computes the hash,
increments the counter and repeats until a hash is found with the desired
properties. The hash function itself typically uses many intrinsically
irreversible transitions, since logical irreversibility is a defining
requirement of a hash function. Even if we use the trick in the preceding
paragraph to eliminate the cost of the intermediate steps in computing
the hash, we would still need to erase the output result each iteration,
dissipating energy. Typical POW systems in use today require millions
to billions of iterations, and this would be likely to increase in the
future, so the dissipation could be substantial.

Replacing the hash with a logically invertible function might help to
reduce the number of intermediate bits, and eliminate the need to use
the run-backwards trick. One would require that both the pre-image and
the post-image contain a number of bits in fixed positions. However this
would still seem to require the same kind of search algorithm, causing
dissipation as each intermediate result is erased.

Perhaps a variation on this idea would work, if the logically invertible
function was itself very slow, perhaps paramaterized to have a huge number
of rounds. Then only a relatively small number of iterations would be
needed before a lucky result is found, for a given level of POW effort.
This would reduce dissipation. However it would slow down verification,
and since verification of the POW will be done far more often than
creation, we can't afford to tip things too far in that direction.
Another idea I had was to use a deterministic POW rather than a random
one like hash collision. Cryptographic work on "timed commitments" and
related topics has shown that repeated squarings modulo an unknown RSA
modulus allow for a relatively concise and quickly verifiable proofs that
some very large number of squarings had taken place, with no shortcuts
possible for the creation of the resulting certification. Broadly
speaking, modular squaring is logically reversible, in that one could
theoretically compute the square root. But in practice, as with the
hash computation, computing a modular square using logically reversible
operations will produce a large number of excess bits. Even if the excess
from a single squaring could be consumed using the trick mentioned
above, one would still be forced to erase the temporarily result of
each individual squaring operation, as the POW would require a very
large number of squarings. So the overall dissipation would appear to
be similar to the hash computation.

(Also, it's not clear that a deterministic POW works well for an
application like Bitcoin; it might let the owner of the fastest computer
win every POW race, giving him too much power.)

So the question from John's challenge remains open: is there a POW
system which could be built solely on logically reversible computation?
The computation has to be intrinsically time consuming, but with a short
and quickly verifiable certificate of validity.

Hal Finney
https://www.metzdowd.com/pipermail/cryptography/2009-January.txt
Hal Finney on digital cash traceability.
2020 01 02

Hal wrote about digital cash and traceability in 1994 on the Cypherpunk Mailing List:

…"the political point is that if you can make an untraceable payment, you could be coerced into doing so, for example by being robbed at gunpoint. Contrariwise, if the cash system used by you and your bank is such that all money is inherently traceable, it will be a lot harder to commit robbery, extortion, kidnapping, and all those other horrors which people fear will come with digital cash."

https://breakingsatoshi.substack.com/p/hal-finney-on-digital-cash-traceability
Hal Finney on digital cash traceability
Deryk Makgill
Jan 2. 2020
https://breakingsatoshi.substack.com/p/hal-finney-on-digital-cash-traceability
Bitcoin P2P e-cash paper
Satoshi Nakamoto satoshi at vistomail.com
Fri Nov 14 13:55:35 EST 2008
https://www.metzdowd.com/pipermail/cryptography/2008-November/014853.html
Forwarded from 2008 361 PoW Proof of Work (@RamonQuesada 🌷)
Now you can have a FULL list with all the Telegram channels that I have been creating, organized alphabetically

Please subscribe to the news letters and you will receive an email with each new blog post

Thank you for making blockchain and BitCoin technology better known every day.
https://ramonquesada.com/english/telegrams-channels-names-in-alphabetical-order/