Eli Ben‐Sasson, Alessandro Chiesa, Christina Garman, Matthew Green · 7 authors
Bit coin is the first digital currency to see widespread adoption. While payments are conducted between pseudonyms, Bit coin cannot offer strong privacy guarantees: payment transactions are recorded in a public decentralized ledger, from which much information can be deduced. Zero coin (Miers et al., IEEE S&P 2013) tackles some of these privacy issues by unlinking transactions from the payment's origin. Yet, it still reveals payments' destinations and amounts, and is limited in functionality. In this paper, we construct a full-fledged ledger-based digital currency with strong privacy guarantees. Our results leverage recent advances in zero-knowledge Succinct Non-interactive Arguments of Knowledge (zk-SNARKs). First, we formulate and construct decentralized anonymous payment schemes (DAP schemes). A DAP scheme enables users to directly pay each other privately: the corresponding transaction hides the payment's origin, destination, and transferred amount. We provide formal definitions and proofs of the construction's security. Second, we build Zero cash, a practical instantiation of our DAP scheme construction. In Zero cash, transactions are less than 1 kB and take under 6 ms to verify - orders of magnitude more efficient than the less-anonymous Zero coin and competitive with plain Bit coin.
A widespread security claim of the Bitcoin system, presented in the original Bitcoin white-paper, states that the security of the system is guaranteed as long as there is no attacker in possession of half or more of the total computational power used to maintain the system. This claim, however, is proved based on theoretically flawed assumptions. In the paper we analyze two kinds of attacks based on two theoretical flaws: the Block Discarding Attack and the Difficulty Raising Attack. We argue that the current theoretical limit of attacker's fraction of total computational power essential for the security of the system is in a sense not $\frac{1}{2}$ but a bit less than $\frac{1}{4}$, and outline proposals for protocol change that can raise this limit to be as close to $\frac{1}{2}$ as we want. The basic idea of the Block Discarding Attack has been noted as early as 2010, and lately was independently though-of and analyzed by both author of this paper and authors of a most recently pre-print published paper. We thus focus on the major differences of our analysis, and try to explain the unfortunate surprising coincidence. To the best of our knowledge, the second attack is presented here for the first time.
Open access
2 source records
cs.CR
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Marcelo Arenas, Juan L. Reutter, Etienne Toussaint, Martín Ugarte · 6 authors
In the consensus protocols used in most cryptocurrencies, participants called miners must find valid blocks of transactions and append them to a shared tree-like data structure. Ideally, the rules of the protocol should ensure that miners maximize their gains if they follow a default strategy, which consists on appending blocks only to the longest branch of the tree, called the blockchain. Our goal is to understand under which circumstances are miners encouraged to follow the default strategy. Unfortunately, most of the existing models work with simplified payoff functions, without considering the possibility that rewards decrease over time because of the game rules (like in Bitcoin), nor integrating the fact that a miner naturally prefers to be paid earlier than later (the economic concept of discount). In order to integrate these factors, we consider a more general model where issues such as economic discount and decreasing rewards can be set as parameters of an infinite stochastic game. In this model, we study the limit situation in which a miner does not receive a full reward for a block if it stops being in the blockchain. We show that if rewards are not decreasing, then miners do not have incentives to create new branches, no matter how high their computational power is. On the other hand, when working with decreasing rewards similar to those in Bitcoin, we show that miners have an incentive to create such branches. Nevertheless, this incentive only occurs when a miner controls a proportion of the computational power which is close to half of the computational power of the entire network.
Marcin Andrychowicz, Stefan Dziembowski, Daniel Malinowski, Łukasz Mazurek
BitCoin transactions are malleable in a sense that given a transaction an adversary can easily construct an equivalent transaction which has a different hash. This can pose a serious problem in some BitCoin distributed contracts in which changing a transaction's hash may result in the protocol disruption and a financial loss. The problem mostly concerns protocols, which use a "refund" transaction to withdraw a deposit in a case of the protocol interruption. In this short note, we show a general technique for creating malleability-resilient "refund" transactions, which does not require any modification of the BitCoin protocol. Applying our technique to our previous paper "Fair Two-Party Computations via the BitCoin Deposits" (Cryptology ePrint Archive, 2013) allows to achieve fairness in any Two-Party Computation using the BitCoin protocol in its current version.
Designed to compete with fiat currencies, bitcoin proposes it is a crypto-currency alternative. Bitcoin makes a number of false claims, including: solving the double-spending problem is a good thing; bitcoin can be a reserve currency for banking; hoarding equals saving, and that we should believe bitcoin can expand by deflation to become a global transactional currency supply. Bitcoin's developers combine technical implementation proficiency with ignorance of currency and banking fundamentals. This has resulted in a failed attempt to change finance. A set of recommendations to change finance are provided in the Afterword: Investment/venture banking for the masses; Venture banking to bring back what investment banks once were; Open-outcry exchange for all CDS contracts; Attempting to develop CDS type contracts on investments in startup and existing enterprises; and Improving the connection between startup tech/ideas, business organization and investment.
Bitcoin is the latest fantasy object of utopian thinkers far and wide. Angry with the banks? It sidesteps them. Fed up with governments? They can’t regulate it. Annoyed by corporations? Bitcoin transcends them. Worried about fraud? Bitcoin uses the latest cryptography. Keen to make a buck (so to speak) by participating in a boom? Come on down and plug in.
Nearly every aspect of a hacked computer and a users online life can be and has been commoditized. Recent trends into crypto currencies have made the former even more true as cyber criminals are now committing crime for monetary benefit and not just to out smart each other. In this study, I look more closely at Bitcoin, a de-centralized crypto currency which has become increasingly popular in the last six months. This study focuses on the analysis of the bitcoin economy, the involvement of malware and botnets and its effect to the currency.
This Note discusses the relationship of Bitcoins, a cyber-currency, to the Bank Secrecy Act and discusses money laundering and tax evasion. This Note highlights the use and potentially problematic implications of Bitcoins in commerce and discusses their current regulation by the government, both within the United States and internationally, to guard against these threats. This Note addresses the regulation of Bitcoin exchanges, the exchanges' vulnerability to cyber-attacks, and the value of trust to the users of Bitcoin exchanges. This Note concludes that well known exchanges that operate both within and outside the United States generally self-regulate in order to gain the trust of their users despite the cyber-attacks on exchanges in the past. This Note also addresses the tax-reporting implications of foreign Bitcoin exchanges, looking by analogy at attempts to gain information from known tax havens.This Note argues that, given the applicability of the BSA to Bitcoin exchanges, the Bitcoin system poses serious questions relating to money laundering and tax reporting, mostly with regard to the less trustworthy exchanges known for their illegal activity. Some Bitcoin exchanges and e-wallets may also have the potential to become the next tax havens. Many exchanges voluntarily implement measures amounting to self-regulation in attempts to appear more trustworthy to wary consumers or in attempts to avoid criminal or civil sanctions. Whether this self-regulation is sufficient to achieve the goals of preventing money laundering and other criminal activity is debatable. Exchanges that have no need to appear trustworthy, however, still pose the same risks of money laundering and other illegal activity contemplated by the FBI. Moreover, ways exist in which criminals can work around the current regulatory scheme to achieve criminal goals; in that respect, the current regulatory scheme is ineffective to prevent the targeted criminal activity. This Note recommends a supplemental regulatory scheme that would target the areas that current regulation fails to address in combating money laundering, tax evasion, and other criminal activity.
The Bitcoin cryptocurrency records its transactions in a public log called the blockchain. Its security rests critically on the distributed protocol that maintains the blockchain, run by participants called miners. Conventional wisdom asserts that the protocol is incentive-compatible and secure against colluding minority groups, i.e., it incentivizes miners to follow the protocol as prescribed. We show that the Bitcoin protocol is not incentive-compatible. We present an attack with which colluding miners obtain a revenue larger than their fair share. This attack can have significant consequences for Bitcoin: Rational miners will prefer to join the selfish miners, and the colluding group will increase in size until it becomes a majority. At this point, the Bitcoin system ceases to be a decentralized currency. Selfish mining is feasible for any group size of colluding miners. We propose a practical modification to the Bitcoin protocol that protects against selfish mining pools that command less than 1/4 of the resources. This threshold is lower than the wrongly assumed 1/2 bound, but better than the current reality where a group of any size can compromise the system.
Bitcoin is a "crypto currency", a decentralized electronic payment scheme based on cryptography which has recently gained excessive popularity. Scientific research on bitcoin is less abundant. A paper at Financial Cryptography 2012 conference explains that it is a system which "uses no fancy cryptography", and is "by no means perfect". It depends on a well-known cryptographic standard SHA-256. In this paper we revisit the cryptographic process which allows one to make money by producing bitcoins. We reformulate this problem as a Constrained Input Small Output (CISO) hashing problem and reduce the problem to a pure block cipher problem. We estimate the speed of this process and we show that the cost of this process is less than it seems and it depends on a certain cryptographic constant which we estimated to be at most 1.86. These optimizations enable bitcoin miners to save tens of millions of dollars per year in electricity bills. Miners who set up mining operations face many economic incertitudes such as high volatility. In this paper we point out that there are fundamental incertitudes which depend very strongly on the bitcoin specification. The energy efficiency of bitcoin miners have already been improved by a factor of about 10,000, and we claim that further improvements are inevitable. Better technology is bound to be invented, would it be quantum miners. More importantly, the specification is likely to change. A major change have been proposed in May 2013 at Bitcoin conference in San Diego by Dan Kaminsky. However, any sort of change could be flatly rejected by the community which have heavily invested in mining with the current technology. Another question is the reward halving scheme in bitcoin. The current bitcoin specification mandates a strong 4-year cyclic property. We find this property totally unreasonable and harmful and explain why and how it needs to be changed.
Sarah Meiklejohn, Marjori Pomarole, Grant Jordan, Kirill Levchenko · 7 authors
Bitcoin is a purely online virtual currency, unbacked by either physical commodities or sovereign obligation; instead, it relies on a combination of cryptographic protection and a peer-to-peer protocol for witnessing settlements. Consequently, Bitcoin has the unintuitive property that while the ownership of money is implicitly anonymous, its flow is globally visible. In this paper we explore this unique characteristic further, using heuristic clustering to group Bitcoin wallets based on evidence of shared authority, and then using re-identification attacks (i.e., empirical purchasing of goods and services) to classify the operators of those clusters. From this analysis, we characterize longitudinal changes in the Bitcoin market, the stresses these changes are placing on the system, and the challenges for those seeking to use Bitcoin for criminal or fraudulent purposes at scale.
Many want to know what bitcoin is and how it works. But bitcoin is as complex as it is controversial, and relatively few have the technical background to understand it. In this paper, I offer an accessible on-ramp for understanding bitcoin in the form of a model. My model reveals both what bitcoin is and how it works. More specifically, it reveals that bitcoin is a fictional substance in a massively coauthored story on a network that automates and distributes jobs normally entrusted to centralized publishing institutions. My model therefore falsifies a popular view according to which each bitcoin is a chunk of code.
Digital payment schemes show an ever increasing importance. Out of the countless different schemes available this article focuses on the popular Bitcoin system. The authors provide a description of Bitcoin's unique technological basis and its accompanying ecosystem of users, miners, trading platforms and vendors. Furthermore, this article discusses Bitcoin's currency-like features and the first regulatory actions take in the European Union and in the United States of America.
The virtual currency and payment project Bitcoin intends to challenge the current monetary and payment system that finds itself in a legitimacy crisis in the aftermath of the financial market turmoil of 2008. In examining the governance of the Bitcoin system, I try to assess its potential to create input and output legitimacy as a payment system and as a monetary system in comparison with current practice.
Amanda Talsma, Jan Sloots, Janneke van de Ouweland
Dit onderzoek is verricht voor het Lectoraat Duurzaam Financieel Management aan de Hanzehogeschool. Er wordt onderzocht welke gevolgen het gebruik van de Bitcoin heeft voor de maatschappij.
Bitcoin, the cryptocurrency powered by a decentralized peer-to-peer network of computers, has been hot this season. With the exchange rate bobbing around US $100, those involved in creating new bitcoins' and upholding the network that makes them valuable' have become locked in an arms race of sorts, seeking new, powerful machines that will enrich them but that could also destabilize the nascent virtual money.
A collection of questions about Bitcoin and its hypothetical relatives Bitguilder and Bitpenny is formulated. These questions concern technical issues about protocols, security issues, issues about the formalizations of informational monies in various contexts, and issues about forms of use and misuse. Some questions are formulated in the more general setting of informational monies and near-monies. We also formulate questions about legal, psychological, and ethical aspects of informational money. Finally we formulate a number of questions concerning the economical merits of and outlooks for Bitcoin.
The Bitcoin network of decentralized payment transactions has attracted a lot of attention from both Internet users and researchers in recent years. Bitcoin utilizes a peer-to-peer network to issue anonymous payment transactions between different users. In the currently used Bitcoin clients, the full transaction history is available at each node of the network to prevent double spending without the need for a central authority, forming a valuable source for empirical research on network structure, network dynamics, and the implied anonymity challenges, as well as guidance on the future evolution of complex payment systems. We found dynamical effects of which some increase anonymity while others decrease it. Most importantly, several parameters of the Bitcoin transaction graph seem to have become stationary over the last 12–18 months. We discuss the implications.
This article examines the use of Bitcoin in money remittance markets as a specific illustration of wider emerging regulatory issues relating to the use of cryptocurrencies. While there are many conceivable benefits of using Bitcoin for remittances, there are also many risks for users of these remittance services. This article adopts a user perspective to look at what the major concerns are and what existing protections may be available to persons using cryptocurrencies under New Zealand law through the example of using Bitcoin for remittance purposes. The article then summarises approaches taken by other jurisdictions before suggesting a specific regulatory approach to cryptocurrencies that New Zealand should consider adopting.
Ian Miers, Christina Garman, Matthew Green, Aviel D. Rubin
Bitcoin is the first e-cash system to see widespread adoption. While Bitcoin offers the potential for new types of financial interaction, it has significant limitations regarding privacy. Specifically, because the Bitcoin transaction log is completely public, users' privacy is protected only through the use of pseudonyms. In this paper we propose Zerocoin, a cryptographic extension to Bitcoin that augments the protocol to allow for fully anonymous currency transactions. Our system uses standard cryptographic assumptions and does not introduce new trusted parties or otherwise change the security model of Bitcoin. We detail Zerocoin's cryptographic construction, its integration into Bitcoin, and examine its performance both in terms of computation and impact on the Bitcoin protocol.
The famous new money Bitcoin is classified as a technical informational money (TIM). Besides introducing the idea of a TIM, a more extreme notion of informational money will be developed: exclusively informational money (EXIM). The informational coins (INCOs) of an EXIM can be in control of an agent but are not owned by any agent. INCOs of an EXIM cannot be stolen, but they can be lost, or thrown away. The difference between an EXIM and a TIM shows up when considering a user perspective on security matters. Security for an EXIM user is discussed in substantial detail, with the remarkable conclusion that computer security (security models, access control, user names, passwords, firewalls etc.) is not always essential for an EXIM, while the application of cryptography based information security is unavoidable for the use of an EXIM. Bitcoin seems to meet the criteria of an EXIM, but the assertion that "Bitcoin is an EXIM", might also be considered problematic. As a thought experiment we will contemplate Bitguilder, a hypothetical copy of Bitcoin that qualifies as an EXIM. A business ethics assessment of Bitcoin is made which reveals a number of worries. By combining Bitguilder with a so-called technical informational near-money (TINM) a dual money system, having two units with a fluctuating rate, may be obtained. It seems that a dual money can remedy some, but not all, of the ethical worries that arise when contemplating Bitcoin after hypothetically having become a dominant form of money. The contributions that Bitcoin's designers can potentially make to the evolution of EXIMs and TIMs is analyzed in terms of the update of the portfolio of money related natural kinds that comes with Bitcoin.
The famous new money Bitcoin is classified as a technical informational money (TIM). Besides introducing the idea of a TIM, a more extreme notion of informational money will be developed: exclusively informational money (EXIM). The informational coins (INCOs) of an EXIM can be in control of an agent but are not owned by any agent. INCOs of an EXIM cannot be stolen, but they can be lost, or thrown away. The difference between an EXIM and a TIM shows up when considering a user perspective on security matters. Security for an EXIM user is discussed in substantial detail, with the remarkable conclusion that computer security (security models, access control, user names, passwords, firewalls etc.) is not always essential for an EXIM, while the application of cryptography based information security is unavoidable for the use of an EXIM. Bitcoin seems to meet the criteria of an EXIM, but the assertion that "Bitcoin is an EXIM", might also be considered problematic. As a thought experiment we will contemplate Bitguilder, a hypothetical copy of Bitcoin that qualifies as an EXIM. A business ethics assessment of Bitcoin is made which reveals a number of worries. By combining Bitguilder with a so-called technical informational near-money (TINM) a dual money system, having two units with a fluctuating rate, may be obtained. It seems that a dual money can remedy some, but not all, of the ethical worries that arise when contemplating Bitcoin after hypothetically having become a dominant form of money. The contributions that Bitcoin's designers can potentially make to the evolution of EXIMs and TIMs is analyzed in terms of the update of the portfolio of money related natural kinds that comes with Bitcoin.
This Comment examines the potentially destabilizing effects of emerging digital currencies on the international foreign currency exchange market. Specifically, it examines "Bitcoin," a decentralized, partially anonymous, and largely unregulated digital currency that has become particularly popular in the last few years. This Comment argues that the International Monetary Fund, the institution responsible for coordinating the stability of foreign exchange rates, is ill-equipped to handle the widespread use of digital currencies in the foreign currency exchange market It highlights the inability of the Fund to intervene in the event of a speculative attack on a currency by Bitcoin users. This Comment concludes by suggesting two interpretations of the Fund's incorporating document, the Articles of Agreement, that would allow it to intervene in the event of such an attack.