Upload
others
View
2
Download
0
Embed Size (px)
Citation preview
Bitcoin: Synchronization andSharing of Transactions
Roger Wattenhofer
ETH Zurich – Distributed Computing Group – www.disco.ethz.ch
20102011
20122013
20142015
0
200
400
600
800
1000
1200
Pri
ce [
USD
/BTC
]
Exchange Rate USD/BTC
What is Bitcoin?
+ + =
Bitcoin Basics
The Bank of Bitcoin
User BalanceA 2B 5C 8
TXB −→ A
User BalanceA 2 4B 5 3C 8
The Bank of Bitcoin
User BalanceA 2B 5C 8
TXB −→ A
User BalanceA 2 4B 5 3C 8
The Bank of Bitcoin
User BalanceA 2B 5C 8
TXB −→ A
User BalanceA 2 4B 5 3C 8
The Bank of Bitcoin
User BalanceA 2B 5C 8
TXB −→ A
User BalanceA 2 4B 5 3C 8
Opening an Account in Bitcoin
Private Key Public Key Address
Transferring Bitcoins
TX: 41b221
B0.1
A4.798
A4.899
Inputs OutputsFee
0.001
Prev. TX:a1a53743
4.899
0
C...
1
|Outputs
Transferring Bitcoins
TX: 41b221
B0.1
A4.798
A4.899
Inputs OutputsFee
0.001
Prev. TX:a1a53743
4.899
0
C...
1
|Outputs
Transferring Bitcoins
TX: 41b221
B0.1
A4.798
A4.899
Inputs OutputsFee
0.001
Prev. TX:a1a53743
4.899
0
C...
1
|Outputs
Transferring Bitcoins
TX: 41b221
B0.1
A4.798
A4.899
Inputs OutputsFee
0.001
Prev. TX:a1a53743
4.899
0
C...
1
|Outputs
Transferring Bitcoins
TX: 41b221
B0.1
A4.798
A4.899
Inputs Outputs
Fee
0.001
Prev. TX:a1a53743
4.899
0
C...
1
|Outputs
Transferring Bitcoins
TX: 41b221
B0.1
A4.798
A4.899
Inputs OutputsFee
0.001
Prev. TX:a1a53743
4.899
0
C...
1
|Outputs
Transferring Bitcoins
TX: 41b221
B0.1
A4.798
A4.899
Inputs OutputsFee
0.001
Prev. TX:a1a53743
4.899
0
C...
1
|Outputs
Distributing the Bank
User BalanceA 2B 5C 8
TX
TX
Distributing the Bank
TX
Distributing the Bank
TX
Distributing the Bank
TX
Distributing the Bank
TX
Distributing the Bank
TX
Let’s Buy a Snack
[Bamert, Decker, Elsen, W, Welten, 2013]
Doublespending
TX B1
A
1
1
Inputs
Outputs
TX’ A1
1
�
Doublespending
TX B1
A
1
1
Inputs
Outputs
TX’ A1
1
�
Doublespending
TX B1
A
1
1
Inputs
Outputs
TX’ A1
1
�
Transaction Conflicts
TX
TX
Transaction Conflicts
TX
TX
Transaction Conflicts
TX
TX
Transaction Conflicts
TX
TX
Resolving Conflicts
Green!
Resolving Conflicts
Green!
Resolving Conflicts
Green!
How to Choose a Leader?
Proof-of-Work
Block
H(Previous Block)
TX TX TX TX
I H(Block|0) → 094d66aa7c844a9dbb516a41259b5877. . .
I H(Block|1) → f2496854af8bf989171587a9259f634f. . .
I H(Block|2) → aec87c0ca2e5eb3f23111092f1089ada. . .
I H(Block|3) → 777f75b2a8ecfdc8026c236fc1d2ffa0. . ....
I H(Block|961127) → 0000014823419622d4c133672a7d657e. . .
Proof-of-Work
Block
H(Previous Block)
TX TX TX TX
I H(Block|0) → 094d66aa7c844a9dbb516a41259b5877. . .
I H(Block|1) → f2496854af8bf989171587a9259f634f. . .
I H(Block|2) → aec87c0ca2e5eb3f23111092f1089ada. . .
I H(Block|3) → 777f75b2a8ecfdc8026c236fc1d2ffa0. . ....
I H(Block|961127) → 0000014823419622d4c133672a7d657e. . .
Proof-of-Work
Block
H(Previous Block) TX TX TX TX
I H(Block|0) → 094d66aa7c844a9dbb516a41259b5877. . .
I H(Block|1) → f2496854af8bf989171587a9259f634f. . .
I H(Block|2) → aec87c0ca2e5eb3f23111092f1089ada. . .
I H(Block|3) → 777f75b2a8ecfdc8026c236fc1d2ffa0. . ....
I H(Block|961127) → 0000014823419622d4c133672a7d657e. . .
Proof-of-Work
Block
H(Previous Block) TX TX TX TX
I H(Block) → fd2e2055f117bfa261b5a6c7e11df367. . .
I H(Block|0) → 094d66aa7c844a9dbb516a41259b5877. . .
I H(Block|1) → f2496854af8bf989171587a9259f634f. . .
I H(Block|2) → aec87c0ca2e5eb3f23111092f1089ada. . .
I H(Block|3) → 777f75b2a8ecfdc8026c236fc1d2ffa0. . ....
I H(Block|961127) → 0000014823419622d4c133672a7d657e. . .
Proof-of-Work
Block
H(Previous Block) TX TX TX TX Nonce
I H(Block|0) → 094d66aa7c844a9dbb516a41259b5877. . .
I H(Block|1) → f2496854af8bf989171587a9259f634f. . .
I H(Block|2) → aec87c0ca2e5eb3f23111092f1089ada. . .
I H(Block|3) → 777f75b2a8ecfdc8026c236fc1d2ffa0. . ....
I H(Block|961127) → 0000014823419622d4c133672a7d657e. . .
Proof-of-Work
Block
H(Previous Block) TX TX TX TX Nonce
I H(Block|0) → 094d66aa7c844a9dbb516a41259b5877. . .
I H(Block|1) → f2496854af8bf989171587a9259f634f. . .
I H(Block|2) → aec87c0ca2e5eb3f23111092f1089ada. . .
I H(Block|3) → 777f75b2a8ecfdc8026c236fc1d2ffa0. . ....
I H(Block|961127) → 0000014823419622d4c133672a7d657e. . .
Proof-of-Work
Block
H(Previous Block) TX TX TX TX Nonce
I H(Block|0) → 094d66aa7c844a9dbb516a41259b5877. . .
I H(Block|1) → f2496854af8bf989171587a9259f634f. . .
I H(Block|2) → aec87c0ca2e5eb3f23111092f1089ada. . .
I H(Block|3) → 777f75b2a8ecfdc8026c236fc1d2ffa0. . ....
I H(Block|961127) → 0000014823419622d4c133672a7d657e. . .
Proof-of-Work
Block
H(Previous Block) TX TX TX TX Nonce
I H(Block|0) → 094d66aa7c844a9dbb516a41259b5877. . .
I H(Block|1) → f2496854af8bf989171587a9259f634f. . .
I H(Block|2) → aec87c0ca2e5eb3f23111092f1089ada. . .
I H(Block|3) → 777f75b2a8ecfdc8026c236fc1d2ffa0. . ....
I H(Block|961127) → 0000014823419622d4c133672a7d657e. . .
The Blockchain
Time
The Blockchain
Time
Is Bitcoin stable?
The Blockchain
Time
The Blockchain
Time
Propagation Speed
0 10 20 30 40 50 60Time since first observation [s]
0.00
0.02
0.04
0.06
0.08
0.10
0.12PD
FBlock propagation
[Decker, W, 2013]http://bitcoinstats.com
Propagation Speed
0 10 20 30 40 50 60Time since first observation [s]
0.00
0.02
0.04
0.06
0.08
0.10
0.12PD
FBlock propagation
50thp
erc.[Decker, W, 2013]http://bitcoinstats.com
Propagation Speed
0 10 20 30 40 50 60Time since first observation [s]
0.00
0.02
0.04
0.06
0.08
0.10
0.12PD
FBlock propagation
50thp
erc.
95thp
erc.
[Decker, W, 2013]http://bitcoinstats.com
Propagation Speed
0 10 20 30 40 50 60Time since first observation [s]
0.00
0.02
0.04
0.06
0.08
0.10
0.12PD
FBlock propagation
[Decker, W, 2013]http://bitcoinstats.com
Blockchain Forks
180000 182000 184000 186000 188000 190000Blockchain Height
0
2
4
6
8
10
12
Fork
sBlockchain forks
1.69%
[Decker, W, 2013]
Aside: Mining Evolution
20102011
20122013
20142015
10-10
10-9
10-8
10-7
10-6
10-5
10-4
10-3
10-2
10-1
100
101
102
103
Hash
rate
PH
/s
Hashrate evolution
Aside: Mining Evolution
20102011
20122013
20142015
10-10
10-9
10-8
10-7
10-6
10-5
10-4
10-3
10-2
10-1
100
101
102
103
Hash
rate
PH
/s
Hashrate evolution
Aside: Mining Evolution
20102011
20122013
20142015
10-10
10-9
10-8
10-7
10-6
10-5
10-4
10-3
10-2
10-1
100
101
102
103
Hash
rate
PH
/s
Hashrate evolution
Summary
TX
Green!
Block
H(Previous Block) TX TX TX TX Nonce
Time
How to Lose $500M
Addressing Transaction Malleability: MtGox has detectedunusual activity on its Bitcoin wallets and performedinvestigations during the past weeks.
The MtGox Incident
I July 2010: First trade on MtGox
I May 2011: Transaction malleability identified as low priority issue
I February 7, 2014: MtGox halts withdrawals
I February 10, 2014: MtGox announces loss of 850,000 bitcoins (620millio USD) and cites transaction malleability as root cause
I February 28, 2014: MtGox files for bankruptcy
I March 7 2014: MtGox finds 200,000 bitcoins
I August 2015: MtGox CEO is arrested
Signatures
00 00
61 af bb 4d e9 f8 b8 74 86 1e
There are multiple ways to serialize a signature:
I Multiple push operations (1 byte, 2 byte, 4 byte)
I Non-canonical DER encodings
I Padding
I . . .
Signatures
00 00 61 af bb 4d e9 f8 b8 74 86 1e
There are multiple ways to serialize a signature:
I Multiple push operations (1 byte, 2 byte, 4 byte)
I Non-canonical DER encodings
I Padding
I . . .
Transaction Malleability Attack
TX
TX
TX
TX
TX
Red!
TX?Refund
Transaction Malleability Attack
TX
TX
TX
TX
TX
Red!
TX?Refund
Transaction Malleability Attack
TX
TX
TX
TX
TX
Red!
TX?Refund
Transaction Malleability Attack
TX
TX
TX
TX
TX
Red!
TX?Refund
Transaction Malleability Attack
TX
TX
TX
TX
TX
Red!
TX?
Refund
Transaction Malleability Attack
TX
TX
TX
TX
TX
Red!
TX?
Refund
Incident Timeline
Feb 01 2014
Feb 04 2014
Feb 07 2014
Feb 10 2014
Feb 13 2014
Feb 16 2014
Feb 19 2014
Feb 22 2014
Feb 25 2014
Feb 28 20140
50000
100000
150000
200000
250000
300000
350000
bit
coin
s
0
5000
10000
15000
20000
25000
30000
transa
ctio
ns
1st
Pre
ss R
ele
ase
2nd P
ress
Rele
ase
Cumulative malleable doublespends
value
number
386 BTC
[Decker, W, 2014]
Incident Timeline
Feb 01 2014
Feb 04 2014
Feb 07 2014
Feb 10 2014
Feb 13 2014
Feb 16 2014
Feb 19 2014
Feb 22 2014
Feb 25 2014
Feb 28 20140
50000
100000
150000
200000
250000
300000
350000
bit
coin
s
0
5000
10000
15000
20000
25000
30000
transa
ctio
ns
1st
Pre
ss R
ele
ase
2nd P
ress
Rele
ase
Cumulative malleable doublespends
value
number
386 BTC
[Decker, W, 2014]
Is Bitcoin Secure?
Securing Your Bitcoins
[Bamert, Decker, W, 2013]
Does Bitcoin Scale?
The Bitcoin Ecosystem is Growing
20102011
20122013
20142015
0
20000
40000
60000
80000
100000
120000
140000
Tra
nsa
ctio
ns
Daily Transaction Volume
Scalability Limits
I Disk space: < 500 transactions per second
I Processing power: < 200 transactions per second
I Network bandwidth: < 100 transactions per second
I Artificial 1MB limit: < 3 transactions per second
Today:
I Bitcoin: 1 transaction per second
I Credit Cards: > 10, 000 transactions per second
Scalability Limits
I Disk space: < 500 transactions per second
I Processing power: < 200 transactions per second
I Network bandwidth: < 100 transactions per second
I Artificial 1MB limit: < 3 transactions per second
Today:
I Bitcoin: 1 transaction per second
I Credit Cards: > 10, 000 transactions per second
Scalability Limits
I Disk space: < 500 transactions per second
I Processing power: < 200 transactions per second
I Network bandwidth: < 100 transactions per second
I Artificial 1MB limit: < 3 transactions per second
Today:
I Bitcoin: 1 transaction per second
I Credit Cards: > 10, 000 transactions per second
Scalability Limits
I Disk space: < 500 transactions per second
I Processing power: < 200 transactions per second
I Network bandwidth: < 100 transactions per second
I Artificial 1MB limit: < 3 transactions per second
Today:
I Bitcoin: 1 transaction per second
I Credit Cards: > 10, 000 transactions per second
Scalability Limits
I Disk space: < 500 transactions per second
I Processing power: < 200 transactions per second
I Network bandwidth: < 100 transactions per second
I Artificial 1MB limit: < 3 transactions per second
Today:
I Bitcoin: 1 transaction per second
I Credit Cards: > 10, 000 transactions per second
Payment Network
Payment Network
Payment Network
Micropayment Channels
5
5
T=100 5
5
0
4
1
3
2
Micropayment Channels
5 5
T=100 5
5
0
4
1
3
2
Micropayment Channels
5 5
T=100 5
5
0
4
1
3
2
Micropayment Channels
5 5
T=100 5
5
0
4
1
3
2
Micropayment Channels
5 5
T=100 5
5
0
4
1
3
2
Micropayment Channels
5 5
T=100 5
5
0
4
1
3
2
Micropayment Channels
5 5
T=100 5
5
0
4
1
3
2
Micropayment Channels
5 5
T=100 5
5
0
4
1
3
2
Micropayment Channels
5 5
T=100 5
5
0
4
1
3
2
Atomic Multiparty Opt-In
Atomic Multiparty Opt-In
Atomic Multiparty Opt-In
Invalidating Transactions
T=100
T=99
Invalidating Transactions
T=100
T=99
Bidirectional Transfers
5 5
5
0
4 4
4
0
0
5
1
3
Bidirectional Transfers
5 5
5
0
4 4
4
0
0
5
1
3
Bidirectional Transfers
5 5
5
0
4 4
4
0
0
5
1
3
Duplex Micropayment Channels
Setup Invalidation Tree Micropayment Channels
T = 100 T = 100 T = 100
T = 99 T = 100 T = 100
T = 99 T = 100
T = 99
Duplex Micropayment Channels
Setup Invalidation Tree Micropayment Channels
T = 100 T = 100 T = 100
T = 99 T = 100 T = 100
T = 99 T = 100
T = 99
Duplex Micropayment Channels
Setup Invalidation Tree Micropayment Channels
T = 100 T = 100 T = 100
T = 99 T = 100 T = 100
T = 99 T = 100
T = 99
Duplex Micropayment Channels
Setup Invalidation Tree Micropayment Channels
T = 100 T = 100 T = 100
T = 99 T = 100 T = 100
T = 99 T = 100
T = 99
Duplex Micropayment Channels
Setup Invalidation Tree Micropayment Channels
T = 100 T = 100 T = 100
T = 99 T = 100 T = 100
T = 99 T = 100
T = 99
Summary
Red!
TX?Refund
T = 100 T = 100 T = 100
T = 99 T = 100 T = 100
T = 99 T = 100
T = 99
Thank you, questions?
Thanks to Christian Decker
ETH Zurich – Distributed Computing Group – www.disco.ethz.ch
Securing Fast Payments
Let’s Buy a Snack
[Bamert, Decker, Elsen, W, Welten, 2013]
Transaction Confidence
TX
confidence(TX ) =
Transaction Confidence
TX
confidence(TX ) =
Transaction Confidence
TX
confidence(TX ) =
Transaction Confidence
TX
confidence(TX ) =
Transaction Confidence
TX
confidence(TX ) =
Doublespend Detection
0 20 40 60 80 100Node sample size
0.0
0.2
0.4
0.6
0.8
1.0D
ete
ctio
n p
robabili
tyDoublespend detection
[Bamert, Decker, Elsen, W, Welten, 2013]
Time to Detection
20 40 60 80 100Node sample size
0
2
4
6
8
10
12
14
Tim
e [
s]Time until detection
Average time
Median time
95 percentile
99 percentile
[Bamert, Decker, Elsen, W, Welten, 2013]
Successful Doublespend
0 20 40 60 80 100Node sample size
0.00
0.05
0.10
0.15
0.20
0.25
0.30
0.35
0.40
0.45
Pro
babili
tyProbability of successful double spend
[Bamert, Decker, Elsen, W, Welten, 2013]
Successful Doublespend
0 20 40 60 80 100Node sample size
0.00
0.05
0.10
0.15
0.20
0.25
0.30
0.35
0.40
0.45
Pro
babili
tyProbability of successful double spend
0.088%
[Bamert, Decker, Elsen, W, Welten, 2013]