Introduction to Bitcoin. Basic design principles.

Before ThisWhere Lecture 15 Left Off

Lecture 15 closed Chapter 5 with the Small Database (SmallDB) mechanism, the information-theoretic and computational lower bounds, traitor tracing (identifying which insider leaked a key) and the connection to game theory. The next three lectures change the subject to maintaining a public ledger with no trusted party.

This LectureWhat It Adds

The lecture starts Bitcoin from the failure mode digital money must solve: bits can be copied, so the same coin can be sent twice. Earlier digital cash used a trusted bank to detect the second spend. Bitcoin emulates a public bulletin board of transactions without an operator, which is a consensus problem. Open networks make identities free, so Bitcoin counts majority by computing power and proves the work with a hash puzzle, finding $s$ such that $\Hash(s \| x)$ starts with $n$ zero bits.

The rest of the lecture gives the data structure and the incentives. Blocks are chained by hashes, transactions sit in a Merkle tree (a tree of hashes that condenses all transactions into one root) and the hardness retargets every 2016 blocks to hold the mean block interval near 10 minutes. Splits in the Chain (Forks) resolve by the longest chain, corrected to the strongest when difficulty varies, and payees wait 6 confirmations (six blocks added after the payment). New coins enter through a coinbase transaction (the first transaction in a block, which pays the miner) that halves every 210,000 blocks, capping the supply at 21 million Bitcoin (BTC). Miners are paid only for blocks the network accepts.

Study PlanWhat to Read, in Lecture Order

All sections are on the Chapter 6 page.

1. Chapter 6 §1: The double-spending problem. The bulletin board, the Sybil attack (one attacker creating many fake identities) and the move from majority of identities to majority of hash power.
2. §2: Design principles. eCash (an early bank-run digital cash system) to Bitcoin, the fixed 21 million supply, pseudonymity and the costs of having no regulator.
3. §3: Proof of work. The hash lottery, expected work $2^{n} \cdot \mathrm{TIME}(\Hash)$, verification in one hash and difficulty retargeting (resetting the puzzle hardness every 2016 blocks). The lab searches for a nonce (a number used once); the stage shows the losing attempts and the win.
4. §4: The blockchain. Hash links, Merkle trees (hash trees that condense many transactions into one root) and their logarithmic proofs, full validation, checkpoints (block hashes hardcoded in the client software) and BIPs (Bitcoin Improvement Proposals).
5. §5: Forks. The longest-chain rule, the fake-timestamp attack, the strongest-chain rule with block strength $2^{n}$ and the 6-confirmation recommendation. The lab runs a fork race.
6. §6: Rewards. The coinbase transaction (the first transaction in a block, which pays the miner), the halving schedule, the 21 million cap, fees and the invariant that an $\alpha$-fraction of hash power earns an $\alpha$-fraction of blocks.

PracticeExercises for This Lecture

• Expected hash evaluations at difficulty $n = 20$: the geometric mean of the lottery.
• The 21 million cap: summing the halving schedule.
• Strongest chain: 10 blocks at $n = 5$ against 8 blocks at $n = 8$.