After all, there are really only two cryptographic ideas in Bitcoin: One is to used public key cryptography and signatures for transactions, which is completely obvious. The other is to use hashing for proof-of-work to build the block chain. This is certainly less obvious, but it wasn't outlandishly new either. Ideas like hashcash have been around much longer than Bitcoin.
Putting it all together in this way with its appeal to the goldbug mindset was certainly clever. But you are seriously overestimating the amount of intelligence required for developing Bitcoin.
No way. Have you looked at the whitepaper? The entire thing? Even completely ignoring the clever leveraging of cryptography, the sheer genius behind the methodology of the protocol makes me think that someone(s) extremely talented came up with it.
>Ideas like hashcash have been around much longer than Bitcoin.
True, but much of the genius comes from the way transactions themselves work. Right now, we're only leveraging a small portion of Bitcoin's capabilities. Because Bitcoin is really based on scripts assigned a value, the Bitcoin protocol allows for incredibly complex economic interactions in a cryptographically secure manner. The deeper I look into the protocol, the more I realize how genius some of the design decisions were.
And besides, Bitcoin obviously did something right, because it's the only decentralized digital currency to take off.
>But you are seriously overestimating the amount of intelligence required for developing Bitcoin.
I think you're underestimating the elegance and complexity of the Bitcoin protocol. It's much, much more than a few crypto primitives strung together.
Amateurs can be talented. On the other hand, look at how the Bitcoin protocol is described and how its security is analyzed -- no formal definition of security properties, no formal threat model, analysis that is limited to a specific attack strategy, etc. The most talented person in the world cannot be expected to duplicate the decades of research on secure multiparty computation and digital cash single-handed.
For comparison, here is the work of a pair of talented (i.e. Turing award winning) cryptography researchers:
http://groups.csail.mit.edu/cis/pubs/shafi/1982-stoc.pdf
"And besides, Bitcoin obviously did something right, because it's the only decentralized digital currency to take off."
I think the vast majority of Bitcoin users know little about Bitcoin's security properties or what it means for Bitcoin to be "secure." The fact that a system is popular does not mean that the system is secure, even when the purpose of the system is to provide security. Caesar ciphers remain remarkably popular, despite the ease with which they can be cracked.
It is also worth pointing out the Bitcoin is pretty unique in not having a "bank." Most digital cash systems require that currency be issued by an authority of some kind, and seek only to decentralize transactions (i.e. allowing offline transactions). Being the only digital cash system without a bank that became popular is not as big of an achievement as you make it seem -- there was not much competition there to begin with.
Not this talented. And you are aware that it's likely that "Satoshi Nakamoto" was actually a team of programmers, right? You don't get that kind of collaboration with clueless college kids.
>no formal definition of security properties, no formal threat model, analysis that is limited to a specific attack strategy
Why would they do that? Nakamoto wasn't selling the bloody thing, he was sharing the idea. We, the developers, have done this independently after Nakamoto fell off the radar.
>I think the vast majority of Bitcoin users know little about Bitcoin's security properties or what it means for Bitcoin to be "secure."
Maybe in the last year or so, but before that, 90% of the Bitcoin community was well educated on cryptography, and most of the power users still are.
>The fact that a system is popular does not mean that the system is secure
You're leaving something important out; the system is popular and the system has not been defeated in any meaningful capacity. That is a strong indicator of security.
>It is also worth pointing out the Bitcoin is pretty unique in not having a "bank." Most digital cash systems require that currency be issued by an authority of some kind, and seek only to decentralize transactions (i.e. allowing offline transactions).
No kidding! That's the whole motivation behind Bitcoin in the first place.
>Being the only digital cash system without a bank that became popular is not as big of an achievement as you make it seem
Are you shitting me? This is by far one of the biggest achievements in applied computer science in the last 25 years. Do you have any comprehension of the sheer number of previously purely theoretical methodologies leveraged to make Bitcoin happen? I feel like you're kind of dismissing Bitcoin without really completely understanding it.
Why would they do that?"
So that we can determine whether or not the system is secure before we commit to it. Replacing insecure cryptosystems is usually very expensive.
"the system has not been defeated in any meaningful capacity. That is a strong indicator of security."
As far as the Germans knew, Enigma had not be broken in any "meaningful capacity" either. They knew there were weaknesses but they did not believe anyone would go to the lengths required to exploit those weaknesses:
https://en.wikipedia.org/wiki/TICOM
Saying "well it has not been broken yet (as far as we know)!" is not a very good argument for security. Even AES has better arguments for security, based on models and heuristics that took many decades of work to develop.
"This is by far one of the biggest achievements in applied computer science in the last 25 years"
More than CAT scans? More than the Internet? Even if we limit ourselves to cryptography, it is clear that that is untrue. What do you think sees more widespread use: Bitcoin, or Kerberos? What do you think had a wider impact on the world: Bitcoin, or HBO encrypting its satellite feeds (for those who are not familiar, that was a major step toward widespread DRM)?
Bitcoin as an application of cryptography or computer science is not even a blip on the radar of achievement.
Double spending in Bitcoin requires the attacker to do duplicate the work done by all honest parties in the system; that is basically a polynomial time attack. This is documented in the original Bitcoin paper. It falls short of the standard for security that cryptographers generally deal in, which requires that the attacker's work be exponential in the parameters of the system.
Again, I don't mean to be dismissive of outsiders -- at one time, Diffie and Hellman were outsiders. The question that was asked was what can be concluded about Satoshi's true identity; that he (they?) is not well-educated in cryptography seems like a reasonable conclusion given what he published.
Yes, it is. Cracking previous digital cash systems fell into the class of "hire a hacker" difficulty problems, which are significantly less difficult than the P difficulty problem presented by pulling off a 51% attack on the Bitcoin network.
>that he (they?) is not well-educated in cryptography seems like a reasonable conclusion given what he published.
Right, the person/group who published what may be the most significant usage case of applied cryptography in human history is probably not educated in cryptography. Have you even read the whitepaper? Perhaps you would change your tune if you saw what is actually being guaranteed. Nakamoto was perfectly aware of the challenges. When I say "Bitcoin is secure", that's by my standard, not Nakamoto's. I can't speak for him/them.
David Chaum would disagree with you. Cryptographers have published a very large volume of research on how to create provably secure digital cash.
"Right, the person/group who published what may be the most significant usage case of applied cryptography in human history is probably not educated in cryptography"
So you think that someone who made no mention of any of the widely studied notions of security, any of the previous work in multiparty computation, any of the previous work in digital cash, or even the fact that allowing polynomial time attackers is a significant weakness in the design was well-educated in cryptography?
"Have you even read the whitepaper?"
The Bitcoin whitepaper reads like the work of someone who took an undergrad course in cryptography and spent a summer thinking about decentralized payments. Where is the notion of security even clearly defined -- what does it even mean to prevent double spending? What does it mean to control "more CPU power" than an attacker?
Compare the Bitcoin paper to this (just a random result from Google):
http://eprint.iacr.org/2007/148.pdf
Look at how security is defined in Section 3.2; that is typical of cryptography research in this day and age. Those are definitions that can be reasoned about in a rigorous way, without hand waving, without poorly defined concepts like "CPU power," and without having to analyze any specific attack strategy (i.e. the attacker is a "black box"). Where in the Bitcoin whitepaper do you see that sort of analysis, or even a hint that such an analysis is possible, desirable, or commonly used?
The security analysis presented in the Bitcoin whitepaper assumes a specific attack strategy: the attacker will try to compute a longer block chain than the rest of the network. Ignoring for the moment that this can be done in polynomial time, what reason is there to believe that no other attack strategy is possible? Maybe the attacker can adaptively send malicious messages to particular nodes in the network to break the security of the system. In multiparty computation, security analysis is usually based on the "simulation paradigm" -- a model of security based on showing that no polynomial time attack has a higher probability of success in the real protocol as it would in a simulation of the real protocol where a trusted party does all the work (which rules out all polynomial time attacks). That is a widely accepted notion of security, and the cryptographers who first published it recently won a Turing award; while other models may be valid, one would have expected an experienced cryptographer to have at least mentioned that they were using a different model (and perhaps justify their approach).
The whitepaper also includes statements that suggest a profound lack of knowledge of the decades of previous work in the field of digital cash. There are claims that no system with a central authority can possibly allow irreversible transactions, but that is untrue -- cryptographers discovered systems that support offline payments, in a model where the bank takes some action when double spending is detected (and in some systems, the bank can produce a proof that double spending occurred and that it was performed by a specific party, allowing for a trustworthy blacklist). Privacy is mentioned, and again the author makes claims about systems with central authorities that are simply not true -- Chaum's original work on digital cash was motivated by the need for private electronic payments, and that was the first problem to be solved in this field.
"When I say "Bitcoin is secure", that's by my standard"
What is your standard, and why should anyone else accept it?
You're kidding, right? Bitcoin is the single most impressive application of cryptography that I have ever seen in my entire life, and I get to look at a lot of cool cryptosystems. The only entity that could have created Bitcoin is some kind of savant or a group of very talented people.
>ECDSA and SHA256 are referenced but little is said about whether or not they compose securely with the Bitcoin protocol, or even if the Bitcoin protocol itself is secure.
By making only a few basic assumptions about the security of SHA, RIPEMD, and ECDSA, it's plainly obvious to anyone who remotely understands the protocol that the protocol is, in fact, secure. If you don't believe me personally, why don't you ask all the talented cryptographers who could lay their hands on over a billion dollars if they found a critical flaw in the Bitcoin protocol?
>(though Bitcoin is not secure under the security notions used by cryptographers)
You have no idea what you're talking about. Bitcoin makes very strict security guarantees and does not violate them.