BIP39 passphrases have weaknesses that are often overlooked, including:

(1) Combination of secrets: The private key and passphrase must be combined in a single location for every single spend.

(2) Exposure of secret: The passphrase must be manually entered for every single spend.

In terms of security, requirement (2) is particularly unique. Unlike seed phrases or private keys, passphrases must be frequently entered, exposing them to the outside world.

As an example of how this weakness could be exploited: Recent advancements in AI technology have reached a point where WiFi routers can now be utilized as motion trackers, as demonstrated in a recent study. In a similar vein, researchers have shown that the sounds of keystrokes recorded over Zoom could reveal what you typed with 93% accuracy. What this means is that in the future, any electronic signal-rich environment could potentially capture passphrase inputs.

Attackers may not need to learn all characters of a passphrase; even partial knowledge or the length alone can provide clues for cracking it.

To summarize this problem:

• Keeping a secret is most effective when it is exposed to the environment as little as possible.
• BIP39 passphrases are designed to be frequently exposed.

This contradiction creates a significant attack vector that cannot be ignored. The problem already exists without AI, but with AI, it becomes an even more substantial concern.

Other weaknesses of passphrases include:

• The lack of standardized key lengths often leads to users employing weak or non-random passphrases, making them susceptible to brute-forcing.
• The absence of a checksum leaves no room for error when it comes to memorization or when sharing access for inheritance purposes.
• The need to combine the private key and the passphrase for each spend means that attackers can time when these secrets are brought together to gain access to both secrets. They can even lure victims into combining them, such as by pretending to offer high-value goods in exchange for bitcoins.
• The introduction of a passphrase might create a false sense of security and cause the users to be more lax in securing the seed phrase (e.g. making multiple copies of it).

Most critically, passphrases represent single points of failure. Instances of users being locked out of their wallets due to forgotten passphrases have been, and will continue to be common as long as passphrases are promoted without sufficient guidance and warnings.

To make matters worse, certain hardware vendors offer products without protection against physical threats, by not including Secure Elements in their designs. To compensate for this lack of security, these vendors often promote the reliance on passphrases.

However, this approach does not provide a genuine solution but merely shifts the burden of security and key management onto end users, leaving them to fend for themselves.

Conclusion

While the scenario of AI targeting Bitcoin users may seem far-fetched, attacks on Bitcoin users will undoubtedly become increasingly sophisticated. Recent incidents, such as the wave of SIM swap attacks, serve as reminders.

Passphrases have inherent weaknesses that make them ill-suited for an adversarial environment and the future of Bitcoin custody.

Disclaimer: This essay contains my personal opinions and deductions.

When it comes to cryptocurrencies, my main interest lies in Bitcoin, not “blockchains”. The blockchain hype has been blown so out of proportions in the last few years that it immediately brings to mind the fresh memory of the Dotcom era and other bubbles in the past. When things that make zero sense on multiple fronts start reaching billion-dollar valuations and everyone around you is shouting “FOMO!”, it should bother you deeply.

To be clear, I can imagine a future where a few select digital assets will co-exist with Bitcoin. It is not out of the realm of possibilities. Nevertheless, when it comes to having an impact, Bitcoin will likely dwarf everything else for reasons that I will expand on below.

I have also written about the infeasibility of projects such as Ethereum, Proof-of-Stake, utility tokens, NFTs, etc. but these will not be the topic of this essay.

So what’s the big idea? Fundamentally, I believe that Bitcoin will help us co-operate much more efficiently at scale, and change the way we organize society. In other words, Bitcoin will raise our “Dunbar level”.

What is a Dunbar level? How is it relevant to Bitcoin? Time for some stories.

Chapter 1: Columbus vs. the Ming Dynasty

For many born in this day and age, it is often taken for granted that the West is the more dominant power of the world. The West is relatively richer per capita, more developed and more technologically-advanced than the East. The East was only able to slowly catch up when it opened itself up to Western ideas and philosophies. This started with Japan during the Meiji era in the late 19th century (led in particular by thinkers like Fukuzawa), followed by the four Asian tigers (South Korea, Taiwan, Singapore and Hong Kong) in the second half of the 20th century. In the last and current wave, it has been China, Vietnam and Southeast Asia driving the growth. We don’t have to look very far for evidences. Just look around in our daily life: anything that brings material improvement to our standard of living — such as the Internet, smartphones, automobiles, air conditioners, self-cleaning toilets — they all have deep Western imprints.

Yet, this wasn’t always the case. For thousands of years, the East, particularly China, was at the peak of civilization.

Long before Columbus “discovered” America, the Ming dynasty commanded Admiral (and eunuch) Zheng He to take to the sea and discover what lay beyond the horizon. These Chinese voyages featured hundreds of ships and tens of thousands of troops, with the largest ships measured up to 500–600 feet long. These ships were 10 times bigger than the ships that Columbus later commanded. The Chinese expeditions reached lands far and away, including pretty much all of Southeast Asia, the Indian Ocean, the Persian Gulf and the coast of eastern Africa. Glamorous was an understatement.

Yet in many ways these expeditions were a failure, especially when compared to the European ones that changed the fate of the world a century later. There were a couple of reasons as to why.

First, the main purpose of the Chinese expeditions was to show off the strength and glory of the Chinese empire, and to collect tributes from foreign lands. But the exotic tributes alone could not cover all the costs. Second, these oversized (and high-maintenance) ships were not a good fit for sea commerce. What that meant was that these voyages had little commercial value. For these reasons, when times turned bad the Ming had to shut them down to focus on the Mongol threat up North.

But what the Zheng He voyages demonstrated was that the power of the Chinese empire was unmatched during those times. In any era, the discovery of new territories perhaps only reflects one aspect of society, but these expeditions and discoveries are a great proxy for approximating the wealth and the level of technology of said society. The Zheng He expeditions were not unlike how NASA, CSNA, SpaceX, or BlueOrigin are vying for space dominance today. Only the most powerful and technologically-advanced entities on Earth can afford these kinds of endeavors.

Up until the 19th century, China was still the largest economy in the world, their GDP was approximated to be a third of global GDP. China invented the compass, paper, printing and gunpowder. (Chinese porcelains, once considered “white gold”, were so advanced that it took Europeans a few centuries to be able to copy their manufacturing techniques.) Just imagine what would have happened if those early Zheng He expeditions had a different, conquering-leaning mindset, combined perhaps with the use of gunpowder, we would perhaps be living in a totally different reality. As it turned out, it was the West that used gunpowder on China first, a few centuries later.

But China’s dominance started to fade back around 400 years ago. What was the main reason for this decline? Or perhaps more accurately, what enabled the West to leap-frog the East during these 400 years?

Chapter 2: The Power and Limit of Belief Systems

If you have read Harari’s Sapiens, you have heard of “Dunbar’s number”. Due to our cognitive limit, humans can only maintain around 150 stable social relationships per person. This number was proposed by the British anthropologist Robin Dunbar in the 1990s, who “found a correlation between primate brain size and average social group size.”

It is worth noting that the exact number probably varies depending on the person and circumstances, but the theory is likely directionally correct.

I want to take the liberty here to expand on this concept and very roughly define “Dunbar levels”: the idea is that certain tools will help humans become better at cooperation games, and each one of those tools likely has a limit [1] in terms of (a) how many people it can help cooperate and (b) how well it does so. These are Dunbar levels. As we create better tools for co-operation, we “level up”, so to speak. [2]

For humans to go beyond the initial Dunbar limit (level 1) and organize ourselves into larger groups, there needs to be some special forces that can unite strangers. Otherwise, we would still be living in small tribes.

Religion was such a force.

Religion was the first human invention that enabled thousands, millions of people to share a common outlook on life and “march to the same drum”, so to speak. They can go even as far as dying for their belief. Before religion, uniting groups of humans in such a way was impossible.

By the 11th century, Christianity has spread to all corners of Europe. The Kings of the Middle Ages, as powerful as they were, were second to the Church. At the peak of their power, it was the Pope that crowned kings and emperors. The center of power of Europe wasn’t in England, France or Spain. It was Vatican city.

In the East, it was Confucianism that played a similar role.

From the Han dynasty (206 BCE–220 CE), Confucianism became the central piece of organized Eastern societies. Thanks to Confucianism, the state doesn’t have to intervene in their subjects’ daily life, and let them self-regulate instead.

Confucianism was how people in the East overcame the Dunbar limit, by sharing a set of common beliefs and self-organized themselves into various professions and classes that made up the feudal Eastern societies.

Both Christianity and Confucianism were incredibly powerful at uniting people, capable of creating highly complex social structures, but at the same time, they held back our ancestors.

Christianity put the words of God above all else. Everything in life must follow the Bible to the letter. If the Bible said that Earth is the center of the universe, then that is an undeniable truth. If the Bible said that sinners shall be stoned or burned to death, so be it.

Confucianism, on the other hand, over-emphasizes harmony and the role of humans in maintaining harmony. “Let the prince be a prince, the minister a minister, the father a father and the son a son.“ Confucians tend to think that every person is born with a clearly-defined role in life, with little room for deviation. Confucians take the natural world as it is, not something to be explored or understood but something to make peace with. It elevates the mind, and downplays what the eyes and the ears see and hear, because Confucianism in essence put humans at the center of its philosophy, not nature. Confucianism also doesn’t encourage thinking outside-the-box as it would disrupt harmony and endanger the social order. In short, Confucianism is a highly constrained, oppressive thinking system.

The major changes in Europe started with Copernicus and Galileo. They were the first people that dared to go against the words of the Church, claiming that Earth was not the center of the universe. Together with the invention of the Gutenberg’s press in the 15th century, the spread of knowledge through books, the inspirations from Columbus travels, all these events slowly changed people’s perception of life. These seeds laid the foundation for the scientific revolution, which brought fourth an era of great discoveries. Since the scientific method was invented, people became less and less reliant on religion. Instead of blindly following the words of some religious texts, people honed their observation skills to find hidden secrets of the natural world.

So now we can answer the question in the first story: the reason the West was able to leap-frog the East was because the West was able to lose the shackles of their earlier belief system — Christianity — while the East was unable to do the same for theirs — Confucianism.

Through this story we can see that belief systems are double-edged swords. They often have the power to unite, but they can also be oppressive and hold back progress.

If the belief systems steer us to truly better things in life (for examples: don’t kill, don’t steal), society will likely be better off in the long run. But if they stop us from advancing our understanding of the world, we can stop progressing or even decline.

Chapter 3: The Dollar Religion

Christianity and Confucianism were some of the earliest belief systems that helped us overcome the Dunbar limit.

But there is a belief system even stronger than religion, and that is money.

To borrow Harari’s words:

“Money is more open-minded than language, state laws, cultural codes, religious beliefs and social habits. Money is the only trust system created by humans that can bridge almost any cultural gap, and that does not discriminate on the basis of religion, gender, race, age or sexual orientation.”

Thanks to money, any two strangers — no matter how far apart or how culturally different — can trade with one another. Thanks to money, we can have markets and vibrant economies. Thanks to money, we can create abstract economic concepts such as corporations and shareholders. Thanks to money, a society of hundreds of millions can operate smoothly.

For most of money’s history, gold was king. Humans have been fascinated with and have been collecting gold going back as far as 5,000 years ago. But the dollar has replaced gold as the world’s number one currency in the 20th century. And this has been entirely due to the two world wars and the unique geography of the United States.

The US spent much of the 19th century expanding its territories. When war broke out across the Atlantic at the turn of the 20th century, the US had consolidated much of its land mass and owned both the coast lines of North America, ultimately acquiring natural shields on both sides. As a result of this, the United States was by far the least damaged industrialized country during WW1 and WW2.

Not only it was least effected, it benefited greatly from the wars. Before WW1, the US was just one of many powers on the world stage. During the wars, it supplied weapons and goods to the participating countries. It adjusted its industrial base to the demands of the wars. It gave out loans and became an increasingly large creditor. Slowly but surely, the wealth of the entire world gravitated towards the US.

This trend culminated post-WW2: the US at that point had possession of more than half of the world’s gold reserve (some figures said up to 75%). At the same time, the rest of the world had been badly destroyed and currencies from former imperial powers lost much of their values. Under this environment, the Bretton Woods agreement came into place in 1944, officially making the US dollar the world’s reserve currency. At the time, the dollar was still pegged to gold. Owning the dollar was indirectly owning gold.

But everything changed again in 1971. The US, ensnared in Vietnam, became heavily indebted and financially strained from both the war and LBJ’s Great Society programs. Then US president Nixon made one of the most pivotal decisions in modern history by unilaterally ending the Bretton Woods system, removing the gold peg and floating the dollar. The dollar’s long 200-year relationship with gold officially ended in 1971.

(The role of gold in US history was deemed so important that the US founders added a “Gold & Silver” clause to the Constitution in 1787.)

Connecting the dots, we can come to this conclusion: it was war that propelled the US and the US dollar into dominance, and it was again war that indirectly helped create the global financial system that we know of today. [3]

Since 1971, the total supply of the dollar is controlled by a cabal known as the US Federal Reserve. Instead of anchoring our universal exchange value in a neutral, scarce and unforgeable metal like gold, we have turned to trust this small group of people.

We can also say that since 1971, the dollar became a full-fledged religion. Just like Christianity, the dollar has its gospel (the dual mandate), its churches (the central banks), its missionaries and enforcers (mainstream economists and politicians), and its Popes (the Chairmen of the Federal Reserve).

The fact that we are willing to trust the dollar is not unlike how people in the Middle Ages believed that the earth was the center of the universe. We believe in it purely because other people do, too.

The power of the Federal Reserve is as far-reaching as it was for Vatican city. Markets around the world collectively hold their breath whenever the Fed makes policy announcements. The Fed sneezes and the world catches a cold.

And just like Christianity, the dollar has great oppressive power.

Along with the rise of the dollar, the US became the “policeman” of global economic activities.

The fact that most international payments are denominated in dollar means that the US has discretionary power to intercept and interrupt the flows of global economic activities, even activities that have nothing to do with the US. This is the basis of the US sanction system.

The primary ways the US achieves sanctions are through Chips (the US Clearing House Interbank Payments System) and indirectly through SWIFT (the Society for Worldwide Interbank Financial Telecommunication). Chips processes about $1.5 trillion a day and has a 96% market share on large-value domestic and international USD payments. SWIFT does not settle transactions but it is a communication network that connects 11,000 global banks, and is heavily controlled by the US.

In recent years, especially after 9/11, the US has ramped up its sanctioning activities. This angered many countries, including Russia, China, and even the US’s own allies. When President Trump started imposing sanctions on Iran, the EU encouraged its members to maintain economic ties with Iran. In 2019, England, France and Germany briefly set up a vehicle called INSTEX to skirt around US sanctions, but ultimately failed. The US’s control of the global financial machinery was simply too powerful.

As we speak, the EU, Russia and China are all actively finding ways to promote their own currencies and to become independent of the dollar.

The sanctions on Iran are a prime example of how a centralized currency system can become oppressive. Without such a system in place, there could have been billions of value created through trade, but the US single-handedly stopped this from happening, against many countries’ wishes.

If we stop and think about it, the mere concept of sanction is bizarre. How does one single country, out of almost 200 countries in the world, put another country into total economic isolation? This would only be possible if that country has complete control over economic flows of all other countries. If the world is a village, then the US must be the village’s biggest bully.

An even bigger problem with a state-issued currency is the threat of inflation and hyperinflation.

The blind trust that people place in state-issued currencies makes it easy for the state to abuse that trust and print money irresponsibly. Throughout history, there has been many state-issued currencies that experienced hyperinflation. This was the case for the currencies of the Roman Empire, the Tang dynasty and the Ming dynasty. More recently, it was Argentina, Venezuela, Zimbabwe and Turkey.

When a currency hyper-inflates, it causes major long-term structural problems. First, it kills trust and wreaks havoc on the economy. Second, it fuels deep-seated conflicts, which could turn violent quickly (some historians suggested that Roman currency debasement was the primary cause of their civil wars and eventual collapse). Third, it massively increases wealth inequality, as the upper classes typically have more means at their disposal to hedge the impact of inflation, such as parking their wealth in rare commodities or real estate.

It wasn’t a coincidence that global wealth inequality has accelerated sharply since 1971. The level of wealth inequality today is the worst it has been in a few centuries, going back to the Middle Ages. High wealth inequality causes a lot of social friction and the reason why so many have taken to the street in protests across many countries.

More than 20% of all dollars in circulation were printed in 2020, which was unprecedented. Inflation pressures in 2021 can now be observed everywhere across the board, from the prices of gas to vegetables to construction materials.

Whether the fiat dollar — a currency with merely 50 years of history — can survive or it is fated to inflate itself out of existence, we will have to wait and see. But past evidences are not encouraging.

Chapter 4: Bitcoin’s Mission

Bitcoin has great potential because it can become a better currency standard than both gold and the dollar.

Bitcoin is better than the dollar because similar to gold, it is not controlled by anyone, and truly scarce. The Bitcoin supply is fixed at 21 million and cannot be arbitrarily changed.

Bitcoin is better than gold because it is digital and inherits all the properties of digital things, such as moving at the speed of light, efficient storage, etc. The costs associated with transportation, storage, as well as verifying the authenticity of gold are extremely high. For these reasons, gold ownership has historically been susceptible to improper confiscation. In contrast, Bitcoin is easy to store and transport, and its authenticity can be verified cheaply. Bitcoin is a perfect fit for the Internet economy because just like the Internet, it is borderless.

Bitcoin is similar to gold in the sense that they are both unforgeably costly, and they are ultimately backed by energy. Gold atoms were created billions of years ago during the collision of neutron stars — this is gold’s “Proof-of-Work”. Because of the enormous amount of energy required to create or synthesize gold, gold is hard to fake. In the same way, to create fake bitcoin would require an amount of energy so large that it would be impossible to go unnoticed if any person or group ever attempts to do so.

With all that said, Bitcoin is not perfect. Bitcoin has a relatively short history compared to gold, which has been tested through many millennia. The decentralization properties of Bitcoin, which are needed to maintain its neutrality, are relative, and can change with time. Bitcoin requires continual vigilance from its participants (developers, users, businesses, exchanges and miners) to ensure that the system stays open and permission-less.

So far, Bitcoin has been positively moving in this direction, improving its decentralization and resilience metrics over time.

Early in Bitcoin’s history, mining was concentrated in China, but now it has completely moved out of China and spread to other countries. Self-custody is another area that has seen major improvements. Early on, the majority of bitcoin were held on a few exchanges, but the options for safe self-custody are rapidly expanding, which will make the system more robust in the long run.

Bitcoin’s biggest test came in 2017, when a significant faction of the network, comprised of some of the biggest Bitcoin businesses and ~80% of total mining power, wanted to force a rule change onto the Bitcoin protocol that would weaken decentralization. Yet they failed spectacularly and would serve as a major deterrent to future take-over attempts.

Bitcoin is the only software network that has a 99.99% uptime since its inception. In its short history, it has already served as a lifeboat for so many people around the world who live under totalitarian regimes, war-torn countries or economic sanctions.

When it comes to the future of money, no other blockchain project can even come close to Bitcoin’s network effects and strengths.

Conclusion

The reason humans are at the top of the food chain is because of our ability to co-operate with one another. Without special tools that unite people and improve our co-operation skills, we could only live in small tribes of a few hundred people. This is the Dunbar limit.

Religion and belief systems in general were the first human inventions that allowed us to break the Dunbar limit. Christianity played this role in the West, while Confucianism did the same in the East. While incredibly powerful, belief systems can also be oppressive and hold back progress.

Money is also a belief system. The unifying force of money is even stronger than that of religion. Thanks to money, we can exchange goods and services with people we have never met. But similar to religion, a currency operated purely based on belief and controlled by a small group of people can create an oppressive financial environment. The US and the dollar rose to dominance in the 20th century, but since Nixon unilaterally ended the Bretton Woods system in 1971, the US has increasingly turned the dollar into a financial weapon.

Bitcoin has great potential to change the world because it is superior to gold and the dollar in many aspects. Bitcoin is apolitical money, and does not discriminate. Bitcoin gives us an anchor of value in a world that has lost its sense of values. If successful, Bitcoin will help us co-operate much more efficiently at scale, remove gate-keepers, unlock frictionless commerce, and bring wealth and prosperity to large populations of the world.

[1] For example, Bitcoin probably will not work inter-planetary if the distance is too large.

[2] Nick Szabo called it “Social Scability” and expertly argued how Bitcoin improves social scalability. This essay has been influenced by Szabo’s writings.

[3] The relationship between war and money is a two-way street.

Alice: This year sucks. You know what’s almost as bad as 2020?

Bob: Yeah?

Alice: Multisig is still scary.

Nunchuk: Hold my beer.

It’s somewhat ironic that for a technology that reveres decentralization as its central operating principle, Bitcoin still heavily relies on single point of failure as the dominant method of ownership. This despite the fact that the unique risk profile of digital assets desperately calls against such a practice.

The highest barriers are technical challenges. Multisig is not for the faint of heart. Many pitfalls await around the corner.

Did you back up all your seeds? Do you need seeds? Are you sure the signing devices use the same derivation path? What about that change address? What do you mean you lost your device in a boating accident? Oops, some vendor has just made an update that bricks my setup.

And the list goes on.

What if we tell you you don’t have to worry about any of this anymore. What if there’s something. THAT. JUST. WORKS.

Say hello to Nunchuk. The app that makes multisig feel like a walk in the park.

But before we talk about features, let’s talk about design philosophy.

If we were to design a multisig wallet today, what should our goals be?

Our answer:

• It must be secure.
• It must be seamless.
• It must be future-proof.
• It must go above and beyond to empower the user.

Let’s see how Nunchuk meets these goals.

1. It must be secure.

Security starts by knowing our limits. We defer to specialists in the most security-sensitive areas.

That means delegating the task of managing private keys to single-purpose hardware.

That means sticking close to Bitcoin Core for consensus code, for standardness rules, for future upgrades. That means avoiding reinventing the wheel in Bitcoin-specific areas.

That also means ruthlessly cutting down on the number of software dependencies, because each dependency is a potential attack surface. That means going with the desktop first and not the browser. That means outside of Core, only using battle-tested software. We can’t completely eliminate all attack surfaces. But we can minimize them.

2. It must be seamless.

Going from a single signer to multiple signers necessarily requires some level of friction. The goal is to avoid further friction in every other part of the multisig process.

In the early days of Bitcoin, wallet vendors were often incompatible with one another, which complicated multisig setups. On this front, there have been great developments in the last few years, notably PSBT and the descriptor language. Both have greatly improved the ecosytem’s interoperability.

Nunchuk treats descriptors and PSBTs as first-class citizens. The consequence of this is that you can use Nunchuk with many different hardware vendors, or easily recover a multisig wallet created by Nunchuk on other wallet software such as Core.

Being seamless also means the ability to switch between singlesig and multisig use cases.

Nunchuk introduces a third type of wallet: an Escrow. It is a one-time-use multisig wallet specially created for the purpose of holding funds temporarily. With Nunchuk, you can easily move funds among these three types of wallets.

3. It must be future-proof.

It would be a shame if we design a brand new multisig solution, only for it to get outdated quickly by tomorrow’s protocol changes. Many multisig solutions in the past no longer serve us well, because they were designed at a time when tools were lacking, and ended up being needlessly complex. Multisig is bound to evolve further in the coming years.

Because Nunchuk stays close to Core code, it can immediately reap all the benefits of future protocol upgrades.

When Taproot is ready, Nunchuk is ready.

4. It must go above and beyond to empower the user.

Last but not least, we want to offer the user granular control over their wallet, and most importantly, their privacy. That’s why we invested time and effort to add support for things like coin control, replace-by-fee, personal server, TOR support, among others. The reason is simple: we ourselves are users of multisig. If someone else designs this app, these features would be high on our wish list.

That, in a nutshell, is Nunchuk.

Nunchuk’s mission is to make multisig the gold standard — no pun intended — for owning Bitcoin.

Nunchuk beta is now available for download at nunchuk.io. We look forward to hearing your feedback.

Keep stacking.

In its 3+ years of existence, Ethereum has had no shortage of controversies. From the DAO hack, to the long-anticipated transition to Proof-of-Stake, to the Constantinople upgrade that reduces mining reward and changes the inflation schedule on-the-fly (not that Ethereum had a clear one to begin with). Ethereum’s culture seems to be diametrically opposed to Bitcoin’s. Everything that Bitcoin shuns, Ethereum loves to embrace.

If one were to ignore all the noise and dig under the hood, one would find that Ethereum’s #1 problem is not a problem of product-market-fit but one of engineering soundness. Ethereum architecture is based on a flawed and unscalable idea: it assumes that “smart contracts” need computations to be replicated on thousands and thousands of machines.

The rest of this article explains why. It was originally a tweet storm, now converted to blog format.

Bitcoin is no magic. It sacrifices all manners of efficiencies, which goes against our intuition and “best practices”, in order to give us something special.

Bitcoin is specifically inefficient in 2 dimensions:

• It mandates that rate of blocks produced must be slow
• It uses broadcast communication

To highlight how counter-intuitive this is. How often do you:

• Purposely make a job slower, even if you figured out a way to make it faster?
• Tell everyone you know about every single thing that you did, every minute of the day?

To do this in a network setting is even more insane. Not only you are slow, everyone else must be slow. Not only you scream at everybody, everybody screams at everybody else.

Furthermore, this network has hundreds of thousands of members. If you have a giant insane asylum in mind, you have the right mental image.

Doing things the Bitcoin’s ways is literally insane, in most contexts.

It turns out that being maximally inefficient has its advantages. By intentionally forcing things to be slow, Bitcoin makes it costly to cheat. By using broadcast communication, it minimizes the need to trust individual members (or maximize fault-tolerance, in computer science terms).

By doing both, slow blocks and broadcast communication, Bitcoin solves the Byzantine Generals’ Problem. A huge breakthrough in computer science.

But doing things Bitcoin’s ways comes at a heavy cost. It walks a thin line between brilliance and uselessness. Blockchain systems work well as long as the data flowing through them grow at a manageable rate.

A data growth rate of anything but linear is unsustainable, and a certain death sentence. Non-linear data growth will quickly kill the individual nodes one-by-one, and inevitably revert the system back to a less trust-minimized model.

As blockchain systems are already maximally inefficient, there is little to fall back on if the data grows too quickly. Blockchain systems, as they are, tread on very thin ice.

So when it comes to blockchain data, you need to be ruthlessly efficient. This is to compensate for being maximally inefficient in areas mentioned above.

This is precisely why Ethereum’s architecture of “rich statefulness” is such a bad idea. Ethereum states are needed purely for computation purposes, but they grow at an unmanageable rate.

Ethereum’s design deciscions are even more questionable when the reasons for embracing rich states at the core layer are vague and dubious.

To simulate Turing-completeness? There can be no real Turing-completeness on the blockchains as all programs must somehow be halted. So “Turing-complete” is a total gimmick. Vitalik himself admitted to this.

To make programmable smart contracts easier to write? Ease of use is the least of your worries when it comes to blockchain engineering. Backward priorities. Remember, with blockchains you’re already treading thin ice, without adding rich states.

So why? To support computations otherwise not possible with Bitcoin-style scripting alone? Not really. Any computations that can be done with Ethereum smart contracts can be done on Bitcoin, just at a higher layer.

And this is the crux of the problem. Ethereum is solving problems at the wrong layer and by doing so, needlessly bloating its core design.

Kicking the can down the road and hope difficult problems resolve by themselves is not a solution either. Sharding is not the solution, as sharding implies scaling down the level of broadcast communication — which is a feature in the context of blockchains, not a bug!

Pinning all hope on sharding as the magical cure-all typifies Ethereum’s attitude towards engineering: Hopium.

Ethereum’s problems are even more serious if you consider that Bitcoin, despite it being extremely conservative towards the type of data and growth of data it handles, still has very real chance of failure. IMHO, Bitcoin is very much still an experiment.

If you’ve read my recent article on Bitcoin’s incentive-scheme, you’ll notice that I’ve left a few questions open-ended which I still don’t know the answers to. I’m optimistic on Bitcoin, but cautiously optimistic.

To recap: Bitcoin is already stretching things to the limits to get something useful. Despite this its success is not guaranteed. Ethereum stretches things out much further, without having good justifications. Ethereum’s architecture is flawed from the get-go for this reason.

A few more words on the engineering side of things. The story of Ethereum is actually not uncommon. We’ve seen this movie before:

• RISC vs. CISC in the 70s
• Linux vs. Windows in the 90s

In these episodes we’ve learned that hardware and software work best when they are built as modular, simple layers, exemplified by RISC and Linux (another example is TCP/IP). The reason is that these systems tend to be more flexible, more elegant and can adapt easier to changing environments / use cases.

This insight is immortalized in the Unix design philosophy: “Flexibility, simplicity, and freedom are the foremost considerations”.

The Unix design philosophy also gets a vote of confidence from nature. Ant colonies exhibit emergent intelligence even though individually the ants are dumb and highly specialized. Similarly, our brain is composed of simple neurons that individually perform simple tasks.

Ethereum’s kitchen-sink approach at the core layer bears resemblance to the idea of a complex instruction set. Or the idea of building software out of big, complex components, instead of smaller and more specialized ones. Complexity for complexity’s sake, not through emergence.

In summary, Ethereum has questionable design decisions without strong justifications for them. We’ve also seen similar engineering mistakes to Ethereum before. My guess is that Ethereum will eventually be another lesson of what-not-to-dos in the history book.

Notes

• I use “blockchain systems” to refer to Bitcoin-like blockchains that are based on Proof-of-Work.
• Additional reading: Gregory Maxwell explained verification-not-computation here. Below is a snippet.

Bob McElrath also described the problem here.

Ten years ago today Satoshi Nakamoto immortalized these words by embedding them in Bitcoin’s very first block — the genesis block. They are a solemn reminder of the unfair and broken system we all live under, and likely the reason Satoshi created Bitcoin in the first place: to wrest control of money back from governments and central bankers [1].

The last 10 years has been nothing short of a miracle. The Bitcoin network has been up 24/7, boasting an impressive record of 99.98% uptime [2]. What is most amazing is that Bitcoin achieved this without anyone being in control.

Bitcoin is a unique invention because it uproots the very foundation of our society: it redefines money. Money, together with language, are considered the 2 most important tools we humans use to cooperate and build civilizations.

My personal journey into Bitcoin has also been extremely rewarding. Very few things are as intellectually stimulating as Bitcoin. Grokking Bitcoin means going down the rabbit hole that is finance, money, history, economics, computer science and biology. It means retracing the footsteps of giants such as Cardano, Pascal, Turing, Plato & Aristotle, Locke, Hume, Adam Smith, Nash, Kahneman & Tversky, Darwin, John Maynard Smith, Dawkins, Diffie, Hellman & Merkle, Szabo, to name a few. It means asking fundamental questions about the nature of the world we live in — much of which we often take for granted.

Over the last several months I have written a series of articles — which I have called the Bitcoin Fundamentals series. My goal is to go down the rabbit hole as far as I could, to see what Bitcoin is really made of.

Writing these concepts down also forces me to articulate my thinking and helps my understanding of Bitcoin. I hope they will help others as well. The rest of this article will sum up what we have learned in the series.

Full index of the series:

• Part 1 - The Anatomy of Proof-of-Work
• Part 2 - Bitcoin, Chance and Randomness
• Part 3 - How Cryptography Redefines Private Property
• Part 4 - Bitcoin’s Incentive Scheme and the Rational Individual
• Part 5 - Bitcoin: Two Parts Math, One Part Biology (this article)

The three sublayers of Bitcoin

Bitcoin is composed of 3 fundamental building blocks:

(i) Randomness-based Proof-of-Work

(ii) Public-key cryptography

(iii) Incentive scheme

If we consider Bitcoin as a base layer upon which further layers can be built upon (such as the Lightning Network, TumbleBit or sidechains), then these building blocks can be viewed as sublayers within the base layer.

There is an implicit hierarchy among these sublayers. That is:

Sublayer 1: Proof-of-Work (PoW) forms the first sublayer. PoW approximates energy burnt and is the bridge between the digital world and the physical world. PoW gives digital blocks — which are just strings of 1s and 0s — real-world significance. With PoW, the Bitcoin ledger becomes an unforgeable and costly asset, with real weight behind it.

Sublayer 2: Public-key cryptography (PKC) forms the second sublayer. If PoW enables a new digital asset, then PKC and specifically digital signatures “tokenize” that asset, chopping it into pieces. Individuals can then store these pieces privately and exchange them with each other.

Sublayer 3: Finally, Bitcoin’s incentive scheme forms the third sublayer, which sustains the system created by sublayers 1 and 2. Bitcoin is a dynamic network. It resembles a living organism whose heart beats roughly every 10 minutes. Bitcoin’s incentive scheme provides the engine for this heartbeat, and is built on the token natively generated by sublayer 2.

Sublayer 2 wouldn’t matter without sublayer 1. Sublayer 3 wouldn’t matter without sublayers 1 and 2.

These sublayers together form the three-legged stool that is the foundation of the entire Bitcoin ecosystem. [3][4]

Two Parts Math, One Part Biology

From the exploration in the series, we have also learned that under the hood:

• Randomness-based PoW is based on math
• Public-key cryptography is also based on math
• Incentive scheme is based on human behavior

It can be said then, that Bitcoin is two parts math, one part biology.

It’s worth noting that both randomness-based PoW and PKC rely on the same mathematical concept underneath, namely one-way function, but they form very distinct parts of the system. PoW creates the digital asset, while PKC tokenizes it.

The third sublayer of Bitcoin, incentive scheme, is arguably Bitcoin’s weakest link. Unlike the first 2 sublayers, it relies on human behavior, which is less consistent and rigorous than mathematical principles. Human behavior exhibits bounded rationality, which is coded at the gene level, but imperfect. Humans are prone to miscalculations and occasional irrational behavior.

It remains to be seen whether Bitcoin’s incentive scheme would be strong enough to hold the network together for the long term.

Final Words

I would like to close out the series by saying that in no way does this constitute a complete understanding of Bitcoin. But I hope it will serve as a good starting point for someone who is new to Bitcoin. Some of the content in this series are my own personal opinions. The reader would do well to do his or her own research and form their own opinions. “Don’t trust, verify” works equally well in Bitcoin and in learning.

Acknowledgements

Special thanks to Nic Carter, Steve Lee, Jimmy Song, Hasu, Murad Mahmudov and Dan Held for their extremely valuable feedback in the writing of this series.

[1] The genesis message also doubled as proof that Satoshi did not unfairly premine before January 3rd, 2009.

[2] Bitcoin has experienced a dozen hours of “downtime”: a combined total of 77 blocks where the network accidentally split, from 2 incidents in 2010 and 2013. This record is as impressive if not better than that of AWS, Google Cloud and Microsoft Azure.

[3] The term “cryptocurrency” derives from the use of public-key cryptography (sublayer 2), which ironically captures only one of many crucial aspects of this technology.

[4] These are the high-level building blocks. In practice the high-level building blocks are implemented using even smaller blocks. This includes hardware devices, software components, and communication protocols such as TCP/IP — each one bringing their own unique set of challenges.

Unlike Proof-of-Work and Public-Key Cryptography, the third component of Bitcoin is not based on math, but human behavior. Specifically, Bitcoin relies on a system of financial incentives and people chasing these incentives to sustain itself.

That sounds a bit scary, and a sharp shift from the strong mathematical foundation that underlies most modern technologies, such as the computer or artificial intelligence. If we have learned anything from history, it is that humans are not always predictable. We are, after all, biological creatures made up of “wet” matter. We’re not like “dry”, cold-hearted machines who can calculate things accurately or consistently. We change our mind in a heartbeat. Not only that, we constantly bicker, and hardly seem to be able to agree on anything.

So how can we create a technology out of fickle human behavior? Bitcoin’s 10-year track record is evidence that perhaps we can, and this aspect of Bitcoin is as innovative as the novel uses of Proof-of-Work and Public-Key Cryptography, which we explored in-depth in the first 3 parts of the series.

Bitcoin’s incentive scheme relies on the assumption that people are rational actors. If people are rational, they would be incentivized to participate in mining, buying and holding Bitcoin. The concept of rationality is incredibly important, but often taken for granted, so it’s worth a background discussion.

Economic Rationality

In economics, the definition of rationality, or the economically-rational individual, has been a topic of great debate, and economists still disagree on the precise definition. At the heart of economic rationality however is the central premise that individuals act to maximize their expected utility. That is, when presented with several choices, individuals will choose the one that they think will make them the happiest, i.e., maximizing net benefit, which is equal to total benefits minus total costs. This is known as the Expected Utility Theory.

Gabriel Cramer and Daniel Bernoulli gave birth to the idea in the 18th century, and it gained in importance as time went by. Nowadays, Expected Utility Theory dominates the field of economics and is widely used in many economic models and real-life policies.

Towards the later half of the 20th century however, doubts started to creep in: do people actually behave like economically-rational individuals, as described by the Expected Utility Theory?

When the choices and consequences are clear and measurable, we have little problem in making optimal decisions. But when the choices are complex, consequences less clear, less measurable, we can be wildly off the mark. And real-world situations are typically of the latter type. So perhaps humans are rational, but due to limited information and our own cognitive limitations, we can only be rational up to a certain point.

Put another way, humans are only rational when the math involved is relatively simple. This is the idea of “bounded rationality”, which Herbert Simon introduced in 1950s.

Going further, Daniel Kahneman and Amos Tversky, observing that irrational behavior is actually quite common and non-random, created what they termed the Prospect Theory in their seminal paper in 1979. Prospect Theory describes several systemic biases — such as loss aversion — in human behavior, which often cause us to act irrationally.

Prospect Theory became the foundation of the new field of Behavioral Economics. It also started a movement towards a better way of doing economics: theories that are based less on abstract, normative ideas, and more on hard evidence and data.

Rational Behavior: Biological Roots

“We are survival machines — robot vehicles blindly programmed to preserve the selfish molecules known as genes.”
“Prediction in a complex world is a chancy business. Every decision that a survival machine takes is a gamble, and it is the business of genes to program brains in advance so that on average they take decisions that pay off. The currency used in the casino of evolution is survival, strictly gene survival, but for many purposes individual survival is a reasonable approximation.” — Richard Dawkins [1]

Rationality might also have roots in biology, especially if you view survival of the fittest as competition at the gene level and not at the individual level [2]. This is also known as the Selfish Gene Theory, developed by John Maynard Smith, W.D. Hamilton and Richard Dawkins, among others. The Selfish Gene Theory postulates that DNA is the main means of information transfer between generations and over time, populations will move towards evolutionarily stable strategy.

Because the world has very limited amount of resources and because each of us is wired biologically to survive and pass on our genes, we are bound to compete for these resources. That means that all else being equal:

• When the opportunity to extract gains (material or non-material) presents itself, our default mode of behavior is to take it to maximize our chance of survival, in the face of future uncertainty.
• When two or more such opportunities arise, we will take the one that gives us more gains, provided that the gains can be accurately measured. Again, this is so that we maximize our chance of survival, in the face of future uncertainty.

This is similar to Expected Utility Theory, only rephrased from the evolutionary standpoint.

In reality, measurement of gains are subjective and only transferable between individuals under a common Unit-of-Measurement (UoM), such as prices in dollar or gold. In the case of Prisoners’ Dilemma for example, the UoM is the number of years in prison. Difficulty arises when there is no consistent UoM or UoMs are not easily convertible, e.g., how much money is worth staying one year in prison?

So rationality, even if coded at the gene level, is likely very rough heuristics. Genes, after all, can’t make worldly information suddenly more available, or reduce the complex math inherent in the natural world. But genes can ensure a basic high-winning-percentage strategy: to program us to take resources in a resource-constrained world. You might end up taking more than you need, but it is better to err on the side of your action being maybe unnecessary, than being for sure sorry the next day.

Bitcoin’s Incentive Scheme

Above we have established that human behavior, although fickle and suffers from systemic biases, likely exhibits bounded rationality, coded at the gene level. The simpler the problem and the simpler the math involved, the more likely we will make the optimal, rational decision.

As it occurs, Bitcoin’s incentive scheme mostly falls into this category. What is Bitcoin’s incentive scheme?

(a) Fixed supply: There can be no more than 21 million bitcoins ever.

(b) Mining subsidy: Bitcoins are created each time a miner discovers a block. The number of bitcoins generated per block is set to decrease geometrically, with a 50% reduction every 210,000 blocks, or approximately four years. As of this writing (Dec 2018), the current subsidy is 12.5 bitcoins per block.

(c) Transaction fees: Users include transaction fees in their transactions as payment to miners for processing those transactions. Transaction fees follow the market forces of supply and demand. When blocks are full, fees are high. Vice versa, when blocks are empty, fees are at their lowest.

Let’s briefly go through each one and see how rationality plays a role in making these incentives work.

(a) A fixed supply is Bitcoin’s primary financial incentive. If successful, Bitcoin would be one of the scarcest assets ever existed — much scarcer than gold. All else being equal, if people are rational, they should prefer the scarcest asset to store value in, given a number of available assets.

(b) Mining subsidy is a temporary incentive, but it is essential to the initiation of Bitcoin. Bitcoin, as with most networks, had a chicken-and-egg problem: why should the first few people participate in an infant network when there were barely anyone else? Relying purely on non-profit-minded volunteers to support the network would be unsustainable. Bitcoin solved this problem by giving early adopters higher amounts of rewards, in the form of subsidy. If people were rational, and estimated Bitcoin to have any chance of success, then the subsidy should serve as a strong enough incentive to overcome the initial risks and uncertainty associated with Bitcoin mining. The subsidy bought Bitcoin time until it is strong enough to protect itself from external attacks. This was also the fairest way to distribute bitcoins: by giving them to people who most strongly believed in and contributed to the project when no one else did. However, mining subsidy is irrelevant in the long run, past the bootstrapping stage.

(c) Transaction fees are Bitcoin’s true second main incentive. As stated, in the long run Bitcoin has to remove mining subsidy altogether in order to not violate the scarcity incentive from (a). As Satoshi put it: “In a few decades when the reward gets too small, the transaction fee will become the main compensation for nodes.”

If transaction fees are high enough, and people are rational, there should be a healthy mining industry to keep the network secure. Worth noting that due to transaction fees being a highly variable factor — which is a stark contrast to the predictability of a fixed supply and fixed inflation schedule — the math involved in calculating opportunity costs of pursuing transaction fees is more complex. Bitcoin’s transition to a fee-driven model is untested, and it remains to be seen whether the transition would happen smoothly.

So we see how Bitcoin’s sustainability greatly depends on rational human behavior at the core. This is a crucial point and an aspect where Bitcoin is inferior to gold, the previous standard of sound money. If people choose to stop using gold as money (perhaps irrationally), gold is fine. It would still exist in nature, and could make a comeback as money centuries later. If people choose to stop using or mining Bitcoin (perhaps irrationally), it will need to be bootstrapped later, or might fail to be bootstrapped ever again.

In return for this inferiority, Bitcoin is superior to gold in almost all other departments desirable for a monetary asset, e.g., transferability and portability.

Side Note: Development Incentive

Since Bitcoin exists as software and requires active development and maintenance [3], a few words are warranted on the issue of development incentive. Since this issue is more about resource allocation than the creation of digital scarce money itself, feel free to skip this section. Development incentive in general is orthogonal to Bitcoin’s incentive scheme as described above.

Unlike miners, developers do not have a direct financial incentive in the protection and development of Bitcoin. Instead, Bitcoin software development relies on a voluntary open-source-software system — where developers who are most philosophically-aligned with the cypherpunk ethos of Bitcoin are motivated to work on it on their own free time. This might seem inefficient, and perhaps due to the success of Bitcoin’s incentive scheme so far, several altcoins have been trying to address this problem by adding development incentive to their protocols.

However, in-protocol development incentive is highly challenging. The reason is that it is very different to Bitcoin’s original incentive scheme, which has some very special properties:

• The common goal can be mathematically-defined: miners get paid for a hash that is smaller than or equal to the current difficulty target.
• The common goal is computationally-verifiable: miners’ work towards the goal is verifiable by anyone, cheaply; and miners only get rewarded after the fact.

This makes Bitcoin’s incentive scheme automatable. That is, it doesn’t need any human intervention to work, and can exist safely as fixed rules within the protocol. In general, in-protocol incentives make sense if the goals can be mathematically-defined and computationally-verifiable.

Development goals, however, are often highly fuzzy [4], neither mathematically-defined nor computationally-verifiable. For example, a typical development goal is to scale Bitcoin to handle twice the traffic without degrading overall network security or Bitcoin’s essential attributes. However, opinions differ wildly on what “network security” or Bitcoin’s “essential attributes” mean. These goals, even if somehow met, are hard to be verified or verified cheaply. Ultimately what that means is that these goals require subjective human inputs. Thus, they are poor candidates to be built into the protocol, adding overhead without being necessarily beneficial. Development incentive is better off being handled off-chain.

In summary, Bitcoin is unlike any other technologies ever created in that human behavior is one of its core moving parts. It is the first of its kind.

Bitcoin’s reliance on human behavior implicitly assumes that humans are rational actors. This rationality assumption might break down in certain situations, such as when information is limited, or when the opportunity costs calculations become too complex. Or within a community of Buddhist monks who were trained from birth to reject material gains. Or imagine a world where resources are infinitely abundant: it’s likely that the beings there will develop behavior not wired to compete or maximize utility [5].

Despite that, there is strong evidence that we humans do possess some degree of rationality, or at least a bounded version of rationality. It is this bounded rationality that Bitcoin’s survival hinges on. Bitcoin needs rational actors to bootstrap its network. Bitcoin needs rational actors to buy into its promise of sound money, HODL at all costs, and consequently raise its price. Bitcoin needs rational actors to keep participating in mining and sustain the network for the next 100-1000 years. Can we, and future generations, stay rational at all times and forever? Or would we be foolish and prematurely abandon this idea, no matter how sound it is?

*This is part 4 of the Bitcoin Fundamentals series. Check out the full series here: part 1, part 2, part 3, part 4, and part 5.

Acknowledgements

Special thanks to Murad Mahmudov, Nic Carter and Steve Lee for their extremely valuable feedback.

[1]: The Selfish Gene, by Richard Dawkins.

[2]: “Some research suggests there is a genetic basis for greed. It is possible people who have a shorter version of the ruthlessness gene (AVPR1a) may behave more selfishly; Ruthlessness gene discovered.” (Wikipedia). Also see related work on the burgeoning field of Genoeconomics.

[3]: Recently a consensus-critical bug, CVE-2018–17144, has been discovered then quickly fixed in Bitcoin. If it was exploited, some Bitcoin nodes could have been tricked into accepting a block that inflates the supply beyond 21 million bitcoins. This event highlights the difficult nature of software development, despite the quality of development team (read my analysis of that bug here). There is also a good chance that the Bitcoin protocol will get ossified at some point in the future, which lessens the need for active development, if not completely removes it (i.e.: critical bugs might still need to get fixed).

[4]: The fuzzy nature of software requirements and difficulty in writing precise “specs” are problems well-known within the software industry.

[5]: Note that in this last example one can argue that this behavior is not really irrational in that context. However we are using “rationality” loosely here to mean utility maximization, not necessarily about being based on logic or reason.

To fully understand the significance of public-key cryptography, we must first take a few steps back and understand how our society is principally organized around the concept of property.

What is Property?

Property never has been abolished and never will be abolished. It is simply a question of who has it. And the fairest system ever devised is one by which all, rather than none, [are] property owners. — A. N. Wilson

Property has wide-ranging definitions. The idea of what constitutes property often changes to reflect contemporary beliefs and circumstances. For example, early discussions of property almost always exclusively referred to land. Since it was mostly land that was the source of constant conflicts and struggle for power, it was natural that land occupied the minds of ancient thinkers. Later, as society develops, property was expanded to include intangible assets such as patents and copyrights, and then expanded again to encompass all things deemed necessary for life and liberty.

Formally speaking, property is a legal concept defined and enforced by a local sovereignty. The specific implementation varies greatly depending on the political system, from monarchy to communism to democracy, among others.

Discussions on property dated back to Greek civilization. Plato and Aristotle, the two fathers of Western philosophy, laid much of the groundwork for the fierce and at times extremely bloody debates that followed in the subsequent 2,500 years.

Plato, likely inspired by the Spartans, was against private property of all sorts, including men’s wives and children. He rejected the idea of “mine” and “not mine”, “his” and “not his”. According to him, private property corrupts the human soul: it fosters greed, jealousy and violence. An ideal Platonic society would eradicate private property entirely. This school of thought was later developed into a full-fledged system, most notably by Karl Marx, the father of communism.

Aristotle, Plato’s best student, had other ideas. Aristotle rejected Plato’s argument that common property would remove vices and violence, arguing that people who share stuff tend to fight more than those who own them personally. Aristotle also believed that private ownership is crucial to progress because people would only be incentivized to work hard for the things they own. Furthermore, only when private property rights are respected, people can have the opportunity to fully grow and afford to be virtuous. As the late historian Richard Pipes eloquently put it: “Human beings must have, in order to be.”

Plato’s central argument against private property rested on morality. Aristotle also responded to Plato on the ground of morality. But some of Aristotle’s arguments went beyond morality and into the realm of economic reality. (Interestingly, like his teacher, Aristotle was against trade and profit-seeking, so he did not develop a consistent economic framework.)

The discussions on property since Plato & Aristotle have evolved to include mainly four aspects: morality, politics, psychology, and economics [1]. Among these, psychological and economical arguments for private property probably bear the most weight, since they address the world as it is, not how it should be.

One of the fundamental questions regarding property is that between property and sovereignty, which comes first?

Some influential thinkers, such as Harrington & Locke, believed that property predated sovereignty. They believed humans intuitively understand property, even without the existence of a state.

To them the primary function of a state is to protect property rights. A sovereign state is judged on its merits to fulfill this responsibility. Locke went further and stated that individuals have the right to rebel against the state if it fails in its duty to preserve property rights. Adam Smith, the father of capitalism and modern economics, had a similar view. Smith recognized that property and government were dependent on each other, and argued that “civil government could not exist without property, as its main function is to safeguard property ownership”. (Smith differed with Locke, however, on whether property rights are “natural” — he believed property rights are “acquired” rights, not “natural” rights).

In contrast, other thinkers, most prominently Hobbes, believed it was the opposite, that property is a creation of the state. He regarded property simply as the product of authority and the acceptance of that authority [2].

There has been mounting evidence, particularly in the later half of the 20th century, that vindicated Harrington’s & Locke’s view. The 20th century saw a large-scale social experiment in attempting to abolish private property via the spread of communism. This experiment resulted in the Cold War and numerous proxy wars across the globe, culminated in the Cuban Missile Crisis in 1962, and ended dramatically when the Soviet Union finally collapsed in 1991. Following this collapse, the remaining communist states were split into two camps. Some switched to capitalism, as many Central & Eastern European countries did. Some retained only a nominal form of communism, as China & Vietnam did — in these countries the political regime purports to represent the “bourgeois”, but the economy functions much like that of a capitalist state. Almost all surviving communist states have adopted free-market ideology, and were forced to respect property rights (to a certain extent) in order to survive.

In summary, what the 20th century has shown us is that governments that failed in their primary role of protecting property ended up either dead or forced to eventually respect private property. This proves that the state is subservient to, and is a derivative of, property needs, not the other way around. Property, by and large, comes before the state.

Despite this, in the short to medium term, individuals do have to depend on the state for preserving their property rights, and suffer a great deal when it fails to do so. We will see how cryptography can help break this cycle of dependency. But first, let’s quickly look at how modern cryptography came about.

Public-Key Cryptography

Until recently, the development of cryptography has been driven mainly by wars and rivaling states.

Prior to WW2, classical cryptography was more about obscurity than mathematical rigor. If there was any math involved, it was simply accidental. This changed with a couple of developments:

• The invention of the telegraph dramatically increased the amount of data that needed to be secured
• The invention of the radio heightened the need to encrypt public communication channels, as opposed to relying on stealth methods
• The invention of the computer brought incredible computational power to cryptanalysis; breaking codes became much easier

These developments culminated in WW2 and saw the Allies heroically break Germany’s state-of-the-art cryptographic device, the Enigma machine, with notable help from Alan Turing. The breaking of Enigma decidedly concluded the era of classical ciphers (a cipher is a particular method of doing encryption and decryption) and called on cryptographers to look for stronger ciphers — ciphers that are based on a more solid, mathematical ground.

Luckily, there were hints for where to look. One major problem with classical ciphers was the problem of secret keys distribution—a problem common to all symmetric ciphers (symmetric ciphers are ciphers that use the same key for encryption and decryption). Basically, with symmetric ciphers, since it is not recommended to reuse secret keys, the number of keys that need to be distributed is proportional to the amount of data that need to be secured — which as mentioned, exploded at an unprecedented rate. As a result, one big research area at the time was to find ways to cheaply and securely distribute keys at scale. The insight for asymmetric ciphers began when a few cryptographers flipped this problem on its head and pondered: do we actually need to distribute the secret keys at all?

This research direction eventually narrowed the search down to one-way functions, and it was not long until a brand new solution was found — one which does not require the distribution of secret keys. Diffie, Hellman & Merkle discovered public-key cryptography, the first ever asymmetric cipher, in 1976. One year later, Rivest, Shamir & Adleman published the first implementation, the now-famous RSA algorithm. Public-key cryptography was also independently discovered, but not implemented, a few years earlier by Ellis & Cocks in Great Britain. However, Ellis & Cocks’ research was classified and not publicly acknowledged for 27 years.

Thus, public-key cryptography, today considered the greatest cryptographic achievement in two thousand years, was born. It took several decades for this technology to filter down to the masses, largely thanks to the efforts of the cypherpunk movement. The cypherpunks, foreseeing that the state’s monopoly on this new technology creates a huge imbalance of power and a potential threat to individual liberty, took incredible risks to bring public-key cryptography to civilians. When they successfully did, the gates were flung wide open. For the first time in history, individuals could afford encryption as strong as the military’s.

But it was not until the invention of Bitcoin that public-key cryptography realizes its full potential. Its application in digital hard money would redefine private property.

Privately-Owned Digital Goods: An Oxymoron?

The arrival of the personal computer and the Internet introduced a new asset class: digital goods. Digital goods are intangible digital bits of information, packaged in various encoding formats. Examples are Wikipedia articles, MP3 files, software, etc.

Digital goods ushered in a new era of information-sharing never before seen. Any piece of information could be instantly reproduced and distributed at scale, at almost zero marginal cost.

However, early on digital goods did not significantly change the nature of private property. As it turns out, digital goods are notoriously bad at staying private.

The problem with trying to establish exclusive ownership over digital goods is that they are infinitely copyable. But that did not stop people from trying anyway. The state and businesses’ preferred method of imposing control over digital goods is through regulations. For example, the US created a complex export control & regulations program to prevent secrets, particularly knowledge of advanced technologies, from leaking to other states. In business, the Big 3 music labels and the Big 5 movie studios spend a large amount of money lobbying for anti-piracy laws, and suing people for violations. Similarly, big software companies learn to build patent war chests. In the process they exploit the patent system and cripple smaller companies. At best, regulatory solutions at enforcing digital exclusivity are expensive and ineffective. At worst, they create an environment where a few players can game the system to their advantage.

Non-regulatory solutions are equally inefficient. One such example is Digital Rights Management (DRM), an access-control technology designed to restrict the use of digital goods. DRM does provide some basic level of security against piracy. However, DRM suffers from a fatal flaw: the security only needs to be bypassed once, and there would be no recourse.

One area where we saw limited success at creating digital exclusivity came from the gaming industry. Game creators figured out that if they could create virtual goods (a subset of digital goods) within the games they designed, these goods could serve to add to the gameplay, as well as a nice bonus source of revenue. Since the game creators control 100% of the environment within which these virtual goods operate, they could impose restrictions on them that are not possible otherwise, including making them inaccessible or rare. However, in-game virtual goods have limited application, and game users are dependent on the game creators to not change the game rules.

So it might have seemed like digital goods and private property are at odds. If something is digital, it is almost impossible for it to be private or for someone to have sole possession of it. Privately-owned digital goods sounds like an oxymoron.

The inability to exclusively own digital goods means that everyone can take advantage of them. Individuals can use them to empower themselves, but the state is also able to become more powerful through data collection, surveillance, and propaganda — all made easier with digital goods. Digital goods, in their pure form, do not change the power structure between the individuals and the state.

But there is a way for digital goods to become private property, only if we can overcome 2 major hurdles:

• Scarcity: the ease of reproducing and redistributing digital goods in unlimited quantity is precisely what makes exclusive ownership difficult.
• Transferability: the ability to dispose of an asset by sale is a crucial component of ownership. Without this, ownership loses much of its power.

It turns out that these two desired attributes are also the prerequisites of money. If we are able to create a digitally-scarce, transferable digital good, not only this good could be privately owned, it would become a great store-of-value and ultimately a new form of money. Digital “hard” money.

Bitcoin solves both problems. Bitcoin creates digital scarcity by imposing a fixed supply on itself in software (a.k.a. consensus rule), and then protecting that consensus rule with a large amount of energy (in the form of Proof-of-Work) through a decentralized network of mining machines. As long as mining is sufficiently decentralized, it would be nearly impossible to change this fixed supply rule or bring down the network. We discussed this key innovation in-depth in Part 1 of the series.

The problem of transferability, on the other hand, can be solved by using public-key cryptography. Specifically, a unique application of public-key cryptography is to generate unforgeable digital signatures. The digital asset could be coupled with a public-private key pair. This single key pair could then generate as many digital signatures as needed, each one represents a piece of the underlying asset. These digital signatures effectively “tokenize” the asset, making it transferable between individuals [4].

In short, public-key cryptography, together with digital scarcity, have given us digital hard money. Digital hard money inherits all the strengths of digital goods: instant, borderless, and impossible to regulate or control. Most importantly, this digital hard money can be privately owned.

It is hard to overstate how big of a disruption this is.

For the first time in history, a form of private property exists that is completely independent of jurisdiction or the law [5]. Private keys and the bitcoins they control are private property de facto, not de jure.

Public-key cryptography’s application in digital hard money greatly changes the social contract that has bound human societies for thousands of years: that individuals need the state for the protection of property, and the state in turn needs individuals to finance its continued existence. One has to wonder, if securing property is the primary function of a state, then will its role — and power — be significantly reduced in a world run on digital hard money?

In summary, public-key cryptography’s application in digital hard money redefines private property and has the potential to uproot the very foundation of society as we know it. The consequences might take decades to play out, but when it happens, the impact will likely be incredibly far-reaching.

*This is part 3 of the Bitcoin Fundamentals series. Check out the full series here: part 1, part 2, part 3, part 4, and part 5.

Acknowledgments

Special thanks to Jimmy Song, Hasu, Nic Carter and Steve Lee for their extremely valuable feedback.

[1]: Property and Freedom, Richard Pipes

[2]: Property and Ownership, Jeremy Waldon

[3]: The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography, Simon Singh

[4]: It is very possible that public-key cryptography is the only way to tokenize a digital asset this way. Imagine implementing Bitcoin using a symmetric cipher.

[5]: Physical assets like gold can be and often is heavily regulated. For example, FDR outlawed & confiscated private gold during the Great Depression.

There are many ways to slice and dice PoS and uncover its weaknesses. Mainly:

Evolutionary Psychology/History: “Collectibles” or “proto-money” in history all had one thing in common, unforgeable costliness [1] — or at least unforgeable costliness in the context of their times. From sea shells, furs, teeth, to precious metals to minted coins. As PoS merely involves the temporary lockup of existing capital and does not consume said capital, it does not satisfy the unforgeable costliness requirement that Nick Szabo identified as one of the 3 key properties of money.

Economics: If an object has value, people will spend effort to chase it, up to whatever the object is worth (MC=MR). This effort is also “work”. Paul Sztorc correctly concluded that PoS is an obfuscated form of PoW.

Work manifests in different ways in PoS, whether it is taking out a loan from the bank, running 24/7 staking servers, or attempting to steal online staking keys.

Not only PoS is obfuscated PoW, it is inferior PoW. Any potential cost saving PoS gives you, it pays back in equal measure in the reduction in security.

As we shall see below, a dollar [2] fleetingly locked up in staking creates nowhere near the same level of security as a dollar spent in mining.

Computer Science: Andrew Poelstra wrote one of the first formalized critiques of PoS, in which he coined the terms costless simulation (aka nothing-at-stake) and long-range attacks.

A recent paper by Jonah Brown-Cohen, Arvind Narayanan & co. also showed surprising barriers to having a good and reliable source of randomness in PoS protocols [3].

Engineering: I myself have written a 2-part series [Part 1] [Part 2] looking at PoS weaknesses from the practical engineering perspective, and listed specific worst-case scenarios where PoS is particularly vulnerable: network partition, private keys theft, or low rate of participation in staking.

But perhaps one of the simplest ways to look at PoS is through the lenses of Time, which I alluded to in my series, but want to expand on here.

Proof of Stake is Proof of Temporary Stake

Proof-of-Stake is a misnomer. The correct, fully descriptive name for Proof-of-Stake should be Proof-of-Temporary-Stake (PoTS). This name is more accurate because it captures the time element, or lack thereof, of PoS.

To understand the effects of Time, let’s first analyze how Time plays a role in PoW.

The ongoing energy expenditure in PoW contributes to network security in 2 ways:

• Energy expended per block not only secures the UTXOs belonging in that block but also retroactively secures all global UTXOs that occurred in past blocks. The reason for this is because it would be impossible to revert past UTXOs without reverting the current block first. Each new block effectively “buries” all existing UTXOs under its weight.
• Investment in specialized mining equipment, in essence, represents the potential stream of rewards earned in the future, discounted back to the present. When a miner invests in a new piece of mining equipment, it is akin to buying a share of stock that pays regular dividends. What that means is that mining hardware in totality roughly represents potential energy expenditure of future blocks.

One way to visualize this is to imagine a timeline. Units of work expended in the past accumulate in the ledger. Units of work expended in the future accumulate in the current mining hardware.

As time moves forward, units of work on the right side materialize and move to the left side. Mining hardware can also be seen as a “buffer”, a place where units of work deposit before making their way to their final destination: the ledger [4].

The official term to describe this sort of time-based accumulation phenomenon is stock & flow, which occurs often in nature. Bitcoin is essentially protected by high stock-to-flow ratios in 2 areas: the ledger, and the mining hardware. (Go here for a detailed discussion of stock & flow.)

In contrast, PoS has no equivalent of this.

Past stakes (left side of the timeline) do not accumulate in the ledger, as stake is released after some arbitrary bonding period [5]. Long-range attack is the manifestation of this weakness: it works because of PoS’s inability to secure the past. Long range attack is at the heart of the problems with PoS, because it shows that in the long run PoS fails to guarantee the integrity of the ledger — the most important asset of all this innovation.

Future stakes (right side of the timeline) also do not accumulate in the validators in the present time, as again the act of staking only has meaning within the short window that it occurs — what happens in the future does not count today. Current-private-keys-theft is the manifestation of this weakness: it works because of PoS’s inability to secure the future. Keys theft sidesteps altogether the financial cost supposedly required to acquire controlling stake — whereas in PoW there’s no sidestepping the fact that an attacker needs to overcome the mining hardware and ongoing energy costs to pull off and sustain a majority attack [6].

(There is one form of accumulation in PoS. That is, the periodic staking rewards that accrue to the validators. However, unlike accumulation in PoW, rewards accumulation is only beneficial to the individual PoS validators, not to overall network security.)

In summary: the further one moves away from the present time in PoS, the faster stake loses its meaning, until stake becomes meaningless.

Work is robust against the ravages of time [7]. Stake is not.

The fact that the cost of PoW mining is irretrievably sunk and accumulates both in the ledger and the mining hardware, is an important feature, not a bug. PoS research is often based on the fundamental misconception that this is a bug and a source of inefficiency.

Acknowledgments

Special thanks to Vijay Boyapati, Bob McElrath, LaurentMT, Nic Carter and Steve Lee for their valuable feedback.

*Note: Another major criticism of PoS is that PoS pretty much guarantees a plutocracy system (rich getting richer). That is not discussed here as it is not related to security strength per se, and deserves its own separate discussion.

[1] Some might confuse unforgeable costliness with the labor theory of value, but they are not the same thing. Energy cost alone is not enough, the asset must be unforgeable.

[2] Dollar is only used as a unit here for convenience, it could be any other unit of account.

[3] For a PoS currency, relying on an external source of randomness involves circular reasoning fallacy. Therefore it is highly desirable that PoS generates randomness internally, using the content of its own ledger. However, this proves to be a difficult problem that has its own trade-offs.

[4] Not all units of work make it all the way to the ledger. Some are thrown away, but even thrown-away work are necessary to keep the network decentralized.

[5] The concept of “finality” does not change the (lack of) accumulation aspect of PoS, as new/long-dormant/partitioned nodes can see different “finalities”.

[6] Hardware seizure (e.g. by a state actor) is a risk in PoW, however this risk can be mitigated as long as mining is sufficiently decentralized. Disperse hardware, however, is not a defensive option for PoS, as PoS validators are just software nodes — which can be targeted from anywhere remotely. More importantly, even with seized hardware, an attacker still can’t avoid ongoing energy costs.

[7] Work is timeless / robust in terms of number of hashes, not energy required. New hardware technologies could improve mining efficiency — although at some point the efficiency gains will slow down as we run into hard physical limits. The robustness of Bitcoin’s PoW also relies on SHA256 not being broken.

The short summary of the bug is that there are 4 cases where the Bitcoin Core software needs to check for double-spending. All 4 cases initially shared the same code execution flow. After some subtle iterations of the code over several years, one of the 4 cases (“single-tx-double-spend-in-a-block”) got skipped, which would allow a miner to potentially trick some nodes into accepting a block that inflates the supply of Bitcoin.

The nature of this bug reminds me of the constant conflict between:

(a) the need for code reusability & optimization

(b) the danger of falling for what I call accidental commonness: things that are similar not by design, but by accident

Accidental commonness creates a fertile ground for refactoring nightmares and potential bugs like CVE-2018–17144.

Some background, if you’re not familiar with software engineering:

In software there is this grand vision of software components being perfectly modular — similar to their physical engineering counterparts. There is a good reason you don’t have to carry a different type of charger or USB wire everywhere you go.

So there has always been a strong push for code reusability. Writing redundant code is often frowned upon. Why do the same work twice when you can do it once?

There’s also a long history of reinventing-the-wheel in software which gives code reusability even a higher priority on the priority list. Code reusability is often considered one of the industry’s “Best Practices”. An aspiring junior software developer might be inclined to think that there is zero downside to code reusability.

But there’s a hidden danger — and I don’t believe this stuff is ever properly taught in schools — of extreme code reusability.

Extreme code reusability means collapsing any two similar-looking pieces of code into one, regardless of their use cases & original intention.

Which a lot of times end up with code that has accidental commonness.

It might not be obvious why accidental commonness is bad, but one only has to maintain a sufficiently large software project for a long period to understand why.

It is bad because product requirements change and software is an ever-evolving, never-quite-finished product.

This constant-moving-target problem is something quite unique to software. If you are a structural engineer you are not expected to turn a house into a 20-story high-rise, or a car into a flying saucer. Yet in software we constantly do this.

When product requirements and use cases change, the underlying assumptions that the software were initially written for might no longer be applicable.

So that proud piece of common code that you refactored (but now have completely forgotten) no longer works the way you think it would.

I’ve lost count of how many painful refactoring projects or nasty bugs I’ve seen that are a direct result of premature optimization or accidental commonness — to the point where I now avoid things like Inheritance like a plague.

Things that have accidental commonness will quickly reveal their differences when they evolve beyond their initial state. Any rigidity in code commonness then would be a massive bane to get rid of.

The more layers of accidental commonness there are in the code, the more of a minefield it is to navigate. CVE-2018–17144 is a perfect example of that.

Feedback loop and circular reasoning fallacy are highly common, but they involve very different types of circularity.

Feedback loop: action induces further action, but the extra action also requires work, it doesn’t come from thin air.

Feedback loops typically weaken and end by themselves, although they can last longer as long as more work is put into the system. Feedback loop is essentially about amplification & second-order effects.

Think: deforestation that leads to land erosion, which leads to further deforestation.

Another example of a feedback loop is economic bubbles. Hype leads to more hype which leads to more hype, until all people who could be hyped up have been hyped up. Each stage in a hype cycle requires more work. Bubbles therefore could misallocate capital & cause waste.

Another example is the adoption curve of Bitcoin. Bitcoin was initially known only among geeks & cypherpunks. An early wave of early adopters built demand which raises the price. Rising prices in turn draws more attention and further increases adoption.

The important thing to remember about feedback loop is that feedback loop requires work. There is no magic.

Circular reasoning fallacy: the proposition is supported by the premise, which is supported by the proposition.

In terms of “work”, circular reasoning can also be generally described as creating work out of thin air. Work is the supposed “proof” that backs the argument, which for circular reasoning actually has zero substance.

So circular reasoning is essentially about creating something out of nothing.

Think: a hypothetical wheel that keeps spinning forever on its own.

This manifests in Proof-of-Stake protocols, for example, by naively moving the problem of distributed consensus from finding blocks to what is the source of randomness.

If the PoS source of randomness is external, it is circular reasoning because to agree on the same external randomness (without Proof-of-Work) also requires solving distributed consensus, which is the original problem.

If the PoS source of randomness is internal, it is not circular reasoning but the scheme breaks down for a different reason: if you use purely the content of a blockchain to determine the content of the blockchain, your process cannot be truly random. No good randomness means that your protocol is predictable and exploitable. For a detailed exploration of the role of randomness in Bitcoin, check out my other article: Bitcoin, Chance & Randomness.