This article covers a lot of interesting ground, and isn't the usual same, old same-old article about Bitcoin. I especially liked the reminders of earlier examples of online currencies.
The conclusion is tentative, and reasonable. Along the way, the author brings up many interesting facts about Bitcoin, about its supporters, and about its critics.
I think it is especially reasonable to assume that Bitcoin exists with the tacit consent of the United States National Security Agency, even if the NSA didn't invent Bitcoin.
AFTER EDIT: Addition of my FAQ-in-progress about Bitcoin for Hacker New. A while ago I wrote that perhaps the greatest contribution the Bitcoin experiment will make to humankind is to teach you and me and our neighbors more about the realities of economics. And later I added that the Bitcoin experiment will also contribute to greater understanding of attack surfaces and online crime. Many of the ideas about how to mine Bitcoins, store Bitcoins, and trade with Bitcoins as a medium of exchange illustrate both the strengths and weaknesses of any other medium of exchange in a world full of human beings. Seeing the discussion of Bitcoins here on Hacker News reminds me of early online discussions in the 1990s of online payment systems such as PayPal, and the arguments beforehand that PayPal wouldn't have to invest a lot of time and effort (as it eventually did) building defenses against theft and fraud. If a weakness in a system is attached to a lot of money, the way to bet is to bet that someone will go looking for that weakness, even if you haven't thought of it.
This prompts a question for all the security-knowledgeable persons who participate here on Hacker News, a question once asked of the inventor of Pretty Good Privacy (PGP). How expensive do you think it would be for the United States National Security Agency (or a comparable organization from another national government) to crack a Bitcoin store, given that we know that some Bitcoin caches have already been cracked? And if the organization storing Bitcoin data held personal bank account data too, how attractive a target might it be to thieves?
How expensive do you think it would be for the United States National Security Agency (or a comparable organization from another national government) to crack a Bitcoin store, given that we know that some Bitcoin caches have already been cracked?
This would be a reasonable 1~2 weeks project for a pentester with less than one year of professional experience, so I'd put a rough upper bound on that at $20k. i.e. it is trivially within the capability of governments, organized crime, and any intermediate Rails programmer who wants a fun side project.
If you 10X the numbers I would not bet against the outcome "Achieve a systemic compromise of the bitcoin client." (Bitcoin, by design, fans transactions out to every client on the network. The transactions contain executable instructions in a language which is interpreted by C code. Do I need to paint a very detailed picture of the risk here?)
It's a simple sequence of opcodes: https://en.bitcoin.it/wiki/Script The code has been thoroughly audited by many people with substantial experience. Finding an important flaw in Bitcoin would be a major feather in any Whitehat's cap, and a major skull on the mantle for any blackhat.
Script adds extreme flexibility to Bitcoin, allowing the complete decentralization of services which would otherwise require trusted servers like escrow. It is statically validated and purposefully not turing complete. For extra conservativeness scripts not matching a set of standard forms are ignored by the unmodified reference software until transactions show up in blocks.
This is important because its what makes it possible to build other safe distributed transaction systems on top of Bitcoin... it's also what will allow Bitcoin to backwards compatibly upgrade its signing primitives if ECDSA begins looking weak.
You're no doubt aware that HTTP servers routinely did buffer overflows leading to arbitrary code execution early in the development of the Internet, and it is only years of work by thousands of people which makes them safe to use currently, right? HTTP servers are also diverse, old/battle-tested, and do not fan out every HTTP request to every HTTP server. Bitcoin is theoretically a protocol but in practice is a client monoculture (so much so that a bug in a point release of the official client forked the transaction chain), has probably less development hours total than Apache has spent on auditing parsing HTTP headers alone, and does fan out every transaction to every node on the network.
Transactions most certainly do not "contain executable instructions".
We're now arguing about the definition of the word "is."
Not even an hour ago you were claiming how the embedded scripting language added extreme flexibility to Bitcoin implementations. Having thought that through, you now claim the very same embedded scripting language is so crippled it, come to think of it, might not even count as executable instructions at all.
The technical reality of Bitcoin has not changed in the past hour. It still allows transactions to include arbitrary content. They still embed executable code. They are still executed, by design, network-wide on an implementation monoculture.
To paraphrase a tptacek comment: I hope to make the starburst of points which immediately follow this by implication as opposed to having to state them explicitly.
I'm not contradicting myself: In the same comment I wrote "It is statically validated and purposefully not turing complete".
There is no contradiction between between being very limited and also allowing extreme flexibility. I don't think many people here would agree that CSS is "executable code", and yet CSS is turing complete and substantially more complicated than Bitcoin's script. This is why I said it depends on what you mean by "executable code". There is nothing that is jumped to, no looping, the processor never jumps to and runs anything fed in off the network, etc. Just a simple set of operations for manipulating a stack and doing comparisons. But, even though the implementation is simple the results are powerful.
There are several implementations of script evaluation— I can think of at least 6— now though the reference is by far the norm on full nodes.
>I think it is especially reasonable to assume that Bitcoin exists with the tacit consent of the United States National Security Agency, even if the NSA didn't invent Bitcoin.
How so? If the NSA really hated bitcoin, what would they do? Even if it were made illegal in the US, the United States are not the world, and it would be extremely hard to enforce.
NSA, China, Russia, most governments really, and possibly a lot of banks, could do a 51% attack and shut down transaction processing... or do double spends, but shutting down all transaction processing seems more damaging. This won't ever change, unless Bitcoin really causes governments to lose most of their power and money.
Edit: gavin has a plan (http://gavintech.blogspot.com/2012/05/neutralizing-51-attack...) but my guess is if they did the work to start an attack in the first place they'd have planned for gavin's plan and acquired enough older coins to foil it. It'd be nice if more thought went into other ways to thwart a possible attack but I'm not sure there really are any. Most people seem to discount and completely avoid the issue.
A direct attack by a state actor (especially one like the US, which likes to be seen as following the rule of law) isn't too likely. China might attack bitcons, but why would they - they can just block them.
The people who do black ops don't generally do so to help the financial sector. They do so for national security. While the economy (and monetary system) is arguably a national security issue, I can't see them all being on the same page. The guys in treasury would probably rather talk to regulators than intelligence.
Simply banning them, and enforcing that ban would work though.
Forgive me if this is a joke that I'm not getting, but they wouldn't be useless at all:
1) Bitcoin is a p2p distributed network with nodes all over the world. Even if a nuclear attack took out the entire US, the network would continue to work as long as segments of the Internet did (and recall that the Internet was originally designed to protect US data networks from nuclear attack).
2) It's quite simple to spend Bitcoins as long as you have access to a Bitcoin node (see above) and a copy of the 32-byte private key string corresponding to the public Bitcoin address the coins were sent to. This short string of characters can be written on paper, etched into stone, whatever.
The receiver can't be sure that the Bitcoin hasn't been double-spent without waiting on changes in the block chain to propogate; that's not easy in the middle of a nuclear wasteland.
It'd be nice if more thought went into other ways to thwart a possible attack
Given that the BitCoin community/industry has been getting hacked lots and there is widespread ignorance of security ("unsalted md5s for passwords!"), I don't have faith this'll change.
"even if [bitcoins] were made illegal in the US, the United States are not the world, and it would be extremely hard to enforce"
Blacklist the Bitcoin exchanges and any foreign financial institution that transacts with them from the U.S. financial system. The script was updated with the twin salvos against online gambling and Iran.
But heres the question: how long would it take for governmental bureaucracy to amass the resources to execute such an attack without raising a flags from other nodes who then will take proactive measures to not only mitigate such attacks but also alert others nodes on the network?
"But heres the question: how long would it take for governmental bureaucracy to amass the resources to execute such an attack without raising a flags from other nodes who then will take proactive measures to not only mitigate such attacks but also alert others nodes on the network?"
Do you really thing that purchasing a hundred million dollars worth of ASICs would alert anyone? The government spends far more than that in a given year, and there are government agencies that are good at keeping secret operations of that size secret. I would not rely on the inefficiency of bureaucracy when it comes to equipment procurement, certainly not as a security measure.
Also, what exactly would the honest nodes do to mitigate the attack? They can only buy more computing power to try to maintain control of the block chain. That is the real problem here: the effort needed to run the Bitcoin network is proportional to the effort needed to attack the system.
"It's trivial for an attacker to fill the network with clients controlled by him. This might be helpful in the execution of other attacks.
For example, an attacker might connect 100,000 IP addresses to the IRC bootstrap channel. You would then be very likely to connect only to attacker nodes. This state can be exploited in (at least) the following ways:
The attacker can refuse to relay blocks and transactions from everyone, disconnecting you from the network.
The attacker can relay only blocks that he creates, putting you on a separate network. You're then open to double-spending attacks.
If you rely on transactions with 0 confirmations, the attacker can just filter out certain transactions to execute a double-spending attack.
Low-latency encryption/anonymization of Bitcoin's transmissions (With Tor, JAP, etc.) can be defeated relatively easy with a timing attack if you're connected to several of the attacker's nodes and the attacker is watching your transmissions at your ISP.
Bitcoin makes these attacks more difficult by only making an outbound connection to one IP address per /16 (x.y.0.0). Incoming connections are unlimited and unregulated, but this is generally only a problem in the anonymity case, where you're probably already unable to accept incoming connections.
Looking for suspiciously low network hash-rates may help prevent the second one.
"
One could even go further to do signal analysis on the network looking for nodes whose hash rates are more similar than others and hash rates per period of time (which will happen if such a large scale operation were in process), point them out to other nodes, and require that that node verify themselves with information which could allow for an independent audit by others before unflagging the node(s) in question.
EDIT: if anyone is interested in possible working on an open source project for rogue node mitigation that miners can install on their rigs, im game :P besides i think it would be more fun than going solo with my algos on the BTCUSD cross exchanges :P
Governments could tax all bitcoin transactions that go through a centralized entity (such as Mt. Gox) a non-trivial amount, which would effectively kill it as a mainstream currency.
CIA, not NSA. Though of course there could have been representatives there.
I think it's also worth noting that covert agencies may find benefits of their own in a public global system for moving money around quickly, verifiably, irreversibly, and somewhat anonymously.
"Tor was originally designed, implemented, and deployed as a third-generation onion routing project of the U.S. Naval Research Laboratory. It was originally developed with the U.S. Navy in mind, for the primary purpose of protecting government communications. Today, it is used every day for a wide variety of purposes by normal people, the military, journalists, law enforcement officers, activists, and many others."
https://www.torproject.org/about/overview.html.en
Comments
This article covers a lot of interesting ground, and isn't the usual same, old same-old article about Bitcoin. I especially liked the reminders of earlier examples of online currencies.
The conclusion is tentative, and reasonable. Along the way, the author brings up many interesting facts about Bitcoin, about its supporters, and about its critics.
I think it is especially reasonable to assume that Bitcoin exists with the tacit consent of the United States National Security Agency, even if the NSA didn't invent Bitcoin.
AFTER EDIT: Addition of my FAQ-in-progress about Bitcoin for Hacker New. A while ago I wrote that perhaps the greatest contribution the Bitcoin experiment will make to humankind is to teach you and me and our neighbors more about the realities of economics. And later I added that the Bitcoin experiment will also contribute to greater understanding of attack surfaces and online crime. Many of the ideas about how to mine Bitcoins, store Bitcoins, and trade with Bitcoins as a medium of exchange illustrate both the strengths and weaknesses of any other medium of exchange in a world full of human beings. Seeing the discussion of Bitcoins here on Hacker News reminds me of early online discussions in the 1990s of online payment systems such as PayPal, and the arguments beforehand that PayPal wouldn't have to invest a lot of time and effort (as it eventually did) building defenses against theft and fraud. If a weakness in a system is attached to a lot of money, the way to bet is to bet that someone will go looking for that weakness, even if you haven't thought of it.
This prompts a question for all the security-knowledgeable persons who participate here on Hacker News, a question once asked of the inventor of Pretty Good Privacy (PGP). How expensive do you think it would be for the United States National Security Agency (or a comparable organization from another national government) to crack a Bitcoin store, given that we know that some Bitcoin caches have already been cracked? And if the organization storing Bitcoin data held personal bank account data too, how attractive a target might it be to thieves?
How expensive do you think it would be for the United States National Security Agency (or a comparable organization from another national government) to crack a Bitcoin store, given that we know that some Bitcoin caches have already been cracked?
This would be a reasonable 1~2 weeks project for a pentester with less than one year of professional experience, so I'd put a rough upper bound on that at $20k. i.e. it is trivially within the capability of governments, organized crime, and any intermediate Rails programmer who wants a fun side project.
If you 10X the numbers I would not bet against the outcome "Achieve a systemic compromise of the bitcoin client." (Bitcoin, by design, fans transactions out to every client on the network. The transactions contain executable instructions in a language which is interpreted by C code. Do I need to paint a very detailed picture of the risk here?)
It's a simple sequence of opcodes: https://en.bitcoin.it/wiki/Script The code has been thoroughly audited by many people with substantial experience. Finding an important flaw in Bitcoin would be a major feather in any Whitehat's cap, and a major skull on the mantle for any blackhat.
Script adds extreme flexibility to Bitcoin, allowing the complete decentralization of services which would otherwise require trusted servers like escrow. It is statically validated and purposefully not turing complete. For extra conservativeness scripts not matching a set of standard forms are ignored by the unmodified reference software until transactions show up in blocks.
This is important because its what makes it possible to build other safe distributed transaction systems on top of Bitcoin... it's also what will allow Bitcoin to backwards compatibly upgrade its signing primitives if ECDSA begins looking weak.
> If you 10X the numbers I would not bet against the outcome "Achieve a systemic compromise of the bitcoin client."
Does that mean you'll take the other side of that bet?
> I'd put a rough upper bound on that at $20k
Um, what? There are public addresses with thousands of Bitcoins. Why aren't they getting looted?
Bitcoin consuming web applications, such as stores/exchanges, are routinely being looted.
you were implying that arbitrary public addresses could be cracked with a 20k budget, and i am saying that it is not the case.
[deleted]
You're no doubt aware that HTTP servers routinely did buffer overflows leading to arbitrary code execution early in the development of the Internet, and it is only years of work by thousands of people which makes them safe to use currently, right? HTTP servers are also diverse, old/battle-tested, and do not fan out every HTTP request to every HTTP server. Bitcoin is theoretically a protocol but in practice is a client monoculture (so much so that a bug in a point release of the official client forked the transaction chain), has probably less development hours total than Apache has spent on auditing parsing HTTP headers alone, and does fan out every transaction to every node on the network.
Transactions most certainly do not "contain executable instructions".
This is contrary to technical fact. https://en.bitcoin.it/wiki/Script
It depends on how you're defining "executable instructions".
There is a small set of operators and a single conditional. No looping, etc. It's strictly less powerful than CSS, for example.
The implementation is a very simple loop over a switch with a simple 'stack'. The size of a script has a hard maximum of 10kbytes.
We're now arguing about the definition of the word "is."
Not even an hour ago you were claiming how the embedded scripting language added extreme flexibility to Bitcoin implementations. Having thought that through, you now claim the very same embedded scripting language is so crippled it, come to think of it, might not even count as executable instructions at all.
The technical reality of Bitcoin has not changed in the past hour. It still allows transactions to include arbitrary content. They still embed executable code. They are still executed, by design, network-wide on an implementation monoculture.
To paraphrase a tptacek comment: I hope to make the starburst of points which immediately follow this by implication as opposed to having to state them explicitly.
I'm not contradicting myself: In the same comment I wrote "It is statically validated and purposefully not turing complete".
There is no contradiction between between being very limited and also allowing extreme flexibility. I don't think many people here would agree that CSS is "executable code", and yet CSS is turing complete and substantially more complicated than Bitcoin's script. This is why I said it depends on what you mean by "executable code". There is nothing that is jumped to, no looping, the processor never jumps to and runs anything fed in off the network, etc. Just a simple set of operations for manipulating a stack and doing comparisons. But, even though the implementation is simple the results are powerful.
There are several implementations of script evaluation— I can think of at least 6— now though the reference is by far the norm on full nodes.
>I think it is especially reasonable to assume that Bitcoin exists with the tacit consent of the United States National Security Agency, even if the NSA didn't invent Bitcoin.
How so? If the NSA really hated bitcoin, what would they do? Even if it were made illegal in the US, the United States are not the world, and it would be extremely hard to enforce.
NSA, China, Russia, most governments really, and possibly a lot of banks, could do a 51% attack and shut down transaction processing... or do double spends, but shutting down all transaction processing seems more damaging. This won't ever change, unless Bitcoin really causes governments to lose most of their power and money.
Edit: gavin has a plan (http://gavintech.blogspot.com/2012/05/neutralizing-51-attack...) but my guess is if they did the work to start an attack in the first place they'd have planned for gavin's plan and acquired enough older coins to foil it. It'd be nice if more thought went into other ways to thwart a possible attack but I'm not sure there really are any. Most people seem to discount and completely avoid the issue.
A direct attack by a state actor (especially one like the US, which likes to be seen as following the rule of law) isn't too likely. China might attack bitcons, but why would they - they can just block them.
The people who do black ops don't generally do so to help the financial sector. They do so for national security. While the economy (and monetary system) is arguably a national security issue, I can't see them all being on the same page. The guys in treasury would probably rather talk to regulators than intelligence.
Simply banning them, and enforcing that ban would work though.
Folk might want to print out Bitcoin wallets or store devices in a Faraday cage... in the unlikely event Kim Jong-Un pulls a wild card! :-)
http://www.washingtontimes.com/news/2012/dec/19/north-korea-...
They'd be useless without a hard-copy block chain to back them up.
Forgive me if this is a joke that I'm not getting, but they wouldn't be useless at all:
1) Bitcoin is a p2p distributed network with nodes all over the world. Even if a nuclear attack took out the entire US, the network would continue to work as long as segments of the Internet did (and recall that the Internet was originally designed to protect US data networks from nuclear attack).
2) It's quite simple to spend Bitcoins as long as you have access to a Bitcoin node (see above) and a copy of the 32-byte private key string corresponding to the public Bitcoin address the coins were sent to. This short string of characters can be written on paper, etched into stone, whatever.
The receiver can't be sure that the Bitcoin hasn't been double-spent without waiting on changes in the block chain to propogate; that's not easy in the middle of a nuclear wasteland.
Right, or even be sure that its a legal bitcoin at all, and not just a forgery.
It'd be nice if more thought went into other ways to thwart a possible attack
Given that the BitCoin community/industry has been getting hacked lots and there is widespread ignorance of security ("unsalted md5s for passwords!"), I don't have faith this'll change.
Maybe they're in the process of gathering their coins!
"even if [bitcoins] were made illegal in the US, the United States are not the world, and it would be extremely hard to enforce"
Blacklist the Bitcoin exchanges and any foreign financial institution that transacts with them from the U.S. financial system. The script was updated with the twin salvos against online gambling and Iran.
More reasons to use Bitcoin.
I like that you said use and not hoard :P
They could buy a bunch of ASICs, keep pulling off double spending attacks until everyone loses confidence in the Bitcoin system, and call it a day.
Heres more on double spending attack vectors: https://en.bitcoin.it/wiki/Double-spending
But heres the question: how long would it take for governmental bureaucracy to amass the resources to execute such an attack without raising a flags from other nodes who then will take proactive measures to not only mitigate such attacks but also alert others nodes on the network?
"But heres the question: how long would it take for governmental bureaucracy to amass the resources to execute such an attack without raising a flags from other nodes who then will take proactive measures to not only mitigate such attacks but also alert others nodes on the network?"
Do you really thing that purchasing a hundred million dollars worth of ASICs would alert anyone? The government spends far more than that in a given year, and there are government agencies that are good at keeping secret operations of that size secret. I would not rely on the inefficiency of bureaucracy when it comes to equipment procurement, certainly not as a security measure.
Also, what exactly would the honest nodes do to mitigate the attack? They can only buy more computing power to try to maintain control of the block chain. That is the real problem here: the effort needed to run the Bitcoin network is proportional to the effort needed to attack the system.
This goes into cancer nodes: https://en.bitcoin.it/wiki/Weaknesses#Cancer_nodes
"It's trivial for an attacker to fill the network with clients controlled by him. This might be helpful in the execution of other attacks. For example, an attacker might connect 100,000 IP addresses to the IRC bootstrap channel. You would then be very likely to connect only to attacker nodes. This state can be exploited in (at least) the following ways: The attacker can refuse to relay blocks and transactions from everyone, disconnecting you from the network. The attacker can relay only blocks that he creates, putting you on a separate network. You're then open to double-spending attacks. If you rely on transactions with 0 confirmations, the attacker can just filter out certain transactions to execute a double-spending attack. Low-latency encryption/anonymization of Bitcoin's transmissions (With Tor, JAP, etc.) can be defeated relatively easy with a timing attack if you're connected to several of the attacker's nodes and the attacker is watching your transmissions at your ISP. Bitcoin makes these attacks more difficult by only making an outbound connection to one IP address per /16 (x.y.0.0). Incoming connections are unlimited and unregulated, but this is generally only a problem in the anonymity case, where you're probably already unable to accept incoming connections. Looking for suspiciously low network hash-rates may help prevent the second one. "
One could even go further to do signal analysis on the network looking for nodes whose hash rates are more similar than others and hash rates per period of time (which will happen if such a large scale operation were in process), point them out to other nodes, and require that that node verify themselves with information which could allow for an independent audit by others before unflagging the node(s) in question.
EDIT: if anyone is interested in possible working on an open source project for rogue node mitigation that miners can install on their rigs, im game :P besides i think it would be more fun than going solo with my algos on the BTCUSD cross exchanges :P
Those ASICs just hash SHA-256, which isn't specific to bitcoin. The NSA probably has enough of those already, for other purposes.
It's actually double hashed - sha256(sha256(x)). So any asic they already have wont be optimized for bitcoin.
Or know mathematical weaknesses in it.
The NSA is one of the largest employers of mathematicians in the world. They don't sit around doing Sudoku all day.
It's probably pretty popular in the break room though.
>If the NSA really hated bitcoin, what would they do?
Well, the NSA couldn't do much, but the federal government could. The CIA could set up Bitcoin exchanges then have them "hacked" for one thing.
Governments could tax all bitcoin transactions that go through a centralized entity (such as Mt. Gox) a non-trivial amount, which would effectively kill it as a mainstream currency.
It's worth noting Bitcoin's lead developer, Gavin Andresen, was invited to the CIA HQ in Langley, VA to a US Intelligence conference in June 2011. [1]
So 'tacit consent' is quite likely indeed.
[1] https://bitcointalk.org/index.php?topic=6652.msg146198#msg14...
edit - I mispoke regarding location, it was the CIA HQ. However, the 'emerging technologies conference' was for the broader US intelligence community.
CIA, not NSA. Though of course there could have been representatives there.
I think it's also worth noting that covert agencies may find benefits of their own in a public global system for moving money around quickly, verifiably, irreversibly, and somewhat anonymously.
Reminds me of Tor.
"Tor was originally designed, implemented, and deployed as a third-generation onion routing project of the U.S. Naval Research Laboratory. It was originally developed with the U.S. Navy in mind, for the primary purpose of protecting government communications. Today, it is used every day for a wide variety of purposes by normal people, the military, journalists, law enforcement officers, activists, and many others." https://www.torproject.org/about/overview.html.en