The following content is
provided under a Creative Commons license. Your support will help
MIT OpenCourseWare continue to offer high quality
educational resources for free. To make a donation or to
view additional materials from hundreds of MIT courses,
visit MIT OpenCourseWare at ocw.mit.edu. GARY GENSLER: I
just want to say how touched I am that you
are all still here. I really– you know, there's a
lot of shopping opportunities in the MIT courses. And that you have come
back and not shaken loose after reading
Satoshi Nakamoto's peer-to-peer Bitcoin paper,
or maybe you just came back to see whether I was going to
crash and burn describing it. But what we're going to try to
do in the next three classes, just to frame it,
is really give you some of the technical
underpinnings of blockchain technology
through the lens of Bitcoin.
Bitcoin is just the first use
case of blockchain technology. So if I often say Bitcoin
this or Bitcoin that, it's really largely– not entirely–
largely applicable to blockchain technology. My feeling is I'm only about
eight or nine months ahead of all of you. I may have spent my
whole professional life around finance and
public service, and I can talk a lot
about markets and about public policy, but
MIT has given me the gift of thinking about
blockchain technology. And I'm trying to return that
gift a little bit for you all.
And I have a few
computer scientists in the room that are
going to bail me out if I don't get this right. Sabrina, and then, oh, I
see Alin is putting up his– do you all know Alin? He's actually a PhD student
at MIT, computer science. So somebody gets to that
part of their life– AUDIENCE: Terrible life choice. GARY GENSLER: Yeah, yeah. What was that? AUDIENCE: Terrible life choice. GARY GENSLER:
Terrible life choice. Yeah. But he's going to
bail us all out. But the reason that I think it's
relevant not to just belabor it, is I really believe
the only way that any of us can get to ground truths is
to know a little bit about how the inner workings of
this technology are. You're not going to
have to do an algorithm or actually do a hash function,
but to know underneath it.
And then you can
step away and say I no longer need to know how
the carburetor on the car works, but I know what a carburetor is. Or, you know, whatever
analogy you want. So with that little
bit, as opposed to sort of all of that
Socratic cold calling that I did last
class, because money, Fiat currency is
something at the core, and ledgers is at the
core of a Sloan student's either education or background,
this a little less of the core. If today's and the next
couple of lectures, if you can work with me then
I want you to interrupt me anytime you've got a question. I'm not going to do
much cold calling. I don't want you
to relax too much. I still want you to do the
readings the next three classes. But just raise your
hand, stop me, say, well, but what is that all about. And that just sort
of we can work a little bit different
on these next classes. So, as I'm always going
to be doing, consistency. What are the study questions? So really, what are
the design features? What are the key design
features of this new technology, blockchain.
And I put a few on the syllabus. And we're going to go through
all this today and next week. Cryptography,
append-only, timestamps blocks, distributed consensus
algorithms, and networking. I list four. Later in this lecture,
you'll see 8 or 10 that– I guess it's 10 that we're
going to really dig dig into. Can I just get a sense
of the class and this is not for Talita or
Sabrina to write down notes about participation. Is it a decent assumption,
did most or all of you at least read Nakamoto's paper? All right. Good. All right, great. Just a sense, how many of you
felt you got at least half of it, maybe less than 2/3,
but at least half of it? All right, pretty good.
When I first read it,
I was right with you. So it's all right. Alin you got more than
half of it, right? AUDIENCE: I read it
five years ago, so. GARY GENSLER: You read
it five years ago. Yeah, yeah, yeah. Yeah, life choices,
talk about it. All right. And you're taking this class. Good, good. So we'll go through
each of those. And then more
specifically, we're going to peel back
the cryptography. The two main cryptographic
algorithms, or these words that you'll hear sometimes,
cryptographic primitives– Alin, what is a
cryptographic primitive? AUDIENCE: Oh, it's
a wild beasts. There are so many of them. GARY GENSLER: Yeah, but what's
the two words together mean? AUDIENCE: Well,
that's I'm saying. It could be anything. It could be a hash function,
could be encryption function, could be a very powerful
computation scheme, it could be a data outsourcing
scheme, could be a data access privacy access.
GARY GENSLER: But
it's anything that basically protects
the communication in the presence of adversaries. AUDIENCE: Well
it's also something that you can use to prove that
computation was done correctly on trusted servers. It's not just communication,
it's also computation. GARY GENSLER: So
communications and computation that needs to be
protected or verified, have some form of
cryptographic algorithm, which happens to be called
a cryptographic primitive. The two main ones– and there's a third one
we'll talk about later in the semester– but the two
main ones, hash functions, just as a working knowledge of
blockchain is worthy to know, and we're going to get–
everybody's going to get there. We're going to all
get there to where you have some sense of
what a hash function is. And then this whole concept
of digital signatures, which relates to
asymmetric cryptography.
Those two are very fundamental
to blockchain technology. Later in the semester,
we'll talk a little bit about zero knowledge
proofs, but they're not as fundamental to the
first application. And so that's why
they're kind of– and they help make things
verifiable and immutable. And that's the business
side, the market side. Why does it matter? Otherwise, like, who cares
what's in the carburetor if it doesn't matter? And then how does this
all relate to the double spend problem? I can cold call on this.
Isabella, do you remember
what the double spending problem was from? AUDIENCE: It was when they
would use the same coin, I guess, and they would
use it multiple places and other digital
wallets [INAUDIBLE].. GARY GENSLER: All right. So in essence, a
double spend is when you have a piece of information
and you use it twice. And we happen to call this
piece of information "money," but you use it twice. You can send an email to
two people and that's OK. I mean, it's a
little embarrassing if you're sending it to
one friend telling them you're available for
dinner and the other friend thought you told them
you weren't available. But you can still
send it to two places. But in the system of money,
it's a critical thing that you don't use it twice. The readings, was
the demo helpful? I mean, we're going to
do a lot more on that.
I watched that demo
last November, December. That was one of the
first things I watched. From an MIT student. I don't know if
you knew Bosworth. And I found it very
helpful, so I'm glad. And I see it's actually
that demo is on a Stanford blockchain course as well,
so the West Coast, one of our competitors is
using an MIT product. And so we're going to just
do a slight review of what we did in class 2. And then we're going to
talk about the key design features, hash functions,
as I mentioned, what is an append-only log,
block headers and Merkle trees, and asymmetric cryptography
and digital signatures.
Crazy. We're going to cover
all five of those today. And then you're going
to tell me how we did. Oh, Bitcoin addresses,
which is just a small thing. Six, actually. So last time, for those of
you that weren't with us, we talked about money. And again, money is
just a social construct, or an economic
consensus mechanism. We're going to talk
a lot about consensus next Tuesday when we
talk about the consensus protocol on Bitcoin. But remember, money itself
is just a consensus. There was a question
on Tuesday, I think Alin actually
had asked this question about well, what
does it mean to be a liability in the central bank? Why is money, what does
that actually mean? And I said it just means that
somebody else will accept it.
It's a social consensus
because it's not that they're going to
give you anything else. It's just that you can
get a bank deposit, you can pay your taxes, you
can use it at Starbucks, if in fact, you've already
gotten a cup of coffee. If you remember, it's only
legal tender for a debt. And so forth. Fiat money is just
in that long line. But it's had its challenges
and instabilities. It doesn't mean it's
going to go away. I'm not a Bitcoin maximalist who
thinks that Fiat currencies are going to go away. But Fiat currencies have their
instabilities, particularly around weak monetary policy. In essence, when you debase a
currency and allow a lot of it to be issued, or usually
around unstable fiscal policy.
So either the government
is spending a lot, the King is off to foreign
wars, and the Bank of England was actually set up in the
late 17th century in essence to control the currency
when the King was– of England, I think– was in wars with
France, if I can recall. A lot of banks, central
banks, were set up right about when a sovereign was
off debasing a currency and spending too much at war. Ledgers, we talked
about ledgers, how critical ledgers are. In essence, ledgers are
a way to keep records. And those records could
either be transaction records or balance records. We'll see that Bitcoin is set up
as a transaction ledger system. Later we're going to be
talking about other blockchain technologies that are set
up as balance ledgers. So one should not just
think immutability that there's only
one way to do this. But transactions and ledgers
are at the core of Bitcoin.
And central banking is of
course, built on ledgers. The master ledger of the
central bank, and then the commercial banks have
sort of the sub-ledgers. And then you can think
sometimes your digital wallet, maybe Starbucks has yet
a third tier ledger. We obviously live in an
electronic age already. We know this. There's been many
efforts, they've all died until Bitcoin
to crack that riddle that we talked about,
peer-to-peer money without a central authority. And later in the
semester when we talk about what
are the use cases, that's going to
be the core thing. It's why I'm not a maximalist.
I'm not sure in
every circumstance a central intermediary
isn't necessarily so bad. And this is not
a value judgment. It's just pure money and
markets and so forth. But in some circumstances,
decentralization really will compete and beat the
centralized intermediary. So let's talk about his little
paper, which of course he was modest, or she was modest. Please remind me, we don't
know who Nakamoto is or was, or a group of people. "I've been working on
a new electronic cash system that's fully peer-to-peer
with no trusted third party." So you've seen
this slide before. But a time stamped
append-only log. Just think blocks of data.
To kind of oversimplify, but
it's got a name, blockchain. And I don't think–
did Satoshi's paper, you all read it in the
last few days, I of course read it again yesterday just
to make sure I remembered it, I don't remember that he ever
used the word blockchain. Am I right about that? Right. So the words
blockchain are really– have been sort of layered
over his innovation. So information, blocks going on. And that leads to
basically a database. But it's the blocks of data. Bitcoin right now is
about 550,000 blocks, and the blocks are added on
average every 10 minutes. And we'll talk about why it's
every 10 minutes, and not only why Satoshi Nakamoto
made it every 10 minutes but how they maintain that. Other blockchains like Ethereum
it's about every seven seconds. So don't get too caught
up that it's all the same. And there's some technologists,
here Silvio Micali is working on Algorand
and that's even tighter, less than seven seconds.
So there's not one way. There's multiple designs on
how often blocks are added. But let's start with Bitcoin. Secured by yes,
guess what, those two cryptographic primitives,
hash functions and digital signatures. Lose anybody yet? Yeah? Maybe. And then there's a
consensus for agreement. The whole debate
usually about databases is who gets to change the data. And this is true
in all databases. In its essence, it's
usually centralized.
But in blockchain, it's all
a sudden, well, maybe it's not centralized. Who gets to add that next bit
of information, that next block? And the consensus agreement is– which we'll discuss
next Tuesday– is about that very issue. And I think there was
a little pretty picture of that done in slides before. But I'm going to I'm going
to delay that discussion until next Tuesday. And hopefully you'll
all come back. So what are the key features? And I might do a
little cold calling. Do you remember any
key feature, Tom? From the papers? AUDIENCE: Oh, boy. GARY GENSLER: It's all right. AUDIENCE: Yeah. You know, the hash function. GARY GENSLER: Hash function. Any other key features? Let's see how many. I'm going to have
10 on this page. AUDIENCE: A private
and a public key. GARY GENSLER: What is that? AUDIENCE: Private
and public keys. Private and public– GARY GENSLER: Oh,
private and public key. Yes. So asymmetric cryptography,
or private and public keying. Yes, hash functions, yes,
private and public key.
Any other kind of
key design features, or words you didn't understand? Maybe that's another
way to put it. Leandro. AUDIENCE: Addresses. GARY GENSLER: What's that? AUDIENCE: Addresses. GARY GENSLER: Bitcoin addresses. Three. AUDIENCE: Timestamp server. GARY GENSLER: Timestamp server. That's four of the things. This is going well. [INAUDIBLE] AUDIENCE: Double payments. GARY GENSLER: Double
payment is something that it's trying to address. It's not really
a design feature, but it's a– they have a
solution for double payment, so I'll give you
a credit for it.
But it's– AUDIENCE: Miners. GARY GENSLER: All right. So Hugo says miners, which
is really the consensus. So I'll say that the
design feature is the consensus or proof of work. Kelly. AUDIENCE: The full node
versus the lightweight node. GARY GENSLER: Right. So very interesting,
this concept of nodes. And Satoshi actually
talks about full nodes or lightweight nodes. In essence, how much
information has to be stored. I want to reserve that. Kelly, please remind me
when we talk about block headers to come back to that. But nodes in the network is a
very important design feature. Over here. AUDIENCE: The Merkle
tree structure.
The Merkle tree structure. GARY GENSLER: Merkle
tree structure. So Merkle tree structure is a
way to compress a lot of data, and also to sort
through that data. Uh-oh. No, Sabrina's not going
to clean me out here. Merkle tree structure is there. We're going to talk about that. Two more. AUDIENCE: Nonce. GARY GENSLER: What's that? The AUDIENCE: Nonce. GARY GENSLER: Nodes. All right. What's that? AUDIENCE: Nonce. GARY GENSLER: Nonce.
The nonce. OK. So a nonce. Anybody know what
the word nonce is? A year ago I didn't. So this– so we're
all getting there. What, do I have a look, do
you know what a nonce is? Yeah. AUDIENCE: In the
actual protocol, it's essentially a guess
for the miners to kind of– GARY GENSLER: So
the word "nonce" means a random number
that is used once.
N for number, and "once." It's a number that's
random and it's used once. That's how I've learned it. Whew. And so one more, because
this is great, actually. AUDIENCE: Peer-to-peer. GARY GENSLER: Remind
me your first name. AUDIENCE: Pria. GARY GENSLER: Pria. Peer-to-peer. All right. So this is what I have. Cryptographic hash functions. We're going to go through
these in more detail. Timestamped append-only logs,
block headers and Merkle trees. So Merkle trees were discussed. But we need to actually
say what information is kept at the head of the block
as opposed to all the body. And some of that's just to
make it more manageable. Asymmetric cryptography,
which is this public key, private key, and signatures.
The Bitcoin
addresses themselves, which interestingly are a little
bit different than public keys. And then I breach break
because in the next, we're going to talk about next
Tuesday, the proof of work, the miners, the then the
nodes, the nonces, they're are all in that little topic. There's actually in Bitcoin
a really important protocol is how information gets
propagated on the internet. Just the network communication. It's not written about a lot. You won't read a lot about it
in Nathaniel Popper's Digital Gold or all the
other popular books, but it is an important
thing to remind ourselves that information has to
propagate around the internet and all these transactions have
to communicate with each other. There's currently about 10,000
nodes on the Bitcoin network.
We don't know where
all of them are, but they're probably in
180 different countries. And so it's just– also the networking and
communication matters. And it matters to
the economics a lot. There's a native currency. This is interesting that it was
the one thing that no one said. That's an actual
technological design feature. It's not only that he
created a currency, but the native currency is
part of the economic incentive system. And we'll have
some fun with that. In essence, he
said that when you mine and did the proof
of work, you created and you've got some native
currency called Bitcoin. So he created an economic
incentive system. Whomever Satoshi
Nakamoto was or is knew a lot about economics,
as well as technology. Yes. AUDIENCE: I just wanted to
quickly add to what you said. So it's not only that he
created this native currency, but wants the finite supply
has reached, the currency can be distributed as
a transaction fee, which I think is very
important in [INAUDIBLE]..
GARY GENSLER: And remind
me your first name? AUDIENCE: Daniel. GARY GENSLER: So
what Daniel just said is really interesting. Not only to take light of
this individual or individuals that did this. But this world of Bitcoin
and other cryptocurrencies creates a unit of account
that could be valued. And once it's valued, you have
sort of a native currency. But as Daniel
said, Nakamoto also said there would
be a finite limit. It happens to be
21 million Bitcoin is the most that it
can be, and we'll get there around the year 2040. Does anyone know how many
Bitcoin there are right now? About half of you
were investing in it. Hugh? Hugo? About 17 million
Bitcoin right now. And all 17 million have
come from this process of proof of work and mining.
Initially it was 50
Bitcoin every 10 minutes, roughly every 10 minutes. Then it went down
to 25, and we're now at 12 and a half Bitcoin. And does anyone know what
today's value purported– I always should say
purported value of Bitcoin, because I don't
know if we can trust some of those websites that
say with the values are. What is it? AUDIENCE: $6,500. GARY GENSLER: So
$6,500 of Bitcoin at 12 and a half
Bitcoin to mine a block. So you see that
it's about $80,000 US is the reward to
mine a block, right? So he created an
incentive system that initially, if you
got 50 Bitcoin and they weren't worth a penny, you
would not commit that much. You had to be a hobbyist,
basically, in 2009, or a cyberpunk, or
just kind of curious. Because you weren't
getting much incentive. If in fact it's
worth 6,500 today, you're getting $80,000 if you
actually successfully mine a block.
And then there's the
transaction inputs and outputs. Think about a check, who signs
it, where you move money. There's something called the
unspent transaction ledger. So this is the ledger part. So when you think– I think of the
technology, I think of cryptography,
which is kind of all that stuff at the top which
we're going to discuss today. Secondly, the
consensus mechanism. In essence, that's
that key question of any database, who gets
to amend the database? Who gets to decide to change the
state of what we all agreed to? And then thirdly, is the ledger,
or the transaction ledger, which we're not
going to deep dive into the scripting
language, but we are next Thursday going
to talk a little bit about the underlying scripting.
Does that give you a path
that's all this cryptography, the consensus, and
then the transactions. Yes. AUDIENCE: I have a question. GARY GENSLER: And
your first name? If everybody just
says first name. AUDIENCE: Oh. I'm just curious, so
you mentioned that– GARY GENSLER: I'm curious
about your first name. AUDIENCE: Sean. GARY GENSLER: All right. AUDIENCE: So just
curious, you mentioned that the block value is
roughly $80,000 US as of now. So just curious, in
terms of the CPU power, the electricity that will be
consumed to mine the block, how much does that translate
to equivalent US dollar terms? GARY GENSLER: So the
question that's asked is how much electricity is
being consumed for that miner to get that reward,
that $80,000.
And I'm going to try to
answer in one minute. But we'll come back to this
later in the semester about economics, and blockchain
economics, and mining economics. But what has happened
over these 10 years is more and more
computers are being used, or are trying to
mine for the Bitcoin. And so today in the most
recent research I've seen is that the probability
of winning a block– there's so much– is it
measured in terahashes? I can't remember the numbers.
But it's how many terahashes,
which, is it 15 zeros Is a terahash? Is it that, or is it 12? Well, in any event,
there's so many hashes being done a second, x
number of terahashes, that your probability
of winning is quite low. And so what's happened
is most nodes and miners have entered into agreements
called mining pools, where they smooth out the
risk and everybody shares in the rewards. But those economics
we'll talk about later, it's thought to be that
you need electricity cost around $0.03 a kilowatt
hour to be successful. And in most parts
of the world you can't get electricity for
$0.03 a kilowatt hour. So you would put
your mining rigs where you can get
low cost electricity or where you possibly can– you can get it legally low
cost or illegally low cost. So there are a
lot of mining rigs and in jurisdictions where there
may be local officials that are allowing those
mining rigs, and instead of $0.03 a kilowatt hour
to the electric company it's $0.01 to $0.02
cents a kilowatt hour to the local
government officials. And the two largest
mining pools are in China.
And the third is in Russia. But we'll get into
the sort of economics and at least some theories about
why some are where they are. So cryptography. So Alin's probably
going to clean me up. It's not just communication in
the presence of adversaries, it's also computation in
the presence of adversaries. That would be good. And we talked about– we're
not going to deep dive. If you remember, even in ancient
times if you were going to war there was this
wonderful little way that you could do cryptography.
And then anybody who's
seen imitation games about the British breaking
into the German codes, even though they
should have probably given more credit to the Polish
government that had probably broken into it in the 1930s,
but Turing did great work. And then we're going to talk
about asymmetric cryptography today. All right. What is a hash function? A hash function, and these are
just words that I think of it, I think of it as a
fingerprint for data. But it has certain properties. The one that you'll
see throughout is that it takes
inputs of input x. It maps that input of
any size to a fixed size. So one that we use
here in the US, one hash function we all
use is zip codes, in a way. It's five digits,
it's a fixed size. I know I'm doing this as a loose
hand, how can I think of it. But zip codes. You might have 50,000 people
or 5,000 people all living in one postal district. And you can map them to zip
codes, and it's a fixed let.
Now, I don't know whether my
friends in the computer science departments– but it's an
early sense of a hash function. I just wanted to say there are
tangible things in our life that act like hash functions. Problem with zip codes
is it will not in any way be a secure hash function. And you'll see that in a minute. But it does take– you can be a 300-pound
person or a 30-pound kid and you still map into
the same zip code. It's deterministic. It's always the same. So if you take a
certain set of data, it will always give
you the same hash. And that's relevant
to the background. And you can
efficiently compute it. You don't want to take
a year to do this. You've got to do it in
short periods of time. And in Bitcoin's case,
it's done in nanoseconds or less, because they're one
computer, one CPU can do– can't remember, probably–
how many millions a second? AUDIENCE: Couple of
terahashes a second.
GARY GENSLER: Couple
of terahashes a second. So it's a remarkably
efficient algorithm. And so a bunch of
mathematicians– and hashing started in the 1950s
and '60s, but the ones that we're talking about
here are much more recent. But it's really
terrifically talented scientists, mathematicians,
computer scientists, and sometimes the National
Institute Standards of Technology here in the US
working on hash functions. So it takes a array of any size,
puts it into a fixed number– I think zip codes for a minute– it's deterministic. It's always– you only live
in one zip code, in a sense. And it's very efficient. But now what are its
cryptographic properties? Because a zip code
wouldn't make it. It just wouldn't. Well, the computer
scientists use this term preimage resistant. I would just say
it's one way, you can only go one way, meaning
it's infeasible to determine the input from the output. It's infeasible to determine
the x from the hash of x. Does anybody know why I use
the word infeasible rather than impossible? AUDIENCE: [INAUDIBLE] GARY GENSLER: First name? AUDIENCE: Brotish.
GARY GENSLER: Brotish AUDIENCE: Because we can
do it with brute force. GARY GENSLER: So you might be
able to use it brute force. What do you mean by brute
force, just so everybody– AUDIENCE: Try all the options. GARY GENSLER: Try all options. But as I understand it, a
sort of tenet of cryptography for centuries is not to have
it mathematically impossible, the point is getting
it so infeasible that your adversary can't
either get the communication or so forth. So hash functions,
I just say this because you can't assume
that Bitcoin can't be broken. We all call it immutable. It is immutable. Until the hash functions
that are inside of Bitcoin might be broken.
And even Satoshi wrote
about this in 2010. He got emails. There's this wonderful
book if any of you want that I mentioned in
the bookshelf at the end of the syllabus, he said, well
what if a SHA-256, which is the hash function, gets broken? And his answer, by
the way, was well, there will be a better
hash function at that time. Whatever that is, we'll
hash the entire system, whatever that is. Because remember, you can
take something of any size, hash it with a new
system, and move forward. And so he or she felt
in this wonderful email is that Bitcoin actually
could transition to a new hash function as long as you
had a little bit of time before it was all corrupted. Kelly. AUDIENCE: Is this what his
article called the Gambler's Ruin problem? Is that we you're describing? GARY GENSLER: The
Gambler's Ruin problem.
AUDIENCE: The probability that
an attacker could catch up to recreating it. GARY GENSLER: OK. AUDIENCE: That's something else. That's– GARY GENSLER: Will you
speak a little louder? AUDIENCE: Yeah. So that's the– you
want to sort of assess how hard it is to fork Bitcoin. If I have a lot of
computational power, how hard is it for
me to create a fork? And Satoshi does an analysis
at the end of the paper– GARY GENSLER: Oh, I apologize.
You're talking
about in his paper. Yes. In his paper, he's
talking about how hard it is computationally to
do what some people call a 51% attack, to basically
take over all the nodes. And that part of his
paper we're going to talk about next Tuesday. But it's basically, can
you take over the nodes? I was talking about
a separate thing, can you break the cryptography. And he doesn't write
about that in his paper. He writes about it in an email
about 10 months later or so. Second key cryptographic thing. So we said one is it's one way. The other thing is this
concept of collision resistant. I presume if everybody in this
room told me your birthdays, there's multiple
people in this room who have the same birthday. And in fact, if we got it
past 26 people in a room it's over 50% chance that two
of you have the same birthday. We don't need to get to 183
people in the room, which is half of the days of the year.
We can get to about 26 or 7. And similarly, the key thing is
is that two sets of data are– it's again, infeasible
that x and y would hash to the same thing. It's not impossible. It's infeasible. And if you look at the
history of hash functions, this is usually the thing,
that at some point in time these hash functions will
not be collision resistant. Some quantum computing
will come along, or something will come along. But for now you can put
something of any size in and they're independent.
They also look terribly random. It's called an avalanche
effect, meaning you change one little
difference and the whole thing looks different. So when you noticed
on that little video, if you changed one thing,
it all looked so different. And why that's important
is it makes it more secure. And then there's something
called puzzle friendliness. Even if you know a
little bit of the input, it doesn't mean that you're
going to get the output. I put these up here not
for you to know them. You're not going to get tested. If you go into
business, as Elon, you've started, when you
probably haven't thought, well, collision
resistant this or that.
But I just wanted
you to know there is a bunch of cryptography
underneath this. And the key is it is
not 100% immutable. It's probably one in,
you know, I don't know, a quadrillion immutable. But there's still– these
things could be broken. And quantum computing and
something else might– Alin. AUDIENCE: The actual probability
should be actually 1 over 2 to the power of 128. So much more than
one quadrillion. GARY GENSLER: So it's 1
over 10 to about the 40th. How'd I do? My math all right? All right. And anybody who's interested
can come to office hours.
So it's highly
unlikely to be broken. But I think it's always
worthwhile to say, well, no, there's some outward– it's not as bounded
as you think. So what is it used for? In many places it's used
for names, and references, and pointers, and in
something called commitments. In Bitcoin, it's used for
pointers because one block points to another block. But it's also used
in commitments. You'll hear these words. We're not going to
delve into them. But the headers and the
Merkle trees use something called SHA 256, which
is a standard which is literally 256 bits long. That's like zeros and
ones for 256 registries. But a Bitcoin address actually– Satoshi Nakamoto
threw on a loop. I'm glad to debate why, but
he uses two hash functions for Bitcoin addresses.
The one thing I saw
that he actually wrote about it is he
said if one of them is broken at least the other
one is less likely to be broken. So as I've read
about it, I think in his own voice is you have
to hash something twice. And he was just making
it that much more secure, even knowing it was one out
of 10 to the 40th chance. AUDIENCE: Which is
astronomically low, so. GARY GENSLER: Right. So. So remember, where's Caroline? I remember– there we are. You asked me about, I
thought I had set it up for today, which you
were good to remind me for Tuesday, what's the
longest running hash, time stamped hash? AUDIENCE: That is
a great question. GARY GENSLER: Thank
you for the compliment. AUDIENCE: The answer is– yeah, I don't know
that phonetically, so I'm not sure if I'm
totally butchering this one. But it came out of Bell Labs
with Stuart Haber and Surety. GARY GENSLER: There he is. Yeah. So Haber and his
colleague– yes. You got it. AUDIENCE: That's my roommate. GARY GENSLER:
That's you roommate.
Terrific. So I'm just trying to say it
wasn't Bitcoin that had it. He did this in 1991. But by 1995, they started
a company called Surety. I don't think it
took off that much. It's not competing with Apple
for the largest market cap or anything like
that or Facebook. But every week in
the notices section, you can see a hash literally. It's time stamped because
it's in the New York Times. And it's a hash, all those
funky digits and everything of all the information
came before it. And they're basically
hashing any document. Any document that you want
a timestamp in that week, you put it in. One follows another,
and that's a blockchain. It's not about money. There's no native
currency and so forth.
I believe that
Haber and Stornetta are three of the eight or nine
footnotes in the Satoshi paper. Maybe it's four of them. So he gets his credit. And if you go to his
website, Stuart Haber, I think he says,
blockchain's co-founder on his personal website. Who knew? So here, we get– this
was in the National Institute, the NIST paper. But timestamp append-only
logs in Bitcoin or blockchain. What is put together is the
header, the top information. And if I can go past the visual
and just say, what's there? There's five pieces
of key information. The version, it doesn't
change that often. But there is a version number. The previous block's
hash, so it's some information about all the
blocks that came before it. The Merkle Root hash, which does
anybody want to tell me what that does, the Merkle Root? AUDIENCE: So it essentially
posts the transactions in the bottom most
layer of the tree and then creates
the [INAUDIBLE] hash of each of the transactions.
GARY GENSLER: So if I go back
to this nice little picture, the yellow box at the bottom
up each of these blocks is all the transactions. There could be upwards to 1,000,
2,000 transactions in a block. So there's blockchain
concept, 1,000, 2,000. There's means and methods
well before Nakamoto's paper about how to compress that,
how to keep that information a little bit tidier. And that uses this thing
called Merkle Roots. The five items right at the top,
what's called the block header, doesn't have the
1,000 transactions. And earlier, Kelly,
you had asked me about full nodes
and light nodes. A light node or a
wallet that anyone here could download on
your cell phone probably does not
download the millions of transactions
that have happened in the history of Bitcoin. You are unlikely to download
what's called a full node. But you might download
all the headers, this bit of information
that's all of the headers. All of the
information in Bitcoin is still not that large.
It's less than 200 gigs. But all of the headers, I
think, is single digit gigs. I can't remember if it's four
or six gigabytes right now. What is the number? AUDIENCE: The
header is 80 bytes. So it's 80 bytes
times 500,000, which is 50 megabytes, 60
megabytes of headers. GARY GENSLER: So
it's 60 megabytes, so it's much smaller as
opposed to like 180 gig. So Satoshi was
thinking in advance. And every blockchain that
you're going to work on, likely, I mean, there might
be some, this concept of it's really keeping the security
by a little bit of information in something called a
header and then pushing all the meat of the
transaction and data down. And this is really
important when you get to like
Ethereum where there's a lot of data, a
lot of computation down in each of these blocks.
It's sort of like
if Stuart Haber had a lot of documents and
pictures and everything. You don't have to
have all the picture quality and a whole movie. You can actually
hash a whole movie, and you still get
these 256 bits. So whoops. So the header has the previous
hash, this Merkle Root, which is just a way to
get all the transactions. Just think of a Merkle
Root as a way to grab 2,000 transactions in a way. A timestamp, that one's easy. We can get that. Difficulty target, anybody
know what blockchain, Bitcoin tried to
do to make it more or less difficult over time? No. Brodish, we've heard. AUDIENCE: [INAUDIBLE]
time but such that it stays with creating
a block every 10 minutes. So with more
computational power, it gets harder to find a block. GARY GENSLER: So it's
harder to find a block, the more miners there are. So every block header
needs to have some what's called a difficulty target. How difficult is the
mining going to be? Since we're talking about
mining next Tuesday, these all bring me back
to difficulty target.
And then what's a nonce? AUDIENCE: [INAUDIBLE] GARY GENSLER: What's that? AUDIENCE: Just a random number. GARY GENSLER: A random
number that's used one. Number once, nonce. And that's hash functions. How'd we do? We're a little off the skids. We are MIT. Yes? AUDIENCE: I have a question. The number of characters in
the hash is equal to your– GARY GENSLER: The
output, not the input. AUDIENCE: No. No. They put the number of
characters in the hash is limited, right? So that's a pool of
functions that you have.
When you have many,
many transactions, that's like a flow, right? So internally, you're just
consuming and consuming hashes up to a point where you're
going going to repeat that hash, right? So how do you know
for the same has, you have two
different information, to which information
you're referring to? GARY GENSLER: So could you help
me pronounce your first name? AUDIENCE: Diermo. GARY GENSLER: Diermo, has
asked the right question. He's say, well, how do you know? Especially as you have more
and more time and more and more time, you might get the
same output of a hash from different inputs.
And if you recall– wait. Somebody does recall. Now before Brodish,
in front of Brodish. AUDIENCE: The papers
mentioned that it's possible that two the hash
of x equal to hash of y. But if the miners are
working at the same time, if the same information are not
treated at the same exact time, it won't be a problem because
then they just continue just like two different– GARY GENSLER: So you're correct
as it relates to mining. But there is another
piece of it as well is that the hash
function, if it's a good cryptographic
secure hash function, is what's called collision
resistant where what you're saying is so
infeasible, in fact, 1 divided by 10 to the 40th,
that's a 1 with 40 zeroes after it.
It's so infeasible to happen,
it's possible but infeasible to happen. What you're referencing
is what if two parties solve the cryptographic puzzle
as opposed to a collision. And because of the difficulty,
they just got at the same time. Please. AUDIENCE: It seems like
a dumb question but– GARY GENSLER: No. There's no dumb questions
when it comes to this. I really mean that. AUDIENCE: The timestamps
attributed, so is it from the whole system or? GARY GENSLER: So timestamps are
not a particularly important part of Bitcoin. They are timestamped. But sometimes if somebody
puts something off and it's off by a few minutes
or even up to two hours, there's a check
in the technology in the scripting function
if the timestamp's off more than a couple hours.
So literally, it's
not that precise. Having said that, the real way
that timestamping happens is if a block is mined and it's the
540,000th block and it's sort of accepted in all the nodes,
these 10,000 nodes start mining the 540,000 and 1st
block, in essence, it's just think of it
as almost like a stack. And so what's, in essence, more
relevant than the actual time that's in the
header, and they all have a timestamp in
the header, but what's more relevant is the
order of the blocks, and, most importantly,
the previous block hash. Yes? AUDIENCE: I would say that
without the timestamps, you cannot do this
difficulty readjustment. The timestamps are
very important.
If you don't have
timestamps on the block, you cannot do the
difficulty readjustment, which is necessary to keep the
rate of blocks 10 minutes after [INAUDIBLE]. GARY GENSLER: I'm going
to partially agree with you because the difficulty
adjustment happens every two weeks. So even if any one individual
or five or six timestamps are a little goofed
up in the two weeks, the algorithm is basically
looking over the course of about 2,000 blocks. AUDIENCE: Yeah. So a little goofed up is fine. But you need the timestamp. GARY GENSLER: You
need the timestamps. But it's more important
is basically the– here, I'll go back a slide. It's the order of the blocks. Please. AUDIENCE: Going back to when
we talked about collisions. The paper didn't
really go into detail, but it said like in
addition to how unlikely it is with to the power of 128
that even if there were two that hashed to the
same kind of has digest that it would be
unlikely that they'd both be valid in the context. So given what's a valid
blockchain transaction that that could
even further reduce the likelihood of any
problems, which there wasn't a lot of detail as to
why the blockchain context would even make two hashes of the
same value even more unlikely because of the context.
GARY GENSLER: I want to hold
that question for Tuesday. But it has to do with rather
than the collision issue, what the paper is talking about is
if two miners solve the puzzle. And that doesn't mean that
they got identical hashes because the puzzle is not
geared to getting an exact hash. The Bitcoin puzzle is
having a certain number of leading zeros. So it's literally
started, I think, it was nine or 10 leading zeros. I'm talking about 10 years ago. And now, you have to hash
to something with, I think, it's about 20 or
26 leading zeros. Meaning it's gotten
more and more difficult, and the result of
the hash has to have a bunch of leading zeros,
what you saw in that video. I'm sorry. AUDIENCE: I have a question on
how the hash, the [INAUDIBLE] hash comes about. So if it's only hashing
the transactions, how does it change when the hash
of the previous block changes? GARY GENSLER: OK, so, Addy. It reminds me of
that old television show with Johnny Carson.
And you just did a great
setup for the comedian. So thank you. So I'm going to go
to Merkle Roots. So Merkle Roots, which
are a binary data tree, looks something like this. If one had 1,000 transactions,
I wouldn't have a pretty slide. So this only goes
to four levels. But think of four
transactions at the bottom. They're each hashed. And then you concatenate. You put the two hashes together. You hash that. You keep going up the tray. If you had 1,000 transactions,
because that's 2 to the 10th roughly, then you'd have
10 levels of this tray. And so that's what happens. And literally, the mining pull
operators are doing this a lot for the nodes. But in the Bitcoin
core application, in software that
anybody in this room could download the
software if you wished. There is software that helps,
takes transactions, puts them basically into this binary
tree called a Merkle tree, uses hash functions, and
basically skinnies it all the way up to the top.
Does that– AUDIENCE: I think
what my question was that given that this
structure exists, how does the root hash change
with the previous block? So basically, we saw
that if you change the hash of the previous
block, all the blocks forward will get invalidated
because the hash changes. But it doesn't seem to
use the previous hash. GARY GENSLER: So I'm going
to repeat the question. Does the Merkle Root
that is basically a summary of the
10,000 transactions that are in a block change if
the rest of the header changes or the previous block change? And the answer is no.
It only changes if some of the
data in the 10,000 transactions change. And so a Merkle Root
will change if you put different
transactions in the mix or, as is really important,
one of the incentives. You get your 12 and
1/2 bitcoins today in what's called a
Coinbase transaction. And so one of these
1,000 transactions is the payment to the miner. So the Merkle Root
would be different depending upon who wins. But that wasn't your question. I'm just saying. But Merkle Roots are
a very efficient way to take thousands
of transactions, store it up, have one spot. Please. AUDIENCE: So the order of
the different transaction has to be exactly the
same for everyone that is hashing, right? GARY GENSLER: No, actually not. So if you're hashing, and
you're running a mining rig, and Elon's running a mining
rig, if Elon solves the puzzle and propagates it
out on the network, and people start mining
on top of Elon's block because they say,
well, he's finished. You're not– you're just
going to probably start mining on the top of his block
and look in something called the mempool.
The memory pool is
this network of all the free floating transactions. You'll scoop up the next
set of transactions. AUDIENCE: And so
how can we validate that all the transaction
he wrote are the real ones? GARY GENSLER: All
right, so validation, which is more next Thursday,
but I'll give it a shot. No, no, no. It's a good question. Every transaction– or
actually, you're setting me up, digital signatures. There you go. Thank you. Did you have a question or
I'm going to on to digital. So the second
cryptographic thing, and we're going to keep
going back and forth, hash functions are basically a
way to compress a lot of data, have a fingerprint, make sure
that it's basically commitment. Digital signatures, well,
remember that little graph that we had Alice and Bob? Alice wants to send a note to
Bob and just say, hello, Bob. She wants to encrypt it. She encrypts it with Bob's
public key, sends it to him. He decrypts it with
his private key.
You might say, oh my god,
Gensler, what's a private key? What's a public key? In cryptography, it's a way to
kind of scramble information. I know. I'm really making this like– So if we went back to
that little mechanism the Romans used or we used what
the Germans used in the Enigma machine, they were
symmetric cryptography. Both people had the key. The key was the Enigma
machine with five rotors. In the 1970s, some wonderful
technologist here and elsewhere basically said, well, what
if the key isn't the same? Because the adversary
could steal the key. What if it's not symmetric
but it's asymmetric? There's a private
key and a public key.
In essence, there's
two keys that have some mathematical relationship. And the math between
these two keys don't matter for
a class like this. But know that the public key and
the private key link together. They're bonded together. But the critical thing is
about digital signatures, there's three functions. You have to generate a key pair. And when a key
pair is generated, a public key and a private key
are generated at the same time. And they need a random
number to go into it. And one of the things
that makes a lot of Bitcoin and other
wallets insecure, and it's probably why
some have been hacked, the wallets, not Bitcoin,
is because they don't have good random number generation.
Yes, Brodish? I saw– I was at a
conference last week where a technologist from the
University of Pennsylvania had done a survey of
150 hedge funds, mining companies, and Bitcoin wallet
companies and the like. So they actually let a
cybersecurity individual get inside and do a survey of
150 what you would consider really committed, high end
users of Bitcoin, miners and hedge funds and
crypto exchanges. And it was horrifying,
their cyber security as to what they're doing
with their private keys. Before he even got to the
private keys, many of them didn't really have a secure way
to create the random numbers to create their private keys. So it's just a piece. When somebody says they have
really good private key, public key, in the
back of your mind, just know there's got to be
some way to do a random number generation. That's the only
math that I'm going to ask you to remember of that. There is a signature function.
And the key thing is
a signature creates. You can create a
digital signature from a message
and a private key. So if Kelly has a
private key and wants to send a secret message to
somebody across the room– Isabella, you want a
message from Kelly? Kelly's going to
take the message. You got this, Kelly? You're going to
take the message, and you're going to sign
it with a private key. You send it over to Isabella. How's Isabella know
that it was from you? AUDIENCE: She has to
decrypt it with her key. GARY GENSLER: She's
got to verify it.
So there's a function called
a verification function, and it comes back just yes, no. I mean, it might
say it differently. But it's just a yes, no. It's a verification function. Isabella– you want
to do this with me– is going to verify
your signature is valid for this
message because you have the public key. So you're right. Isabella has your public key. But using your public key, she
can verify that the signature. It's magical math. Well, it's not magical math. It's real math. But it's not math we need
to study in this class. Yes, Hugo? AUDIENCE: Back to
generating the key pair. GARY GENSLER: Yeah? AUDIENCE: So they're
both generated from the random number? One is not– like
the private is not determined by the public
key or the other way around? GARY GENSLER: The public– you can think of it– in Bitcoin, it uses an
elliptic curve cryptography. And you can think of it
as that the private key is based on the random number. To be more technical,
the random number is what gets you
to the public key.
But I think of it
as the private key is almost the random number,
and then the public key is generated along with it. AUDIENCE: So [INAUDIBLE]. GARY GENSLER: Yes. AUDIENCE: So you pick a
random number actually between 0 and 256,
that's your private key. To pick a public
key, you derive it directly from the private key. In fact, all you do is you
exponentiate another number by the private key. So you can think
of the public key as a one way function
of the private key. So given a public key, you
cannot recover the private key. If you could, then you could
sign, potentially disastrous. GARY GENSLER: And instead of
exponentiation, in Bitcoin, it uses a function called
the elliptic curve. So what properties? And these are the key
economic properties as well as cryptographic properties. Basically, it's infeasible. And again, I use
the word infeasible. I didn't say impossible,
even though Eileen might want to tell me
that it's 1 over 10 to the 40th of something.
But it's infeasible to find a
private key from a public key, so reverse engineer. AUDIENCE: So even if you
can't find the private key, like in the case of
Kelly and Isabella, if I knew Kelly's
public key, could I send a message to Isabella
impersonating Kelly? GARY GENSLER: No. You need to do a signature– if you please just
run your eye up there. To do a digital
signature, you need a private key and a message. And it's a function of the
message and the private key. Let's call it complex math. That digital signature was
created from the private key. And the public key was
created from the private key. And to oversimplify the reason
that the verify function works is because both
the digital signature and the public key
that Isabella has– Isabella has this
digital signature, and she has the public key,
and she has the message.
The math is such
that, basically, the private key, if you wish,
almost like factors out. But think of two functions. Isabella has Kelly's
public key, the message, the digital signature. It either verifies
or it doesn't. But she never has to
see the private key. And in fact, Kelly
does not want her to ever see the private key. AUDIENCE: Eric, maybe
just to simplify the way the validation of
the digital signature works is Kelly's message is run
through a hash function which generates a hash. And it's encrypted
with her private key. Then the message encrypted
and the digital signature goes to Isabella. Isabella, what she does is
using the same hash function to run it with the document
to generate the hash function and uses the public key of
Kelly to unencrypt the signature and compare those two hashes. If those two hashes
correspond that means that the message
belongs to Kelly and it hasn't been
tampered with. So that's the more or
less the simplification of the digital
signature process. AUDIENCE: I don't know if– GARY GENSLER: So I mean,
the key is basically that there's a scheme
unrelated to Bitcoin that exists for many other
reasons on the internet, many other reasons in
commerce and at war that this public key,
private key cryptography.
And it's not simply
just going back, it's not just simply
Alice sending something. It's also digital signatures. You generate the key pair. Everything in Bitcoin,
everything in Ethereum has key pairs, public
key and private key, a digital signature. But, Kelly, never
lose your private key. You got that? Do not. And by the way, you have to
create it with a good random number generator because most
sophisticated hedge funds around the world aren't. So you're going to
be better than those. That's what I learned at a
conference I was at recently. And then there's a
verification function. AUDIENCE: A quick question about
the random number generator and the verification function.
So is there any third
party generating the generator or the generator
is a function already existing and already there? GARY GENSLER: So the question
is, if random number generation is so important, are
there outside parties that have good software, in essence,
to produce the random number generation? And the answer is
yes, and there's some that are not so good. And yes, some good
laptops have it. At the heart, I
want to skip ahead. Elliptic curve digital
signature algorithm, that's the actual algorithm
that Bitcoin uses to take the private key and so forth.
But many of the wallets, if you
download a wallet application to hold your Bitcoin,
to hold your Litecoin, to hold some other coin,
that wallet application has a random number
generation software. I can't attest to all the random
number generation software. I'm not a cyber security expert. But there's probably
a range of some that are a little bit more. There's stronger ones. The key to random
number generation is if you're generating
any length that it truly is not clumpier,
that there's let's say it's what maximum
entropy, and that you really don't have any clumps. If it all clumps
in one area, then that's not great randomness. So I just want to
finish because there's one other thing we're
going to chat about to lay the groundwork
is Bitcoin addresses.
I put that up. You can look at
the slides later. The details don't matter much. But the key thing is that
when you hear somebody talk about public keys and Bitcoin
addresses, colloquially, we all reference them the same. They're actually not. The technology that Nakamoto
did was he uses the public key. He literally hashed it twice,
once with this hash function called SHA256,
another hash function, then concatenates, and puts a
little check sum at the end, and then uses something
called a base 58 to make it even shorter. I've gone back and read
some of Nakamoto's emails for the two years after
he published all this and I've read other things. My understanding is the reason
there is two hash functions and actually two
different ones was just to make everything
a bit more secure.
Also, a public key is very long. It's about 512 bits. And so you can shrink
the data and make the data more compressed
by hashing it, which took it to 256 bits. He hashes it twice, and
then he does this base 58 and makes it even
a little tighter. So for all purposes, you
could go ahead and just use public key and Bitcoin
address is the same. But remember back in
the mind, oh, actually, they're a little different.
Bitcoin addresses are a little
bit more secure supposedly, unless of course somebody
has hacked into your wallet and figured out all
these little details. A Bitcoin address
is a little bit like the signatures on these
notes we talked about, right? Remember what an– half of you
don't use checking accounts. But these are early
forms of checks. And there's a signature
on the bottom. That's really kind
of a Bitcoin address. I'm sorry, the signature
is the digital signature. The address, the Bitcoin
address is who it's paid for. And I promise last slide. We're going to be talking
about this next week. Transactions, all
that stuff that rolls up into the Merkle trees. All that little itty bitty
important information, they basically have an input
and an output, the input and a lock time. But the input is a
previous transaction. This uniquely identifies,
basically, money. And you're going to
send value in Satoshis. He named the unit of
count for himself. There's a lot of Satoshis
in every one Bitcoin. That's why we don't hear
much about Satoshis. But there's 10 to the 8th
Satoshis in every one Bitcoin.
So when you actually
enter in the computer code in a transaction,
you're doing it in Satoshis. And it's sent to a public key. That's a coin. That is what the incentive
system's all about. Any other questions? And this is just I know. There's a lot. I wonder how many of you are
going to come back on Thursday. No. Let me say this. It's not just that we're at MIT. But we are at MIT. Come on. Everybody in this room can get
these kind of key concepts. The key questions
that we talked about were timestamped
append-only logs. Does anybody want
to tell me what a– if this class here in
the next seven minutes can get these two
concepts, that's all we talked about
for the last hour. So I don't know your
name in the orange shirt. AUDIENCE: Andrew. GARY GENSLER: What's that? Andrew? Andrew, what's time
append-only logs? AUDIENCE: Timestamped
append-only logs is essentially a record of
transactions or a block as blockchain uses
it with a time.
And that can't be
changed in the future. So you can only add
on transactions. GARY GENSLER: So it's
kind of immutable because of all this cryptography. Stuart Haber was making it in
a timestamped append-only log. And he was placing it where? Carolyn, you still with me? Where was Haber putting it? AUDIENCE: New York Times. GARY GENSLER: New York Times. There you go in the
classified section. So it's just it's a bunch of
blocks of data compressed up. So we talked about
something called Merkle trees and Merkle Roots.
Just think about as that's a
way to take a lot of information and compress it but also
make it searchable later because 1,000 transactions,
when we talk next week, you have to be able to verify. Somebody asked me about
how to verify, right? When you go back to verify, you
need an index number to find it in that Merkle tree situation. And it's secured
through hash functions. Anybody want to tell me
that easiest lay definition of the hash function? Jennifer? AUDIENCE: It's like
a mapping can be so members can get to just one. GARY GENSLER: Right. You could take a picture of this
classroom and everybody exactly and they could map
it into something. I don't know. Would a QR code be
a form of a hash? Not cryptographically secure.
But is it a hash? AUDIENCE: It's more of a
different representation of some data rather than
binary you're using. GARY GENSLER: All right,
so I failed that one. AUDIENCE: It often
stores hashes. GARY GENSLER: So
cryptographic hash function is a way to take not
only a lot of information and put it into a fixed
form, but the key thing here is the hash functions are
what tie the blocks together because hash functions can
point to previous information. And as the video showed, if you
change any of the underlying information, the hash changes. So what does that give you? It basically secures the data. You know if somebody
has tampered. So the only reason to really
learn about hash functions is it's to say, oh, I get it. This is one of the ways to
make this data tamper proof. Go on. AUDIENCE: I have a question
about a theoretical event where a better hash function
is found than the SHA256.
How would that be implemented
into the Bitcoin network practically? There needs to be
a consensus and– GARY GENSLER: So how
would any relevant change be adopted into Bitcoin
is always a challenge because it's a
decentralized network. And all decentralized
networks have a little bit of a governance challenge. The governance challenge is,
how do you do software updates? We all know that on our
laptops, our iPhones, there's probably software
updates going on here now unbeknownst to me, right? They're probably just
Apple has dropped.
I mean, who knows what
they're doing in here, right? And Uber, I really, one of my
favorites, who knows what's happening inside this phone. But the commercial enterprise,
the central authority has a way to update
the software. We probably sign
some terms of use that allows them to do that. In a decentralized
network like this, there has to be consensus. And so the only way
really to update the software for a new hash
function or for most everything else is, in essence,
that the nodes, the operators of the software
collectively in a consensus form adopt it. So it's another way that
not only is the data immutable because of these hash
functions but the software is. And that comes both
with benefits and costs. Some people would say
that's a bug of blockchain. Some people would
say it's a feature.
You can come to
your own judgment over the course
of this semester. But the software
is harder to update than software in
centralized authorities because centralized
authorities just say– they just push the– now sometimes you have
to click and say update. But don't be naive. Not every software do you click. I mean, there's some
that's just happening. But here, you've got
to have consensus. I know it didn't
answer your question about the hash function. But if it were a hash function
that had to be updated and everybody said they
had to quickly update it, there's interesting
debates about this, but you wouldn't need to
go back over all 540,000 previous blocks. You could just hash all 540,000
blocks, 180 gigabytes to one 256 or maybe it's
then a different, and then you'd have that.
And it would be tamper proof. So those are the key things. That's what we covered really. What we're going to cover next
Tuesday is consensus protocol. We've talked a lot
about proof of work here because everybody thinks
of Bitcoin about proof of work. But we're going to talk about
proof of work, the nodes, and the native currency.
And then next
Thursday, we're going to talk about transactions. Again, I try to break
down this technology. If you want to forget
about this lecture, and you're going to
go, oh my god, it was like going to
the dentist, you can tell your friends
that you actually know something about cryptography. It is called cryptocurrencies. So how could we not know
something about cryptography? But it's basically
those three things. It's cryptography. It's a consensus mechanism
and the transactions.
So right? Cryptography, consensus
mechanism, transactions. And we will get through it. And then you'll see
this matters to finance and whether it's
got any use cases. So thank you.
