Partnered With:

Genesis Documents: How Adam Back Designed Bitcoin's Engine

Read this article in 20 Minutes

The technology behind Hashcash, "proof of work", has shaped digital currency research for more than ten years after its birth.

Original title: "Genesis Documents: Adam Back How to Design a Bitcoin Engine"

Original Source: Aaron Van Wirdum

Original Compilation: A Jian, Ethereum Enthusiast

On March 28, 1997, more than 2,000 subscribers to the cypherpunk mailing list received an email beginning with the above sentence citation. The sender was a 26-year-old Briton, a postdoctoral fellow at the University of Exeter. The young cryptographer goes by the name Dr. Adam Back on the mailing list and is a prolific contributor to the mailing list. The explanation and simple implementation contained in this email, the author named "postage scheme based on partial hash collision"-in fact, it is equivalent to the stamp used in email, but its basis is a beautiful cryptographic scheme .

"The rationale for using partial hashes is that their computational cost can be adjusted arbitrarily high", Back wrote, "but immediately verifiable" . Here's how he explained the advantages of the system.

The cryptographer at the time is now the CEO of Blockstream, but the email didn't make much of a difference at the time: only one reader replied, and Discusses the technical aspects of choosing a hashing algorithm. But the technology behind Hashcash — proof-of-work — has shaped digital currency research for more than a decade since its creation.

"Fight spam with task processing"

Back's Hashcash is not The pioneer of similar programs.

Back in the early 1990s, the promise of the Internet, and especially the benefits of the e-mail system, were apparent to concerned technologists. However, the Internet pioneers at the time also realized that the email system had its own problems.

“In particular, sending email is easy and cheap, and you can send the same message to many people, which is bound to invite abuse” , explained IBM researchers Dr. Cynthia Dwork and Dr. Moni Naor in their 1992 white paper. The white paper is titled "Fighting Spam with Task Processing".

It is true that with the popularity of e-mail, spam also emerges in an endless stream.

There needs to be a solution, early Internet users agree -- and one of those is provided by Dwork and Naor's paper.

Their plan is: the person who sends the email must attach some data to the email every time he sends an email. The data needs to be the solution to a mathematical problem, and each email poses a unique problem. Specifically, Dwork and Naor propose three candidate puzzle forms that could be used in this scenario, all based on public-key cryptography and signature schemes.

It is not difficult to add a solution to e-mail, ideally it only needs the processing power of an ordinary computer, count a few seconds, and receive It is easy to check its validity. Here's where it gets interesting: Even a small amount of processing power per email can add up to a high cost for advertisers, scammers, and hackers who want to send thousands or even thousands of emails at a time. million messages. In theory, the cost of spamming can be so high that it is unprofitable.

"The main idea is to prevent abuse by allowing users to compute a moderately hard, not tricky function before gaining access to resources", Dwork and Naor So explain.

While Dwork and Naor did not invent the term, the type of solution they proposed would later become known as "Proof of Work". Users must show the results of their computer work as evidence that they spent real-world resources.

What a beautiful plan, but unfortunately it may be too advanced. This scheme circulated only among a small circle of computer scientists and never received widespread attention.

Adam Back and the Cypherpunks

At the same time that Dwork and Naor published their white paper , a group of privacy activists with Libertarian leanings also began to realize the powerful potential of the Internet. This group of like-minded individuals started a mailing list dedicated to discussing privacy-enhancing technologies. Like Dwork and Naor, these "cypherpunks" -- as they were called later -- used newer cryptography to achieve their goals.

A few years later, Adam Back - who received his PhD in 1996 - became one of the most active participants on this mailing list, with Sometimes dozens of emails can be sent a month. Like other cypherpunks, he is passionate about topics such as privacy, free speech In technical discussions on topics such as doctoral inventions).

But for a while, Back was probably best known for printing and selling "arms" tops: T-shirts with encryption protocols printed on them, intended to Point out the absurdity that the US government controls Phil Zimmermann's PGP (Pretty Good Privacy) encryption program as the "arms" regulation in the export control law. If you wear Back's clothes and cross the border to leave the United States, then you will become an "arms exporter".

Like most, Back was oblivious to Dwork and Naor's proof-of-work proposal. But in the mid-1990s, he had been thinking about a similar approach to fighting spam, sometimes speaking "highly" on cypherpunk mailing lists.

For example, in the context of adding more privacy to forwarders, Back would comment: "A side benefit of using the PGP protocol is that the PFP encryption method imposes some overhead on the spammer - he should be able to encrypt fewer messages per second than can be used to jam a T3 link." How like Dwork and Naor's idea.

The cypherpunk mailing list has grown rapidly in five years. What started as an online discussion platform for a small group of people building startups in the San Francisco Bay Area turned into a small Internet phenomenon with thousands of subscribers — and often too many emails to read.

It was during this period - 1997, when the number of mailgroups was nearing its peak - that Back came up with his Hashcash.

Hashcash

Hashcah is similar to the anti-spam scheme of Dwork and Naor, and the purpose is the same Yes, but Back proposes some additional uses, such as resisting the abuse of anonymous relayers. But as the name implies, the basis of Hashcash is not the same as that used by Dwork and Naor, it is based on hashing algorithms.

A hashing algorithm is a cryptographic tool that takes arbitrary data -- whether it's a single letter or an entire book -- as input, and outputs A number of definite length that looks random.

For example, the SHA-256 hash value of the sentence "This is a sentence" is the following hexadecimal number:

< /p>

"converts" to regular decimal numbers as:

The binary form is :

However, the SHA-256 hash value of "This, is a sentence" is:

As you can see, just inserting a single punctuation produces a completely different hash. And, importantly, the hashes of both sentences are completely unpredictable; even if you knew the hash of the first sentence, you couldn't deduce the hash of the second sentence from it. The only way to know is to actually run the hash calculation.

Hashcash makes clever use of this mathematical tool.

In Hashcash, the metadata of the mail (such as "sender address", "recipient address", sending time, etc.) are formalized as an agreement. In addition, the sender of the email must add a random number called a "nonce" to this part of the metadata. All this metadata, including this "nonce", (when fed into a hash function) yields a hash value that also looks like the random number shown above, haphazardly.

The secret is that not just any hash value can be counted as "valid". The binary form of a hash value that must start with a predetermined number of "0"s to be valid; for example, 20 "0"s at the beginning. The sender needs to find out a certain nonce so that there must be 20 "0"s at the beginning of the hash value. However, he has no way of knowing in advance which nonce can do this.

Therefore, in order to obtain such a valid hash value, the sender has only one way: trial and error (aka "brute force calculation"). He can only keep trying different nonces until he finds a combination that works. Otherwise, TA's mail will be rejected by the recipient's mail client. Like Dwork and Naor's proposal, Hashcash also requires payment of computing resources: it is a proof-of-work system.

"If the email doesn't come with a 20-digit hash... your program will pop up a statement explaining that there is a postage fee to send the email and where to get it The right software," Back explained on the cypherpunk mailing list, "can bankrupt spammers overnight, because 100 0000 x 20 = 100 MIP years is far more than their computing power".

It is worth noting that Back's proof-of-work system is more random than Dwork's and Naor's. Their solution required only one puzzle to be solved, which meant that a faster computer would always solve it faster (than a worse computer). But statistically, a slower computer in Hashcash also has a chance of finding the correct solution faster.

(For example, if someone runs faster than others, in a sprint race, TA wins every time. But if someone just buys more More lottery tickets, there is always a chance that someone else will win more than him -- just not as often.)

Scarcity in the digital world< /h4>

Similar to the fate of Dwork and Naor's proposal, Hashcash never made much headway. Back explained Hashcash in detail in his 2002 white paper. Apache's open-source SpamAssassin (spam filtering) platform implements it, while Microsoft also leverages the proof-of-work idea in an incompatible "email postmark" format. And Back and other scholars have been working on different applications for this solution for years, but they have not received much attention. For most potential applications, the lack of network effects makes them difficult to launch.

However, Dwork and Naor, Back (independent research), did create something. One of the most powerful properties of digital products is that they can be easily replicated, and Proof-of-Work is essentially the first notion of virtual scarcity independent of a center: it links electronic data with real-world, finite Computing resources are bound together.

And scarcity, without a doubt, is a prerequisite for money. In fact, in his cypherpunk email speech and white paper, Back specifically placed Hashcash in the currency category, in contrast to the only digital cash in the world at that time (Chaum's DigiCash).

"Hashcash may provide a temporary measure until digicash is widely used," Back said in the mailing list. "Hashcash is free, you only It costs a few calculations on your computer to get it. It fits with the free-expression Internet culture where the poor can talk to millionaires, retired government officials, etc. on an equal footing. (And) if digicash goes wrong (takeover or require custody of user identities), Hashcash can also provide a fallback solution to control spam.”

However, despite the name, Hashcash Doesn't play well as a full-fledged cash (nor Dwork and Naor's proposal, of course). Perhaps more importantly, the receiver "receives" a proof of work that is of no use to him. Unlike currency, you can spend it elsewhere. Also, as computers get more powerful, they can generate more and more proofs in the same amount of time - Hashcash suffers from hyperinflation.

All else aside, proof of work provides a whole new foundation for digital currency research. Most of the later important digital currency schemes are built on top of Hashcash, generally to enable the reuse of proof of work (Hal Finney's "reusable proof of work (PROW)" is the most obvious example) .

Bitcoin

Of course, in the end, proof-of-work became Bitcoin's cornerstone, and Hashcash is also one of the few references in the Bitcoin white paper.

However, Bitcoin's use of Hashcash (or variants thereof) is very different from what others have suggested before. Unlike Hashcash and other Hashcash-based schemes, the scarcity provided by proof-of-work itself is not directly used as money in Bitcoin. In effect, Hashcash is used to create a race: whichever miner first produces a valid proof-of-work—that is, the hash of a block of Bitcoin transactions—determines which transactions are the next batches are processed. In theory at least, everyone is playing on equal footing: much like a lottery, even a small miner has a probability of being the first to produce a valid amount of work at a certain point.

Furthermore, every time a block is mined, it confirms a batch of transactions that are unlikely to be reversed. The attacker must prove that he has done at least as much work as the block that was mined first (the block producer), and this amount will continue to accumulate with the appearance of subsequent blocks. Under normal circumstances, This difficulty will increase exponentially. As a result, the real-world resource cost of cheating is generally greater than the potential gain from cheating. The receiver of the Bitcoin transaction also has confidence that the money he has received will not disappear out of thin air.

This way of using Hashcash can be said to kill two birds with one stone: it not only solves the "multiple payment problem" in a decentralized way, but also provides a way for new Coins can enter circulation without a centralized issuer.

Hashcash did not become the first electronic cash system - Ecash had a head start, and Proof of Work itself cannot actually be used as money. But without it, there may not be a decentralized digital cash system.