1
00:00:05,359 --> 00:00:09,991
In segment 1.5, we're going to move
from talking about cryptography and

2
00:00:09,991 --> 00:00:13,060
we're going to move on
to cryptocurrencies.

3
00:00:13,060 --> 00:00:18,830
Now I know that many of you showed up here
for the cryptocurrency stuff, and trust

4
00:00:18,830 --> 00:00:22,730
me there will be a lot more cryptocurrency
material in future lectures.

5
00:00:22,730 --> 00:00:26,040
Unfortunately, we needed to eat some
of our cryptographic vegetables

6
00:00:26,040 --> 00:00:29,080
in order to have the background
to talk about crypto currencies.

7
00:00:29,080 --> 00:00:31,740
And now you'll see, when I start
talking about crypto currencies,

8
00:00:31,740 --> 00:00:36,490
how these pieces fit together, and
why the cryptographic operations,

9
00:00:36,490 --> 00:00:40,230
like hash functions and
digital signatures are actually useful.

10
00:00:40,230 --> 00:00:41,220
All right.
So in this section,

11
00:00:41,220 --> 00:00:43,650
I want to talk about some simplified

12
00:00:43,650 --> 00:00:48,740
Crypto currencies that give us ideas
about how systems like BitCoin work.

13
00:00:48,740 --> 00:00:53,720
Of course it's going to require about ten
more lectures in order to really spill out

14
00:00:53,720 --> 00:00:58,600
all of the implications of how
BitCoin works and what that means, but

15
00:00:58,600 --> 00:01:03,370
let me talk about some very simple crypto
currencies to get the discussion started.

16
00:01:04,390 --> 00:01:06,480
And first let's talk about GoofyCoin.

17
00:01:06,480 --> 00:01:10,070
GoofyCoin is about the simplest
crypto currency we can imagine.

18
00:01:10,070 --> 00:01:11,840
And it works kind of like this.

19
00:01:13,290 --> 00:01:16,530
There are just a couple
rules of GoofyCoin.

20
00:01:16,530 --> 00:01:19,850
The first rule is that
Goofy can create new coins.

21
00:01:19,850 --> 00:01:23,020
Goofy can make a new coin whenever he
wants and when he makes a new coin,

22
00:01:23,020 --> 00:01:24,610
it belongs to him.

23
00:01:24,610 --> 00:01:28,710
So when Goofy makes a coin, it's
represented by a data structure like this.

24
00:01:28,710 --> 00:01:30,670
Here you have the create
coin operation and

25
00:01:30,670 --> 00:01:33,130
there's a unique coin ID
that Goofy generated.

26
00:01:33,130 --> 00:01:36,630
And then there's a digital signature
that was put on it by Goofy

27
00:01:36,630 --> 00:01:38,110
which anyone can verify.

28
00:01:38,110 --> 00:01:41,970
So anyone being given this can verify
that the signature is valid and

29
00:01:41,970 --> 00:01:44,470
that it's a signature of this statement.

30
00:01:44,470 --> 00:01:45,910
And new coins belong to Goofy,

31
00:01:45,910 --> 00:01:49,120
by definition, because those
are the rules that Goofy made.

32
00:01:49,120 --> 00:01:51,500
So, that's the first rule,
Goofy can create new coins.

33
00:01:52,630 --> 00:01:55,330
The second rule of Goofy coin is that

34
00:01:55,330 --> 00:01:59,120
whoever owns a coin can pass it on
to someone else, they can spend it.

35
00:01:59,120 --> 00:02:02,210
So, for example, here we have
the coin that I showed you before,

36
00:02:02,210 --> 00:02:07,750
that Goofy created, and now we're going
to take a hash pointer to that coin, and

37
00:02:07,750 --> 00:02:08,940
we're going to create a statement.

38
00:02:08,940 --> 00:02:12,720
Goofy's going to make a statement
that says pay this to Alice,

39
00:02:12,720 --> 00:02:15,340
Alice is being named by a public key here.

40
00:02:15,340 --> 00:02:20,280
Pay to public key Alice the coin that
is represented by this hash pointer and

41
00:02:20,280 --> 00:02:22,339
this is also signed by Goofy.

42
00:02:23,430 --> 00:02:26,330
Now Goofy is the one who
owned that coin and so

43
00:02:26,330 --> 00:02:30,220
Goofy has to sign any transaction
that spends the coin.

44
00:02:31,970 --> 00:02:34,810
And once this has happened,
now Alice owns the coin.

45
00:02:34,810 --> 00:02:38,460
Alice owns the coin and Alice can prove
that she owns the coin, because she can

46
00:02:38,460 --> 00:02:43,200
present this data structure here,
which is validly signed by Goofy and

47
00:02:43,200 --> 00:02:46,260
points to a coin that was
validly owned by Goofy.

48
00:02:46,260 --> 00:02:50,620
So the correctness of this coin
is self evident in this system.

49
00:02:50,620 --> 00:02:54,570
Now, Alice can move on and
she can spend the coin as well.

50
00:02:54,570 --> 00:02:57,112
So here we have the coin we had before.

51
00:02:57,112 --> 00:03:00,800
Down here at the bottom, we have
the creation of the coin signed by Goofy.

52
00:03:00,800 --> 00:03:05,110
Now Goofy paid the coin to Alice via
this hash pointer and he signs that.

53
00:03:05,110 --> 00:03:06,490
Now Alice is the owner of the coin.

54
00:03:06,490 --> 00:03:08,270
Now, she can create a statement like this,

55
00:03:08,270 --> 00:03:11,250
that says pay this coin
to Bob's public key.

56
00:03:11,250 --> 00:03:12,650
And here's a hash pointer to the coin.

57
00:03:13,670 --> 00:03:15,400
And now Alice signs that.

58
00:03:15,400 --> 00:03:19,360
So because Alice was the valid owner of
the coin which we could verify by walking

59
00:03:19,360 --> 00:03:20,400
this chain.

60
00:03:20,400 --> 00:03:23,460
Now we know that this is valid and
the coin belongs to Bob.

61
00:03:23,460 --> 00:03:25,940
So Bob is now the owner of this coin.

62
00:03:25,940 --> 00:03:28,680
So those are all the rules of Goofy coin.

63
00:03:28,680 --> 00:03:32,460
Goofy can create new coins by simply
signing a statement that he's making a new

64
00:03:32,460 --> 00:03:33,980
coin with a unique coin ID.

65
00:03:35,070 --> 00:03:38,510
And then whoever owns a coin
can pass it on to someone else

66
00:03:38,510 --> 00:03:42,300
by signing a statement saying
pass on this coin to person X.

67
00:03:42,300 --> 00:03:46,280
And you can verify the validity of
the coin by simply following the chain and

68
00:03:46,280 --> 00:03:48,430
verifying all the signatures
along the way.

69
00:03:49,440 --> 00:03:50,150
That's Goofy coin.

70
00:03:52,210 --> 00:03:53,720
Alright, now there's a problem though.

71
00:03:53,720 --> 00:03:55,810
There's a big security
problem with Goofy coin and

72
00:03:55,810 --> 00:03:58,530
we can see it in this structure here.

73
00:03:58,530 --> 00:04:01,940
So look at this coin here,
this is the coin that Goofy made and

74
00:04:01,940 --> 00:04:03,000
then paid to Alice.

75
00:04:03,000 --> 00:04:04,430
Alice was the owner of that coin.

76
00:04:04,430 --> 00:04:06,170
And there's a problem.

77
00:04:06,170 --> 00:04:08,690
Alice paid this coin onto Bob.

78
00:04:08,690 --> 00:04:12,870
But now Alice makes another
data structure like this which

79
00:04:12,870 --> 00:04:17,620
pays to Chuck the very same coin,
and this is signed by Alice.

80
00:04:17,620 --> 00:04:20,670
Now if Chuck doesn't know about
this thing up in the upper left,

81
00:04:20,670 --> 00:04:23,580
this data structure,
let's say Alice just gave that to Bob and

82
00:04:23,580 --> 00:04:26,230
didn't tell Chuck,
now Chuck will look at this and

83
00:04:26,230 --> 00:04:30,240
he'll think that this is perfectly valid
and now he's the owner of the Coin.

84
00:04:30,240 --> 00:04:34,060
Chuck has a valid looking claim
to be the owner of this coin, and

85
00:04:34,060 --> 00:04:37,720
Bob has an equally valid looking claim
to be an owner of this coin, and

86
00:04:37,720 --> 00:04:40,740
that's a problem, because coins
are not supposed to work that way.

87
00:04:40,740 --> 00:04:42,800
This is called a double-spending attack.

88
00:04:42,800 --> 00:04:47,100
It's called double-spending because
Alice is spending the same coin twice.

89
00:04:47,100 --> 00:04:51,020
And double-spending attacks are one of
the key problems that a cryptocurrency

90
00:04:51,020 --> 00:04:52,230
has to solve.

91
00:04:52,230 --> 00:04:55,430
Goofy coin does not solve
the double spending attack and

92
00:04:55,430 --> 00:04:57,840
therefore Goofy coin is not secure.

93
00:04:57,840 --> 00:05:01,300
So although Goofy coin is simple and
we understand its rules,

94
00:05:01,300 --> 00:05:06,140
it won't cut it as a cryptocurrency
because it allows double spending.

95
00:05:06,140 --> 00:05:11,220
So in order to build the cryptocurrency
that is going to be workable,

96
00:05:11,220 --> 00:05:14,590
we need to have some solution
to the double-spending problem.

97
00:05:14,590 --> 00:05:18,690
And indeed the double-spending problem is
the main design challenge that we face

98
00:05:18,690 --> 00:05:20,020
in designing a cryptocurrency.

99
00:05:21,030 --> 00:05:22,970
So we need to somehow
improve on GoofyCoin.

100
00:05:22,970 --> 00:05:27,140
And we'll do that by designing another
coin, which I'll call ScroogeCoin.

101
00:05:27,140 --> 00:05:30,960
ScroogeCoin is going to be rather like
GoofyCoin, except it will solve the double

102
00:05:30,960 --> 00:05:34,820
spending problem in a particular way,
and this coin was created by Scrooge.

103
00:05:36,010 --> 00:05:39,480
Okay, so this is a little bit more
complicated in terms of data structures,

104
00:05:39,480 --> 00:05:40,800
but here's one of the key ideas.

105
00:05:40,800 --> 00:05:41,560
That Scrooge is

106
00:05:41,560 --> 00:05:44,850
going to publish a history of all
the transactions that have happened.

107
00:05:44,850 --> 00:05:48,470
This will be a block chain, that data
structure we talked about before, and

108
00:05:48,470 --> 00:05:50,440
it will be digitally signed by Scrooge.

109
00:05:51,510 --> 00:05:56,380
And it looks like this of course,
a series of blocks, data blocks.

110
00:05:56,380 --> 00:05:58,110
Each block will have
one transaction in it.

111
00:05:58,110 --> 00:06:02,700
This block has the transaction
with transaction ID number 73.

112
00:06:02,700 --> 00:06:05,240
And it has the contents
of this transaction, and

113
00:06:05,240 --> 00:06:08,130
there's a hash pointer to
the previous block in the history.

114
00:06:09,560 --> 00:06:13,410
And then Scrooge will take the hash
pointer which represents this entire

115
00:06:13,410 --> 00:06:16,380
structure, and
he'll digitally sign it and publish it.

116
00:06:16,380 --> 00:06:20,500
Now anybody can verify that Scrooge really
did sign this hash pointer, and then they

117
00:06:20,500 --> 00:06:24,660
can follow this chain all the way back and
see what is the entire history of

118
00:06:24,660 --> 00:06:30,210
all the transactions in the history of
Scrooge coin, as endorsed by Scrooge.

119
00:06:30,210 --> 00:06:32,840
Okay?
Now I said here we put one transaction

120
00:06:32,840 --> 00:06:34,030
in each block.

121
00:06:34,030 --> 00:06:37,940
We do that for simplicity of explanation,
but in practice as an optimization we'd

122
00:06:37,940 --> 00:06:42,270
really put multiple transactions into
the same block, as Bitcoin does.

123
00:06:42,270 --> 00:06:45,310
So you can bare in mind as
I talk about Scrooge coin.

124
00:06:45,310 --> 00:06:47,890
But that's the way we
really do it in practice.

125
00:06:47,890 --> 00:06:49,610
So Scrooge publishes this history.

126
00:06:49,610 --> 00:06:51,530
What does the history do?

127
00:06:51,530 --> 00:06:56,360
Well the thing that history does for us is
it allows us to detect double spending.

128
00:06:56,360 --> 00:07:01,730
Because assume Alice owns a coin and
she's going to pay that coin on to Bob.

129
00:07:02,890 --> 00:07:05,710
And she's then later going to try and
pay that coin on to Charlie.

130
00:07:07,378 --> 00:07:10,450
Charlie's going to notice that something
is wrong, because Charlie will be able to

131
00:07:10,450 --> 00:07:15,060
look into the history and see that
Alice already paid that coin to Bob.

132
00:07:15,060 --> 00:07:18,760
In fact, everyone will be able to see
that Alice already paid that coin to Bob.

133
00:07:18,760 --> 00:07:20,990
So if she tries to pay that coin to Chuck,

134
00:07:20,990 --> 00:07:24,280
then everyone can see that's a double
spend, and they'll be able to reject it.

135
00:07:24,280 --> 00:07:27,170
Scrooge will reject it and
everyone else will reject it and

136
00:07:27,170 --> 00:07:30,234
know that they really
shouldn't trust Alice.

137
00:07:30,234 --> 00:07:35,470
All right, so in ScroogeCoin,
there are two kinds of transactions.

138
00:07:35,470 --> 00:07:37,780
The first kind is a create
coins transaction.

139
00:07:37,780 --> 00:07:39,780
What it does is create new coins,

140
00:07:39,780 --> 00:07:43,900
that's like the operation Goofy could
do in GoofyCoin that makes a new coin.

141
00:07:43,900 --> 00:07:48,330
But here, we're going to allow multiple
coins to be created in one transaction.

142
00:07:48,330 --> 00:07:51,200
So here's what a CreateCoins
transaction looks like.

143
00:07:51,200 --> 00:07:53,470
It has transaction ID number 73,

144
00:07:53,470 --> 00:07:57,040
let's say in this case,
its transaction type is CreateCoins.

145
00:07:57,040 --> 00:07:59,940
And then down here,
there's a list of which coins are created.

146
00:07:59,940 --> 00:08:04,990
Each coin is going to have a serial
number within this transaction, 012, etc.

147
00:08:04,990 --> 00:08:06,220
Each coin has a value.

148
00:08:06,220 --> 00:08:10,270
It's worth a certain number of Scrooge
Coins, and each coin has a recipient,

149
00:08:10,270 --> 00:08:13,330
which is going to be a public key,
who gets that coin as it's created.

150
00:08:14,630 --> 00:08:17,930
So this transaction type creates
a bunch of new coins and

151
00:08:17,930 --> 00:08:19,980
assigns them to people as initial owners.

152
00:08:21,600 --> 00:08:24,810
Now we're going to have a concept
in Scrooge Coin of a coinID.

153
00:08:24,810 --> 00:08:26,820
That refers to a particular coin.

154
00:08:26,820 --> 00:08:31,820
So this particular coin here is
coin ID 73 paren zero, because it

155
00:08:31,820 --> 00:08:37,570
was created in transaction 73, and it
was number zero within that transaction.

156
00:08:37,570 --> 00:08:40,700
Similarly we have 73 paren 1,
73 paren 2, and so on.

157
00:08:40,700 --> 00:08:44,839
So every coin in Scrooge coin has
a coin ID that we can use to refer to.

158
00:08:46,450 --> 00:08:48,910
A CreateCoins transaction is always valid.

159
00:08:48,910 --> 00:08:49,740
Why is it valid?

160
00:08:49,740 --> 00:08:53,450
Well because Scrooge said so, and
they call it Scrooge coin for a reason.

161
00:08:53,450 --> 00:08:56,470
If Scrooge puts this into
the history of which he signs,

162
00:08:56,470 --> 00:08:58,340
then it's valid by definition.

163
00:08:58,340 --> 00:09:04,240
We don't worry whether Scrooge is entitled
to create coins, just like we didn't need

164
00:09:04,240 --> 00:09:08,420
to worry in GoofyCoin about whether Goofy
is entitled to create coins, the rules of

165
00:09:08,420 --> 00:09:12,450
the system which were created by Scrooge
simply say that if Scrooge wants to make

166
00:09:12,450 --> 00:09:16,530
coins, then that's valid, so anything
he puts into the history is valid.

167
00:09:16,530 --> 00:09:21,060
The second kind of transaction we're going
to talk about is a PayCoins transaction.

168
00:09:21,060 --> 00:09:25,180
And this is a transaction that
consumes some coins and destroys them.

169
00:09:25,180 --> 00:09:27,770
And creates new coins of
the same total value but

170
00:09:27,770 --> 00:09:29,990
which might belong to different people.

171
00:09:29,990 --> 00:09:32,890
So over here on the left we have
an example of what a PayCoins

172
00:09:32,890 --> 00:09:34,340
transaction looks like.

173
00:09:34,340 --> 00:09:37,230
This is transaction ID number
seventy-three, let's say.

174
00:09:37,230 --> 00:09:38,930
It's type is PayCoins.

175
00:09:38,930 --> 00:09:43,420
We have here a list of the coins
that this one consumes.

176
00:09:43,420 --> 00:09:47,950
All of these coins are being consumed and
destroyed by this paycoin transaction.

177
00:09:47,950 --> 00:09:51,220
So we're going to add up all the values of
those coins and then we're going to create

178
00:09:51,220 --> 00:09:54,630
a bunch of new coins down here zero,
one, and two etcetera.

179
00:09:54,630 --> 00:09:57,260
Just like before in
the CreateCoins transaction.

180
00:09:57,260 --> 00:10:01,329
Each one will have a value and
each one will have a certain recipient.

181
00:10:02,340 --> 00:10:05,850
And those new coins had better add up to
the same total value as the coins that

182
00:10:05,850 --> 00:10:06,410
we consumed.

183
00:10:08,200 --> 00:10:11,070
And then at the bottom we have
a set of digital signatures.

184
00:10:11,070 --> 00:10:15,090
This transaction has to be signed
by everyone whose paying in a coin.

185
00:10:15,090 --> 00:10:18,230
So if you're the owner of one of the coins
that's going to be consumed in this

186
00:10:18,230 --> 00:10:21,960
transaction, then you need to digitally
sign the transaction to say that you're

187
00:10:21,960 --> 00:10:24,610
really okay with spending this coin.

188
00:10:24,610 --> 00:10:28,650
The rules of Scrooge coin say that
a PayCoins transaction is valid

189
00:10:28,650 --> 00:10:32,110
if four things are true: first,
if the consumed coins are valid,

190
00:10:32,110 --> 00:10:36,190
that is they really were created,
in previous transactions.

191
00:10:37,320 --> 00:10:41,360
Second, that the consumed coins were
not already consumed in some previous

192
00:10:41,360 --> 00:10:43,710
transaction, that is that
this is not a double spend.

193
00:10:44,920 --> 00:10:47,710
Third that the total value of
the coins that come out of this

194
00:10:47,710 --> 00:10:51,420
transaction is equal to the total
value of the coins that went in.

195
00:10:51,420 --> 00:10:52,170
And finally,

196
00:10:52,170 --> 00:10:57,270
that the transaction is validly signed by
the owners of all of the consumed coins.

197
00:10:57,270 --> 00:11:00,665
If all of those things are true,
then this paycoins transaction is valid,

198
00:11:00,665 --> 00:11:04,060
Scrooge will accept it,
he'll write it into the history,

199
00:11:04,060 --> 00:11:08,570
into the block chain, and everyone will
see that this transaction has happened.

200
00:11:08,570 --> 00:11:11,790
One thing to note about this scheme
is that coins are immutable.

201
00:11:11,790 --> 00:11:16,060
Coins are never changed, they're never
subdivided, they're never combined.

202
00:11:16,060 --> 00:11:19,680
All they are is created once
in one transaction, and

203
00:11:19,680 --> 00:11:22,460
then later consumed in
some other transaction.

204
00:11:22,460 --> 00:11:27,250
But you can get the same effect as
being able to subdivide, or pay on, or

205
00:11:27,250 --> 00:11:30,000
combine coins by using transactions.

206
00:11:30,000 --> 00:11:31,980
For example,
if you want to subdivide a coin,

207
00:11:31,980 --> 00:11:36,530
you could just create a new transaction
that consumes that one coin, and

208
00:11:36,530 --> 00:11:38,920
then produces two new coins
of the same total value.

209
00:11:38,920 --> 00:11:42,120
And if you want, you can give those
two new coins back to yourself.

210
00:11:42,120 --> 00:11:44,630
That's a way that you can
subdivide a coin that you own.

211
00:11:44,630 --> 00:11:47,220
Similarly you can combine coins or

212
00:11:47,220 --> 00:11:52,730
you can pay on a coin in effect by
just creating a chain of transactions,

213
00:11:52,730 --> 00:11:57,620
each of which pass that value on in
the form of a new coin to someone else.

214
00:11:57,620 --> 00:11:59,490
So although coins
are immutable in the system,

215
00:11:59,490 --> 00:12:03,840
it has all of the flexibility of a system
that didn't have immutable coins.

216
00:12:05,490 --> 00:12:06,060
Okay.

217
00:12:06,060 --> 00:12:09,210
Now we come to the core
problem with Scrooge Coin.

218
00:12:09,210 --> 00:12:12,990
Scrooge Coin will work,
people can see which coins are valid,

219
00:12:12,990 --> 00:12:17,530
it prevents double spending because
people can look into the block chain and

220
00:12:17,530 --> 00:12:21,599
see that all of the transactions are valid
and that every coin is consumed only once.

221
00:12:22,800 --> 00:12:25,650
But the problem is Scrooge.

222
00:12:25,650 --> 00:12:27,480
Scrooge thinks this is fine.

223
00:12:27,480 --> 00:12:29,930
Right?
Scrooge says, don't worry I'm honest.

224
00:12:29,930 --> 00:12:30,710
But the fact is,

225
00:12:30,710 --> 00:12:34,570
if Scrooge starts misbehaving,
then we're going to have a problem.

226
00:12:34,570 --> 00:12:38,460
Or, if Scrooge just gets bored of the
whole Scrooge coin scheme and stops doing

227
00:12:38,460 --> 00:12:42,330
the things that he's supposed to do,
then the system won't operate anymore.

228
00:12:43,340 --> 00:12:46,120
And so the problem we have
here is centralization.

229
00:12:46,120 --> 00:12:50,710
But although Scrooge is happy with this
system, we as users of it might not be.

230
00:12:50,710 --> 00:12:55,060
So the central technical challenge that
we need to solve in order to improve

231
00:12:55,060 --> 00:12:59,770
on Scrooge coin is can we
descroogify the system?

232
00:12:59,770 --> 00:13:03,710
That is can we get rid of that
centralized Scrooge figure?

233
00:13:03,710 --> 00:13:08,740
Can we have a cryptocurrency that operates
like ScroogeCoin in many ways, but

234
00:13:08,740 --> 00:13:11,620
doesn't have any central
trusted authority?

235
00:13:11,620 --> 00:13:15,650
In order to do that, we're going to need
to figure out how to provide the services

236
00:13:15,650 --> 00:13:19,210
that Scrooge provides, but
do it in a decentralized way,

237
00:13:19,210 --> 00:13:22,840
in a way in while no particular
party is particularly trusted.

238
00:13:22,840 --> 00:13:26,580
That means we're going to need to figure
out how everyone can agree upon a single

239
00:13:26,580 --> 00:13:28,140
published block chain,

240
00:13:28,140 --> 00:13:31,840
that is the agreed upon history of
which transactions have happened.

241
00:13:31,840 --> 00:13:35,490
We need to figure out how people can
agree which transactions are valid and

242
00:13:35,490 --> 00:13:38,060
which transactions have actually occurred.

243
00:13:38,060 --> 00:13:41,620
And, we need to figure out how
we can assign IDs to things

244
00:13:41,620 --> 00:13:43,310
in a decentralized way.

245
00:13:43,310 --> 00:13:45,170
If we can solve all of those problems,

246
00:13:45,170 --> 00:13:48,120
then we can build a currency
that is very much like BitCoin,

247
00:13:48,120 --> 00:13:51,050
which is like ScroogeCoin, but
without a centralized party.

248
00:13:51,050 --> 00:13:53,790
But in order to do that,
it's going to take a few more lectures and

249
00:13:53,790 --> 00:13:56,210
we hope you'll stick around and
watch them.

250
00:13:56,210 --> 00:13:56,718
Thanks.