The following content is
provided under a Creative Commons license. Your support will help
MIT OpenCourseWare continue to offer high quality
educational resources for free. To make a donation or to
view additional materials from hundreds of MIT courses,
visit MIT OpenCourseWare at ocw.mit.edu. GARY GENSLER: Hello, everybody. Good weekend? Everybody staying dry, I hope. So we're going to dive back
in to blockchain, money. And we didn't lose
too many people when we did cryptographic
hash functions and digital
signatures last week. So I thank you for
all being back. So what were today's
study questions again? What's the Byzantine
Generals problem? Anybody want to tell me what the
Byzantine Generals problem is? Ben. AUDIENCE: So, the
Byzantine General problem is this sort of general
mathematical puzzle. And basically, what it is is,
how do you coordinate actors when they may be an actor
who's not acting in the best interests of the group-- how do you sort of get a
good actor on that then? GARY GENSLER: So there-- it might be how to coordinate
when somebody is not acting in good faith
as a malicious actor. But it also might be
just somebody that doesn't get the communication. Somebody that-- there's a
thought, whether it's malicious or not. How we doing, Alene? Yeah. How does proof of work and
mining in Bitcoin address it? We're going to
walk through this, and I'm going to give
you my sense of it. But does anybody want to
give a short version-- prepared for a-- Brodush. AUDIENCE: So the
proposed way solves it in a probabilistic way, rather
than a deterministic way, using amount of
CPU power to solve a problem of certain complexity
to prove that one consensus has been reached by a majority
of the participants. GARY GENSLER: All right. So what Brodush said is
it's probabilistic instead of deterministic. That you use CPU power
to form some consensus. I think that's what you said. I'm going to walk through
this in more detail. But does anybody want to
give another shot at it? AUDIENCE: I could say so
when a transaction happens, it is posted. And then miners get
in, and that they try to compete in solving this. And whoever gets it first,
then he claims the award. I would also say it requires
a lot of CPU processing power. I'm quoting the [INAUDIBLE]. So it needs to be powered. Big computers. So there is a question
around [INAUDIBLE].. GARY GENSLER: So remind
me your first name? AUDIENCE: Riham. GARY GENSLER: Riham. AUDIENCE: Yes. GARY GENSLER: Riham says
it's about people called miners or computers
called miners, which we'll talk about today,
using computer power again. But transactions were
part of that as well as to how it comes together. I'm not going to torture you
and ask a bunch more but, Addy? AUDIENCE: I think one of
the other important ideas is that even though solving
the problem is really hard, validating that the
solution is correct is easy. So what is ensured is that
even though miners are thinking about the computing power
to solve [INAUDIBLE],, it can propagate it [INAUDIBLE]
and then validate it. GARY GENSLER: So a
key point that Addy-- Addy raises is that once
somebody solves the puzzle, it can be propagated
across a network. And then others on the
network can validate it. So what we'll talk
about a little bit later is that it's a hard
puzzle to solve, but an easy puzzle to verify. And this is an important
asymmetry in essence, that there's a lot of
resources to solve a puzzle, but once knowing
the answer, there's very limited resources to verify
that it's the right answer. If it was not asymmetric,
it would not work as well. So it's a key part of the design
of many cryptographic things, but particularly, Adam
Back's sort of novelty in the 1990s of proof of work. I don't know if that's
just a relaxed bit for you, or you have your
hands up, Derek. AUDIENCE: Ah, no. That's-- GARY GENSLER: That's
just a relaxed pose. I like it. We're going to talk about other
consensus protocols as well. Proof of work is not the
only consensus protocol, but how to address ourselves
to Byzantine fault tolerance. And then some of the
economic incentives, so we'll talk about the native currency. What's the native currency
of the first blockchain application? AUDIENCE: Bitcoin. GARY GENSLER: Bitcoin. How many of you in this
room have owned a Bitcoin at some point in time? So you've all owned
the native currency that helps a blockchain. You got the opportunity to
read a paper that a group of us here at MIT co-authored. I hope some of you actually
were able to download it and-- good. Apparently, even when
you write something, it still goes behind
a copyright wall. So I'm glad to know that
it was actually available. And then back to the National
Institute of Standards and Technology paper as well-- this time the next chapters. And then a paper from
about 25 years ago on the Byzantine
Generals problem itself. So what are we
going to do today? We're going to go back
through the design. We're going to talk about
consensus through proof of work Bitcoin mining-- it's important. It's relevant. But it's kind of some fun
facts about that as well. The native currency-- of
course, Bitcoin of the first. But there's now at least 1600
different native currencies. What does it mean
to have a network? And why do networks matter
particularly for blockchain? Some of the other consensus
protocols, and then just wrap up. So just going back
to the review, and this is what we talked
about a bit on Thursday. But I think it's relevant to
just kind of bring it back. I found when I was
first learning this, it's hard to keep
all the moving parts. Remember, there's--
that graphic, you'll see all semester. But it's all the
different blocks. And it's append only. What does append only mean? Andrew. Why does that matter, this
word append only that we talked about last Thursday? AUDIENCE: Yeah. So that it's immutable. It cannot be changed. GARY GENSLER: Right. So it's immutable. Now, of course, because
cryptography maybe can be broken, but we use the word
immutable that it cannot be changed, except for
maybe as Alene so-- I like that that's in his book. You all have to see this. This is very clever. You know, a little-- how to do a flag. Maybe it's immutable
except for one out of 10 to the 40th times it could
be broken or something. AUDIENCE: Can I interject
and actually say that it's not that
good, actually. So technically,
Bitcoin and all of these permissionless
cryptocurrencies, one way to attack them is to mine-- to get a lot of
mining power and mine. But another way
to attack them is to just take control
over the actual network, like the internet. So if you're an internet service
provider, or if you're China, you can actually fork Bitcoin
with zero mining power by just controlling the network. So there's actually
an assumption behind how this
thing works, which is that the network works. Because everybody
sees the messages. GARY GENSLER: I agree with you. But there's also
some assumptions-- let's say that China,
or any state actor, chose to fork one of these. If it's considerably
less than a majority-- AUDIENCE: No. Zero mining. You can fork with zero mining. You won't get any mining charge,
if you control the network. GARY GENSLER: If you control
the worldwide network, or just the network-- AUDIENCE: Not the
mining network. The actual internet. GARY GENSLER: I understand. Are you talking about
the worldwide internet, or you're talking about
one country's internet? AUDIENCE: Let's say
you're in China. There's 50% of Chinese
miners in China. I forbid these Chinese miners
to broadcast with blocks. They find a block
that goes here, and they find another block
that goes here, it goes here, and it goes there. The rest of the world will
find the block that goes here. I have a fork. It goes here and here,
and I have two forks. They don't see each other. GARY GENSLER: So
we're going to talk about forks a little later. Can we hold Alene's
point until then? AUDIENCE: Sure. Sure. GARY GENSLER: And then I'm
going to share with you what Satoshi Nakamoto wrote about
this very issue back in 2010. AUDIENCE: And he
was writing back where you have mining power. He was assuming
the network works. Again, just to clarify. GARY GENSLER: Alene's raising
a point as to whether somebody captures part of the internet. And if the internet itself, by
capturing part of the internet, you fork the blockchain. And what I was just-- said I would hold for later,
but instead I'll cover now, is this question was
raised in an email exchange with whomever Satoshi Nakamoto
was back in around 2010. And his answer to
Alene's question that I'm just helping
share with you all, is that as long as that
part of the internet that was walled off was less than
a majority, and in fact, if it was China, because that
was in the example even eight years ago, it would be
considerably less than 50%, that within a reasonable
amount of time, maybe it would take a few hours,
but within a reasonable amount of time, one chain
would be where the majority of the
mining power was. And that it could take a
while, but the other one would probably stop,
that people would stop investing electricity
and CPU time within China, because they would
realize some way. Now, that was the
theory at least. AUDIENCE: And just to add onto
that, something to realize is like if you-- I mean, like, you said
we'll go into forks. But just for people
who don't know, like if you go in one
fork, then anything after that you go in all forks. So like if you lose connection
to the main Bitcoin network, you'll still have that, as long
as you have your private keys. So if somebody in China
realizes that they're on the wrong chain,
it's not like you've lost your actual bitcoin. GARY GENSLER: That's correct. They won't lose it up to,
if I can use the term, prior to the fork. AUDIENCE: Correct. GARY GENSLER: Was a question? Brodush. AUDIENCE: So just to add to
Alene's point, essentially. So the way he said-- GARY GENSLER: Since you're in
the back of the room, speak up. AUDIENCE: Yeah. So to add to Alene's
point actually. So there's an assumption,
underlying assumption, for the-- that the real problem in the
context of blockchain is-- you have the assumption that
the network can actually verify that the-- what is being-- [INAUDIBLE] what the network
is actually valid information. So that is kind of an
underlying assumption. If the network is
contaminated, then the premise on which the problem
is being solved, or the protocol that is being
given here as a solution to the problem, is
actually not valid if the network is contaminated. So that way, it is indeed
a underlying [INAUDIBLE].. GARY GENSLER: So I think,
because I didn't pick up every word, you're
just saying that there is an underlying
assumption that the network protocol, the communication
protocol of the internet, is not compromised
or walled off. But also, that it's working. It creates a database. We've talked about it
through hash functions and digital signatures,
and then consensus. So what were the
technical features? I thought about it a little
bit from our last class to help just thinking
through in three buckets-- the cryptography
and timestamping that we talked
about last Thursday; what we're going to
talk about today, the decentralized consensus
protocols and the network, of course, and the
native currency; and then lastly, transaction
script that we're going to talk about this coming Thursday. Now, it's not just three buckets
because it's three lectures. But it's three buckets
because they have something to do with each other. The cryptography, which is at
the core of cryptocurrencies and blockchains, and is
the core of a lot of things on the internet today, the
consensus mechanism, and then the transaction script itself. Cryptography, as
we've talked about-- communications in the presence
of adversaries-- also, a form of ways to make
commitments and secure computation. Hash functions, if you
recall what we talked about. What's the key of
a hash function? Here. Joaquin. AUDIENCE: The key
of hash function? GARY GENSLER: One--
the elevator pitch. You just have to make sure
that your sibling knows you. What's that? AUDIENCE: If you have two, the
private and the public key. GARY GENSLER: All right. That's a good--
that's cryptography, but not a hash function. AUDIENCE: OK. AUDIENCE: It's a
fingerprint of a fixed length of any amount of data. GARY GENSLER: I like that. One way data compression-- a crossword puzzle. Anybody here do the New
York Times crossword puzzle on a mobile app? Good. So if you do a Wednesday's New
York Times crossword puzzle, does it tell you whether
you're correct on Wednesday? Or does it not tell
you you're correct? When does it-- I don't
do the New York Times crossword puzzles. But-- AUDIENCE: Erin. GARY GENSLER: Erin. AUDIENCE: I'm actually-- I
usually do ones in the past. But I think it
will tell you maybe either that day or the next
day, or maybe [INAUDIBLE].. GARY GENSLER: Stephanie. AUDIENCE: So it
tells you as soon as you finish the puzzle whether
or not you have any errors. But it won't-- but you can't
actually check what the errors are unless you want to
invalidate your streak for that day. So basically, you get a streak
every time you [INAUDIBLE].. GARY GENSLER: I don't
actually know if the New York Times use hash functions. But they could. They could, because
they could stick the whole entire crossword
puzzle into a hash, and it's a commitment scheme. And remember, if you change even
one thing in the input data, the hash will come
out differently. So the New York Times
could use a hash function, so that Stephanie
could find out, right? Because you can only push
to see if it's correct when you finish the whole. And it either tells you
you have it or not, right? So I'm just-- I'm bringing it to real life
that a hash function-- just think of the New York
Times crossword puzzle. And if you don't
remember, ask Stephanie. We talked about
append-only logs. And recall that in
blockchain, in Bitcoin, there is a bunch of information
in the head of the block. And that which is in
the head of the block is put together like the New
York Times crossword puzzle. And we have a chain of blocks. Most of the data, though, is
stored efficiently in something called a Merkle tree. Again, it uses a whole
lot of hash functions. And so it's a way
to be efficient, but it's also a way
to secure the data. So now, we're going to get
back to your favorite thing-- digital signatures. So what's a digital
signature do? AUDIENCE: You can prove that
you're signing something like a transaction
with your private key. And the other person
on the outside could prove that
you are the one that signed it with your public key. GARY GENSLER: Perfect. So it guards against
tampering and impersonation. I didn't go through
this last Thursday, but think of digital
signatures two different ways-- a digital signature that
you use without a hash, and in Bitcoin and blockchain,
often it's actually-- it's combined with a hash. So as Joaquin just
went through, you can have a private key that
you sign something with, the sender's public key, and
a signature, and exactly that. But it's also able to do it
where you have a hash as well. You take all the
data, all the message, and you've put it into
it with a signature. And this is a little
bit too complex, and it was last
Thursday's lecture, but it's important to know that
what blockchain is basically doing, most
blockchains do, is they take a lot of information,
a transaction for instance, hash that information. And why do we hash it again? Kelly? AUDIENCE: To protect it from
other users of the network, sort of like we talked
about Alice and Bob, and how one has to be
aware of each other's key, and then back verify
the incoming message. GARY GENSLER: Right. And it also compresses
some of the data. But it's a commitment scheme. It's like this is it. This is actually the New
York Times crossword puzzle that answers all the questions. So usually it first hashes
it, meaning it's a commitment. And then put a digital
signature on it. And there was one last thing
we talked about last week. What are Bitcoin addresses? Isabella, can you tell me
when a Bitcoin address is? AUDIENCE: Umm. Is that what-- like,
I guess tells you where the Bitcoins being sent. GARY GENSLER: So it tells you
where Bitcoin is being sent. Ben, you want to
help out a little. AUDIENCE: So it's the
public hash, public key? Public hash of the-- GARY GENSLER: It's close. So it's basically that-- between Isabelle and
Ben, you've got it. It's basically how any
of the native currency-- Bitcoin-- can be identified. But it is a public key
with a couple extra hashes, and a little bit
other fancy footwork to make it compressed
and smaller. But it is literally what
you can send Bitcoins to. So it's determined by the public
key, but it's not identical to. And I found a fancy
little chart to define it. A private key leads to a
public key through some form. And in Bitcoin, it's called
elliptic curve multiplication. But there are other forms
of public and private keys. The public key,
then it gets hashed. And then it goes through a code
that makes it shorter, which is the Bitcoin address. Part of the reason
it was hashed, and part of the reason it
goes through that extra code, is to make it even more secure. It's not the only reason. It also compresses
it a bit more. But those of you who
have ever owned Bitcoin, you have a wallet. And the wallet keeps
those Bitcoin addresses. All right. So now let's talk about
decentralized networks, the topic of today. Any questions about the
review for last Thursday? I know it was quick. Alon? AUDIENCE: I have a question
about the double hash part. Does that mean that it's
now less feasible to be, like, less immutable? Because if you take
a 24-digit hash, and you contract it to a 4-digit
hash, there's fewer options. GARY GENSLER: I think that
you're-- the question is, is if the output of a
hash function is shorter, is it possibly more breakable? I think mathematically,
that might be correct. However, this actually
goes through two hashes-- one, which is this
mechanism called SHA-256. And the other one, I'm going to
mispronounce, but down to 160. So I think because it's going
through two different hashes, the answer is it's even
harder to break both. Does that-- AUDIENCE: That makes sense. GARY GENSLER: Any other
questions about the review? No. Please. Derek. AUDIENCE: So you said
hashing the public key makes it more secure. I'm just wondering, because the
public key is for the public. So what is the-- where does
the added security come from? GARY GENSLER: So the only thing
that you're actually showing is a Bitcoin address. Until later-- and we'll talk
a lot about this on Thursday-- when you actually
do a transaction, you have to then
disclose your public key. So initially, the storage
is around Bitcoin addresses. And some will advise-- and it's why many
wallets do this-- that you should never use
the same public key twice. Though, numerous people
do in blockchains. But to be most secure,
you would constantly be creating new public
key/private key pairs. And once you've used it, move
on and get a new set of keys. Got it? AUDIENCE: Yeah. GARY GENSLER: So
distributed networks-- we talked about Byzantine
Generals problem. So I found some
Byzantine generals. They want to all
attack that castle. Or what if only three of
them do, and two of them say retreat? That's the visual. That's the problem. The only way to win in
this mathematical game theory, a paper that was
written some 25 years ago, is if they all said attack,
or all said retreat. But the same thing sort
of came to computers. And the core thing about
a permissionless system is there is no
central authority. And if there's no
central authority, how does a distributed
network, like the distributed set of generals, come
to some agreement? Do we attack? Do we retreat? Well, it's based on a consensus
protocol and a native currency. That's the key innovation
of Satoshi Nakamoto, is to pull it all together. But it was built on the
backs of other people. Adam Back, in 1997,
he proposed a way to address email
spam and other types of computer problems called
denial of service attacks. Now, it ultimately wasn't used. I mean, he proposed it. It was used for a short
while, and then it wasn't subsequently used. But it's important to understand
that the proof of work in the middle of Bitcoin
was created 11 or 12 years before the Bitcoin paper. And the key was
basically require a bunch of computational
work using hash functions. And so the email, or the
header of the email-- this is Adam Back's, not Bitcoin. But the email, or the
header of the email, went into the hash
function, creates a hash. But the difficulty of finding
whether it's confirmed was was it in a certain
range of hashes? And he did that by the
quote, "leading zeros." Does anybody want to guess
why he did it this way? Or Alene's just going to tell
us probably and not guess, but-- who hasn't spoken yet? Emily, you want to try it out? AUDIENCE: I'm not totally sure. GARY GENSLER: Daniel? AUDIENCE: I mean, I guess just,
like, preserve some privacy around the emails? GARY GENSLER: Well, so it
definitely preserved privacy. But he was trying to put
some computational work. Every email that
would be sent would take one to two or three
seconds of computational work. That was in his original paper. It would take a few seconds. AUDIENCE: The fact that we-- earlier we were
talking about the fact that we need a way
in which we have to make the puzzles difficult
to solve, but easy to validate. This is exactly how the
whole thing is accomplished, by setting the hash into a fixed
characteristic, like leading-- a number of leading
zeros, what you get is to modify a small piece
of the whole information, and try and try until you
get that specific hash. And that makes it really
computational intensive, but validating is just
running one hashing function. So-- GARY GENSLER: Do you have a-- AUDIENCE: I mean, it comes
back to what we talked about last time with the nonces. You need to try out a bunch
of different random numbers in order to get the right
number of leading zeros. And it could be-- I don't know. I think it could be
like leading anything. But he chose zero
because it's nice. But you need to try to
get the numbers in order to get the right number. GARY GENSLER: And in
the email circumstance, his thought was it will take
two or three seconds for anyone sending an email to
do this proof of work. But it will take a nanosecond
or less to confirm it. But if you were
sending spam, and you had a computer to send
millions of spam times two or three
seconds apiece, that would be too much
for the spammer. That was it. So any one person-- any
person sending one email, it won't be too bad. Anyone sending millions of
emails, it would be lousy. And so that's why this concept
was in the midst of emails. And it could be
efficiently proved. So back to blockchain, the
innovation was basically, how do we do this with a chain? How do we do this with
a chain set of works? And remember, Stuart
Haber, that whole thing about the blockchain and
what's in the New York Times was that chain of information. But here, why
don't we do a proof of work between the chain? And I found a little graphic. But the SHA-256, that's the
formula which is used to hash the header-- the previous hash, the
transaction hash, a time stamp, and a nonce. Can you find a hash that has
a certain number of leading zeros? This was the key innovation. In a sense, or maybe
Satoshi Nakamoto was just taking Adam
Back's email proof of work. Remember the reading
for last week of blocks? This is colored green
because each of them have hashes that in
this case have leading, if I'm right-- is this
leading four zeros? Leading four zeros. What if we change one thing? What's going to happen? Is it Alfa? AUDIENCE: Yeah. GARY GENSLER: What happens
if we change one thing? AUDIENCE: The hash
should change completely. GARY GENSLER: The hash
will change completely. So what happened? What did we change? Here, I'll go back and forth. AUDIENCE: You changed the color. GARY GENSLER: What's that? Zan? AUDIENCE: You changed
the coinbase transaction, so that $100, I guess
in this example, went to you instead
of [INAUDIBLE].. GARY GENSLER: Well,
why shouldn't I be able to get $100 for free? AUDIENCE: Well,
in this example, I guess the coinbase is
for the miner, right? So there's one
transaction dedicated for whoever validates
the block, gets, right now, 12 and 1/2 Bitcoin. And so you add that in addition
to all the other transactions that you're validating. But in this case, you're
not actually this miner. So you shouldn't be
getting that much. GARY GENSLER: So the little
18-minute video that was assigned for last Thursday, I
just went in, and I was trying to-- I was trying to get-- I was trying to get
the money for me. And it invalidated
the rest of the chain. And that's really-- that's the
sort of innovation or genius is, is if you try to
go into a former block, whether it's the last block or
a block 100,000 blocks away, and change one little
whisker of information, or one letter on that
crossword puzzle, it's going to change
the entire blockchain. And I bring it back to
the crossword puzzles, or a whisker on a cat. It's just any little
bit of information. So an innovation
about hash functions became, and an innovation
about timestamp blocks, all of a sudden came
together with this proof of work innovation. So now to the chains themselves. The consensus of
blockchains-- and many people would say that, in fact,
the reality of blockchains is only the longest chain is
the one that other miners, other people, will build upon. As I understand,
though, it's not written into the base
computational code. It's really just a
consensus that comes about. This is an example-- the purple block and
the black blocks. The purple blocks are
kind of stale blocks. They were mined. They were computationally
solved a proof of work. But nobody mined on top of them. And if somebody doesn't
mine on top of them, then eventually they're ignored. Some people call
them orphan blocks. But I'll call them stale
blocks, because they were actually created. But the information that's
in them is kind of worthless. It's not needed. In the actual
Bitcoin technology, this happens from time to time. But it hasn't happened
in over a year. The technology, it's-- and you
can look on various websites to find this out. Probably at the maximum,
the longest stale chain goes out to two or three blocks. But it's very, very rare. So back to Alene's question
of what if China carved off and had the presumption--
it may not work-- but the presumption
is, let's say, China is the purple blocks. Because China's walled
off its entire network. The presumption is there'll
be some communication outside of the network. It might be on television. It might be by courier, that
the Chinese miners would know that they're
not in the majority, and they would stop
expending electricity to even mine in
that circumstance. Because whether it's a few hours
or a few weeks or a few months, they know that
their expenditures would be worthless. Tom. AUDIENCE: In these
stale blocks, these forked blocks, are the
miners receiving Bitcoins? GARY GENSLER: So in the
purple blocks, there will be, if I can go back to this, there
will be a coinbase transaction. But it will be worthless. Because it's a coinbase
transaction in a block that's not on the main block. And it won't be usable later. But in Bitcoin itself, there's
software that says you cannot use a coinbase output
for 100 blocks. It's written right
into the base code. And it has been
since the beginning. AUDIENCE: So can you
not verify though that-- so in the situation where
network is walled off. People start mining on top
of this segmented block. Would they not realize
that their Bitcoins are invalid for 100 blocks, save
for some external knowledge. GARY GENSLER: Yes. Let me just go back to the-- sorry-- the chain. You're saying if--
Tom's question is, is what if the purple side
chain goes on for 100 blocks. What happens? And in fact, we have
circumstances of that. Bitcoin has split between
Bitcoin and Bitcoin Cash. It was called a
hard fork last year. And for a moment, let's call
the purple chain Bitcoin Cash. It's not only gone
on for 100 blocks, it's now gone on for tens
of thousands of blocks. It is now its own
native currency. Within that community
that purple blockchain is so long now, that people
have found value in that. And it is its own
native currency. And the reason I share that
is to Tom's question of, well, what if China was walled
off so long, it's plausible-- unlikely, but plausible-- that
there would become some value and call it the Bitcoin China
blockchain versus the Bitcoin global blockchain. It would be-- what is money,
but a social consensus? AUDIENCE: How does
this society work? I mean, is it based on supply
and demand, the amount of forks out there? And then the other
question that I have. Who decides it? So if it's supply and
demand, is it community? And what is the form of reward? GARY GENSLER: The question
is, is the reward-- I'm going to hold a part
of it for a little bit when we talk about native currency. But the reward is,
in nearly every blockchain is a new native
currency of that blockchain. Bitcoin for Bitcoin. ETH, or E-T-H, for the Ethereum. XRP. For each blockchain
there's a native currency. Who-- the second question
was, who decides it? It's generally, but
not always, hard programmed into the first
release of that blockchain. AUDIENCE: Yeah. So back to the question on
Bitcoin and Bitcoin Cash. If the Bitcoin Cash is the
purple line that we see on the chart here, does that
mean-- because it's shorter, compared to the block-- Bitcoin chain. Does that mean that under the
assumption of the majority consensus, the value of
which is essentially zero? GARY GENSLER: So the question
is is if it's shorter, does it-- AUDIENCE: So there's no
validity in that chain. And therefore, the
value becomes zero. GARY GENSLER: So there's two-- using this chart
just as an example. There's two ways-- there was-- the main point of
this chart was to say that the black chain,
as represented in black, is the main chain. And that is where the
social consensus will stay. That's where the consensus is. And generally speaking,
the stale blocks don't mean anything, and
the stale blocks go away. Occasionally, there
is something called a hard fork, where the
social consensus continues to maintain. And I was using this
chart as a rough answer to Tom's earlier question
about Bitcoin Cash. And if the purple chain kept
going for thousands of blocks, and there was a social consensus
to keep both chains going, you'd start to see
separate currencies, as you've seen
with Bitcoin Cash. Does that help? So I was using a graphic to
answer a separate question. I'm going to take
two more questions, and then go to
native currencies. I haven't heard from Daniel yet. AUDIENCE: So my question
is similar to the mining. So if your transaction
is on one of the blocks, does that transaction
become void, so to speak? GARY GENSLER: It's
not so much void. It's just-- it's meaningless. It's-- yes, in a sense,
effectively, it's void. AUDIENCE: So I guess would
somebody-- if you initiated that transaction, would
you be aware of that and reinitiate it? GARY GENSLER: Very
good question. The transactions will
still be in what's called the memory
pool of anybody who's mining on the main chain. So transactions-- which we'll
talk a lot about on Thursday, this coming lecture-- go in through the network. They're propagated
through the network to the entire node network. In Bitcoin, there's
about 10,000 nodes. And they will receive those
coins and those proposed transactions. So anything on the
purple chain will still be in the other
chain's memory pool. One more, and then
I'm going to-- AUDIENCE: In the
case of the hash-- GARY GENSLER: Your
first name is? AUDIENCE: Iash. GARY GENSLER: Iash. AUDIENCE: In the case
of the hard fork, so between Bitcoin and Bitcoin
Cash, what are the differences? And what about the differences
in value between those two? GARY GENSLER: That's a
much longer question. The question is, is
what are the differences of value between Bitcoin
and Bitcoin Cash? And though, I think Bitcoin
is trading around $6,300, and Bitcoin Cash is-- AUDIENCE: It's about $435. GARY GENSLER: --$435. Thank you, Zan. That gives you the monetary
difference of about 15 to 1. But it would take
more conversations about why that happened and
background and so forth. So let me talk about
the difficulty factor. So proof of work, at
least in Bitcoin's case, has a difficulty factor
with regard to these leading zeros in the hash. And Satoshi Nakamoto said, let's
change that every 10 minutes. Let's ensure that every block
comes on average every 10 minutes. And to do that, define how
many leading zeros there needs to be. And it adjusts about
every two weeks. Every blockchain
can be different. It doesn't have to
adjust every two weeks. This is just what Bitcoin did. This is what Nakamoto
did to maintain an average of 10 minutes. So what has happened? Currently it takes
18 leading zeros. And because this is in a 60-- it's in a hexadecimal
character system. Every decimal is-- what's that? AUDIENCE: Four bits. So it's 64 leading zeros in
bits, and 18 in hexadecimal. Is it? GARY GENSLER: So
it's 2 to the 64th. AUDIENCE: But the probability
of finding a block is 1 over 2 to the minuses. GARY GENSLER: So
what Alene just said was that it's a very small
chance of finding a block, because this is the equivalent
of 18 leading zeros-- so that's more than 64. It's 18 times 4. AUDIENCE: Oh. Yeah. I know. I'm sorry. I can't do arithmetic. GARY GENSLER: Yeah. PhD in computer science,
but can't do arithmetic. So this is the most recent block
I grabbed off the blockchain this morning. And it has 18 leading zeros,
and then all those other digits. That's block number 541,974. 18 leading zeros. The genesis block, the very
first block in January of 2009, had 10 leading zeros. But the requirement that
Satoshi Nakamoto actually put into the computer
code was you only needed eight leading zeros. So the probabilities
have gone way up. So let me take it off of
fancy numbers like that, and just say this is the actual
Bitcoin mining difficulties on a logarithmic scale. Because if it
weren't logarithmic, you couldn't really read it. The difficulty was set at one. This is all scaled to
how difficult was it for the first year and
a half of mining in 2009 and early 2010, one. And now, it is at one trillion. It's actually more
than one trillion because it's logarithmic. It's at about seven trillion. It is currently seven
trillion times harder to find the answer to the
puzzle than it was in 2009. And that's because there's
a lot of computers trying to hash all of this stuff. AUDIENCE: So is that where the-- GARY GENSLER: Kelly. AUDIENCE: --the collectors
in the pools of mining nodes work to be able to achieve
this at a more efficient rate? GARY GENSLER: Correct. Correct. And the hash rate is now
somewhere around 50-- it's not terahashes. I'm trying to
remember what the-- what's that? AUDIENCE: Hexahash. GARY GENSLER: 50 hexahash
per second, which is like 1,000 trillion hashes. Because a terahash
is a trillion hashes. Zan. AUDIENCE: I think it's worth
noting, though, it didn't scale linearly as, like,
number of computers got on the network. It's also the hardware
has gotten incredibly more sophisticated. So it's not that
you can just assume there's 15 trillion number of
people that are mining Bitcoin. It's just the same people
that are doing it better. GARY GENSLER: I can't ask
for a better setup than that. Bitcoin mining evolution--
did you see my slides? AUDIENCE: I just read your mind. GARY GENSLER: So what
what's the evolution? So it started with
central processing units. And CPUs-- and I'm not sure
my numbers are accurate, because I might be
using CPU power today, and not CPU power in 2009. Apologies for those who know
CPU power better than mine. You could do about 2 to
20 million hashes a second on a CPU properly
geared, apparently. They didn't last that long. By 2010, some folks figured
out there was something faster, and it was called a
graphics processing unit. We all use GPUs all day
long, because that's what gives us all our quick
graphics if you live stream something on your laptop. And graphics processing
units, somebody figured out you can use that, and
you could hash faster. And then all of a
sudden, hobbyists started to wire the GPUs together. And they could figure
out a way to get between 20 million hashes to
300 million hashes a second. I'm told that even
today you could maybe get up closer to a thousand
million hashes a second, or a billion hashes a
second, if you did a GPU rig. But that's yesteryear
on Bitcoin. Now there's something called an
application-specific integrated circuit, an ASIC. Just think about a circuit that
the only thing the circuit does is create hashes. In fact, the circuit is wired-- I use the word
wired, because I'm old enough to remember wires. But it's-- the circuit board is
manufactured in a way that all it does is the SHA-256 hash
function to Bitcoin mine. And the first ASICs, which are
dedicated circuit boards to do this mining, came out in 2013. And even since then, they
have moved up the scale. The most expensive that sells
for about $3,000 or $4,000 in ASIC could do 16 terahashes
per second, or at least that's what it's rated
for if you go on Amazon and try to buy it. And you could do that. But you'd be competing with
something that looks like this. A modern map mining factory for
Bitcoin has thousands of ASICs. They have water cooling
systems to keep it cooled down. And they're probably
buying their electricity for less than 3 kilowatts,
$0.03 per kilowatt. And they might even be paying
off the local government officials, and not even paying
the electricity company, and just bribing to
get their electricity. Emily. AUDIENCE: This might
be a dumb question, but is there an
economic opportunity cost of using all this
processing power just for mining Bitcoin? Like, is there a more
efficient allocation of that processing capability in terms
of like more-- for a more stable economic usage? GARY GENSLER: There are
certainly trade-offs here. And the aggregate electricity
for all of Bitcoin mining, now that it's seven trillion
times harder than it was in 2009, has been
compared to the electricity use of countries like
Ireland, on the way to the electricity use of
countries like Denmark, I think. It's somewhere between
Ireland and Denmark. See ya, Larry. Alon. AUDIENCE: Well, add
to that the cost is-- let's assume it's in dollars
or whatever currency, and the reward is in Bitcoin,
the volatility of Bitcoin makes it hard to
answer that question. Because you don't
know if there's an economic value for you,
because you don't know what will happen to Bitcoin. GARY GENSLER: So I said
in our first class, I'm neither a blockchain
maximalist or a blockchain minimalist. And you all will have a
chance through this course to form your own views. But one of the debates is, all
right, Emily's [INAUDIBLE].. Is this a good use of economic-- a good use of resources? But I would note that all strong
currencies, strong monies, for centuries have had
something to limit the supply. And so now we're doing
it electronically and through this mining. That doesn't mean
it's the best use. I'm just saying
it's another way. Extracting gold out of
the ground is very hard. And in the 19th century, to have
big vault doors and security guards with rifles was
a way to insure it. And one could even say
that having central banks takes cost. So I think of it as
a trade-off of how you ensure a currency as a
harder currency to create. But it doesn't mean
that proof of work is the best way, which
is, of course, then, the setup to the question
of, are there other ways to do consensus? So one other thing is
all of this hashing, how is it distributed? And this, I pulled off
the internet this morning. You can see these
statistics every day. Proof of work and mining
has formed mining pools. And these mining
pools come together for simple economic reason
that it's so unlikely to solve the riddle, solve
the puzzle of mining, that if you can only solve it
once a year, or maybe even once every 10 years, you weren't
going to invest in mining. So mining pools started around
2010 to smooth out the revenue. So if Amanda doesn't want to
get it once every 10 years, she might say, well,
why doesn't all the 80 people in this room-- you might, Amanda,
I don't know-- say, why don't we
all form a pool, and we'll all going
to use our laptops. And now this is
still 2009 or 2010, when you could mine
Bitcoin on your laptop. But we could say, why don't
we all do that together? And then all of us
could say, well, Amanda, that's a bright
idea, but could you create the Merkle root for us? Could you do some
other things so that our computer
doesn't have to do all that other fancy stuff? So then Amanda might say, well,
I want to charge all of you a little bit. How about if I charge
you 1% of the take? And Amanda would call herself
a mining pool operator. That's what's
happened, is basically the economics of
mining have clumped around mining pool operators. And the standard fees
range from 1% to 3%. That the mining pool operator
provides a number of services to the miners themselves,
and those services are compensated, as I say,
somewhere between 1% and 3% of the returns. But mostly, it smooths out the
economics for all the miners. It does some other things as
well, but that's the primary. AUDIENCE: So I also
had one question. You laid out the
difficulty, as mining has become increasing
difficult. And the cost of the electricity--
the break even point has actually become
lower and lower in terms of the electricity cost. So with that in mind, over
the next couple of years, if that's the case, people
will start to lose incentive in keep doing the mining. And once that happens-- once
that happens, [INAUDIBLE].. GARY GENSLER: Well, it
could go either way. As we said-- just
Bitcoin, this is-- Bitcoin adjusts the difficulty
of mining every two weeks. So if there's fewer
people mining, the difficulty will go down. And if you remember, I said you
had to have 18 leading zeros. It might go back to 17 leading
zeros or 16 leading zeros. And every two weeks, it adjusts
based upon the prior 2016 blocks. Did it average 10 minutes? If it averaged, for
instance, 14 minutes, then it will lower the difficulty. If it averages six minutes, it
will increase the difficulty. Kelly. AUDIENCE: So is this where
the proof of stake comes in? Does BTC always get their 19%
because they have the largest stake in the system? GARY GENSLER: So Kelly
is asking whether this is where proof of stake comes in. What is proof of stake? Anybody who read the
Coindesk article? See, you when you
hide your first name, I can just call
you US Air Force. It's true. Bo's name card
says US Air Force. AUDIENCE: That's true. So proof of stake is the coins-- all the coins are already
dispersed onto the network, and the verification allocation
is allocated based on-- GARY GENSLER: So proof of stake
is an alternative consensus mechanism. And Bo described it well. But Kelly, it's not
related to this chart here. This is all proof of work. BTC has 19% of the hash rate. That means that they
literally have about-- if the total hash power
on Bitcoin is 60 hexa-- do I have the word-- AUDIENCE: It starts
with an e-x-- exa. GARY GENSLER: Exahash-- then
19% of that, or about 12. AUDIENCE: That's what
they're attempting to do. That's not the stake
that they already have. GARY GENSLER: Correct. Most Bitcoin miners
sell their coins. So the coins that are created-- the coins that are
created each year are sold into the
broad community. Very few miners hold
onto their coins for great lengths of time. I mean, they might for days. That might for-- they might keep
some for all sorts of reasons. And as I truly believe,
but can't factually prove, a number of the biggest
mining pools or miners are in places where they're
doing illicit activity. They're getting
their electricity for less than what it's
really costing on the grid by bad actors. But nonetheless,
they have a choice whether to sell their
coins or keep their coins. Got a question over here, and
then I want to keep going. AUDIENCE: If the mining
industry is like so formalized, like you've so many
pools, what prevents all the pools from coming
together and saying that, let's just solve lesser puzzles
so that the value becomes lower, and then the
charge is much lower for each and every one? GARY GENSLER: So
the question is, is what happens if the
mining pools collude and come together, either, as
[INAUDIBLE] says, to, let's say, well, why should we
have so much mining capacity? Let's, as a cartel-- like OPEC, the oil cartel-- say we should constrain
supply and so forth. I think what constrains
that is it's an open system. But it's possible. It's plausible. I think the bigger
question, and there's been numerous academic
papers around this, is what happens if the mining
pools come together and try to do what's called
a 51% attack, and try to take
over the blockchain? And that's a more
interesting challenge. And we'll talk about that
throughout the semester. It hasn't happened as of yet. Let me talk about the
native currencies. Native currency
helps do all this. What Nakamoto said, is it
was an incentive system. There was an incentive
system, but it was also a peer-to-peer way to
create a new money. And embedded in most
blockchains, not 100% of them, there is something, I put quotes
around it, monetary policy, in essence, that limits
the supply of the currency. Not every blockchain has this,
but the vast majority do. And when we start talking
about initial coin offerings, you'll find some that don't. But Bitcoin limits it. And I'm just going
to say what it is. It's created in a coinbase
transaction in each block. It was initially 50
Bitcoins per block. But now, because it's
halved every 210,000 blocks, it's just 12 and
one half Bitcoins. That's the number of
Bitcoins you earn each time if you mine a block that's
approximately $75,000 US dollars in value
today, give or take, or $80,000, roughly,
to mine a block. The inflation rate for
Bitcoin right now is 4.1%. So think-- for any of you that
have taken monetary policy courses or financial courses
that talk about the Federal Reserve, Bitcoin is growing
about 4% a year right now. But it halves every
210,000 blocks. So the inflation rate
will go down to 2%, and then later to about 1%, and
later about a half a percent. And it caps around
the year 2040. So whether Satoshi was one
person or a team of people, back in 2008 they put in
place a monetary policy that is hard-coded into
the computer base code, and is supposedly going
to be there forever to cap Bitcoin at
21 million Bitcoin. I'm going to throw up Ether just
because it's an alternative. Currently, that mines
three ETH per block. And the inflation
rate's about 7 and 1/2%. It's a different
stage of development, different inflation rate. But there has been a proposal
recently to literally-- it was a proposal
by the programmers, we should really lower
the inflation rate. And if it's accepted, it
will be adopted in November. The fees in Ethereum are largely
paid in something called Gas. Gas is just a small
unit of Ethereum. What's the small
unit of Bitcoin? AUDIENCE: Satoshi. GARY GENSLER: Satoshi. So Gas and Satoshi
are very similar. Brodush. AUDIENCE: I think the
limit of 21 million has switched to 2140, not 2040. GARY GENSLER: It's not 2040? AUDIENCE: It's 2140. GARY GENSLER: Yes. Wait. You think it's 2140? AUDIENCE: [INAUDIBLE]. GARY GENSLER: What's that? AUDIENCE: I also [INAUDIBLE]. GARY GENSLER: All right. So I typed poorly. Aviva, did you have a question? No. Alene. AUDIENCE: So this is-- Bitcoin is a
deflationary currency? AUDIENCE: Yes. GARY GENSLER:
Well, Alene says is Bitcoin a deflationary
currency, depending upon your use of that word. But others have
written that Bitcoin is a deflationary currency
because it's not growing. If the economy is
growing at x percent, and x percent is bigger
than how Bitcoin is growing, that would sort of define
it as deflationary. I would just note that
those who are fond-- and there's a lot of
academic literature. And this goes back
decades, if not centuries. For hard currencies, where
monetary policy is absolutely formula-driven, whether it's
the Taylor rule or other rules-- rule-based monetary
policy would have a fondness for what you could
maybe put in computer code. Those who think that
humans should be involved, and many people
think there is a need for some human
involvement, would say this is too hard-coded, and
you'd want something where you can modify it and change it. And that would be
dangerous in times of war, in times of stress, in
times of economic peril. Or like the 2008 crisis, that
this would make a crisis worse. And so the academic literature
and the real life reality of the last couple of hundred
years of hard currencies, hard monetary policies
versus human involvement and some judgment, is kind
of an interesting debate that goes right in the
middle of all of this. AUDIENCE: [INAUDIBLE] question. Would you consider
this as being currency? Or is it an asset-- it's a class of asset that
has some aspect of a currency. GARY GENSLER: So the question
is, is this is a real currency, or is it just an asset that
has aspects of a currency? Ben, what do you think? AUDIENCE: So there
were three roles of-- well, three ways that you
could define a currency. It was the unit
of account, stored value, and medium of exchange. So I guess this has all
of those attributes. So you could call it a currency. GARY GENSLER: You're saying
if it has all of those. AUDIENCE: It does
have those attributes. GARY GENSLER: Oh, it does. All right. So Ben thinks yes. How many people are with Ben
as of September 18, 2018, not 2118? So Isabella's there. Zan, Joaquin? How many people-- Tom. How many people think not? I don't-- I think that you
all get to decide yourself. Mark Carney, who's the governor
of the Bank of England, gave a speech earlier
in the year, which is assigned in a later class. And he says, I don't
think we should call them cryptocurrencies. They should be
called cryptoassets. They're not yet evidencing
all three of these. So that's Mark Carney, who
I have great respect for. But there are others that say,
no, it's evidencing enough. I would say this, though. It's plausible that they will-- and this-- if you take
nothing else from the class, it's plausible in my view
that they could provide. You could have digital
currency that does not have a central authority. I mean, I think that
innovation is there. Whether you call it a
cryptocurrency or cryptoasset at this point in time,
I leave to all of you. There won't be a right answer
to that on any paper you submit. You can use whichever term
you think fits your thinking. I want to talk
about the network. We only have 10 minutes. But the network is important. And a lot of times when
you talk about Bitcoin and blockchain, folks aren't
going to talk about it. But I want to quickly hit eight
or nine players on the network. There are full nodes. A full node is a group-- is a computer, I should say-- that stores the full
blockchain, and is able to validate
all transactions. It doesn't have to. It's a volunteer thing. But it can validate
all transactions. A pruning node-- you're not
going to read a lot about it, but I just have it. It prunes transactions
once they've validated, and they have a certain age. They're saying, all of
those early transactions, we're not going to focus. There's been probably six times
the number of transactions that have happened compared to
the actual extant transactions right now. So all the transactions
that have ever happened, five, six of them have
already been used. They're not around anymore. Why do we have to lug it
around in our data set? So you could have
a pruning node. Lightweight nodes,
which if any of you have a Bitcoin wallet
or any other wallet, you probably have
a lightweight-- some form of lightweight node,
or what's called an SPV node. It stores just those
blockchain headers, rather than all this detail underneath--
a lot less storage. But a lightweight
node has to rely on the full nodes
for verification, because the lightweight
node's not going to be doing that on it's own. Miners-- we talked about miners. I want to just
mention, miners don't have to be full
nodes Amanda, you're running this mining operation
for the whole class. And we're paying you 1% to 3%. But you're Sloan, right? You're probably charging
at the high end, right? So do you think that Amanda,
as a mining pool operator's, operating a full node? Tom? AUDIENCE: Yes. GARY GENSLER: You're
saying it tentatively. But Tom, you're paying
Amanda 2% of your fees. Don't you want to make sure
she's validating everything? AUDIENCE: Just lost
a whole percent. GARY GENSLER: What's that? AUDIENCE: She thinks 3%. GARY GENSLER: Oh. She thinks 3%. AUDIENCE: Yes. GARY GENSLER: But any of
you who are just miners, remember Amanda's
our pool operator. Anybody who's-- Andrew, do
you think you need a full node if Amanda-- AUDIENCE: No. GARY GENSLER: No. So a lot of miners are
not operating full nodes. They've got all
those racks of ASICs. They're running all
their electricity, and they're paying
Amanda to check on it. Don't let them down. Alene? AUDIENCE: I think this
is a terrible thing. Because in principle, we
have 20, 30 mining pools, which means you have 20, 30
computers which validates the newly proposed block. And the thing that
everybody wants to believe is that these systems
are decentralized, and you have thousands
of contributors. GARY GENSLER: So I might start
calling you Nouriel Roubini, but I won't. But Nouriel Roubini, who's
an economist-- he's sometimes called Dr. Doom. And he likes that phrase,
because he caused downturns in the markets. There's a later
reading, and I might have even done a video of-- Roubini has this view, that
it's not decentralized, and mining pools are an
Achilles heel of the system. But the full nodes,
the 10,000 nodes, actually still do validation. And there's an interesting
social construct where there's a
lot of nodes doing, in essence, noncompensated
work validating transactions beyond Amanda. And any miner-- Andrew could validate
if he wants to. So there's a lot of free
riding that goes along, and the economics
of free riding. And then there's wallets,
which probably 30 or 40 of you have on your computer somewhere. They store and view and
send all the transactions. But importantly, also
create the key pairs. So a lot to cover. There's one that's not
a node itself at all. It's called the mempool,
or the memory pool. And we're going to talk
about this more on Thursday. But the memory pool stores
all the unconfirmed, but yet, already validated. So they've been
validated by somebody. A transaction goes
out into the network. A full node validates it, and
it's put in a memory pool. And Amanda grabs
the memory pool, and sends it out to everybody
in this class in a block. And then we mine it. We're not going to chat
much about these right now. But we talked about-- there was a Coindesk article. How many of you actually
skimmed it, looked at it? Did it mean anything
to you, or just meant that there's some alternative? What's that, Prya? AUDIENCE: Just that
there's some alternative. GARY GENSLER: There's
some alternative. That's what it meant to
me the first time I looked into this about six months ago. But I want to just mention what
the alternatives come down to. They generally randomized
or delegate the selection. So rather than saying
any one of 10,000 nodes can prove that this
works, they use various mathematical means-- randomized or delegated. And sometimes they
do a little bit of delegation and
randomization to pick who's going to validate
the next block. It all comes down to who
is picking the next block. Is it by Adam Back's sort of, as
Satoshi Nakamoto put out there, we'll call it Nakamoto
consensus, proof of work? And you'll have a
paper for Thursday that talks about Nakamoto
Consensus, the Clark paper. But-- or is there some other
randomized, delegated way to do it? In some of them, they
have a second check. If there's a delegated
person to validate something, they put a second check
in there that there's another group that officiates
and says whether it's correct. And so there's proof of stake,
which is based on the stake you have in the
underlying currency. There's proof of activity, which
is kind of a hybrid of proof of work and proof of stake. Proof of burn-- are you
willing to give up coins? Proof of capacity-- do
you have storage capacity? And you might have
a tiered system. The major permissionless
blockchains all use proof of work. And the reason is
nobody's really solved-- all of these other
alternatives, no one's really solved for a couple
of problems in them. But they usually
find a way to be more efficient through
delegation and randomization, and might have a backup
set of checks on it. DASH and NEO will say that
they use proof of stake. But they're actually kind of
using some form of masternodes or set up professional nodes. But DASH and NEO are
kind of, I think, the 13th and 15th largest
market value cryptos, which means everything else kind of-- And Ripple doesn't-- Ripple's really almost like a
permission system rather than permissionless. I mean, they would say
they're permissionless. But it's a confirmed set of
nodes in the node system. So that's it for today. We're going to do
transactions on Thursday. I moved that study question. And then I'm going
to ask you to read through the Clark
paper, which is really the academic pedigree. Where is this built on? What's the background? But I think it's a good way
to bring it all together. And remember on
Thursday, you all come in to answer this
question-- your own view as to who Satoshi Nakamoto is. There is no right answer. But if MIT's Blockchain and
Money class can answer that, I'm sure that we'll get a
write-up somewhere about it.
