比特币：点对点电子现金论文
原始发布页
打开来源页面查看 1 个交叉存档
Ray Dillinger 写道：
一种实现方法是 让接收币的人生成一个非对称 密钥对，然后将其中一半随 交易一起公开。为了以后花掉这枚币，他/她必须 证明自己持有这个非对称 密钥对的另一半，可能的做法是用它为 新卖家提供的密钥签名。
没错，它使用的是 ECC 数字签名。每笔 交易都使用一个新的密钥对。
它并不是以化名识别人的意义上的假名制，但它 至少具有一点假名性，因为一枚币的下一步操作 可以被识别为来自该币的所有者。
嗯。我不知道自己是否能接受这一点。你是说 没有尝试识别并排除那些不 合作的节点吗？我怀疑这会导致麻烦和潜在的 DOS 攻击。
这里不依赖对任何人的身份识别。正如你所说，这种做法 徒劳无功，而且可以用马甲轻而易举地规避。
证明某人真实存在的凭证，是其提供 CPU 算力的能力。
直到……直到什么？大家怎样知道一笔交易何时 已经变得不可撤销？“几个”区块是三个？三十个？一 百个？这取决于节点数量吗？它与节点数量的关系是对数的 还是线性的？
第 11 节计算了遭受攻击时的最坏情况。通常，5 个或 10 个区块就足以应对。如果你出售的东西 不值得别人为了窃取它而发动网络规模的攻击，实践中你 可以把界限放宽一些。
但在没有身份的情况下，如果支出后来变得无效， 而他们已经收到了通过双重支付换取的 商品（网站访问权限、下载内容， 等等），他们也不会遭受任何损失。商家只得承担损失，手里留下 “无效”的币，除非他们等待那神奇的“几个区块” （而且他们怎么知道该等多少个？），然后才把付款者 视为已经支付。
如果消费者花出币后还要等一个小时完成清算，才能使用 自己用币购买的东西，他们不会接受这种做法。 如果商家发现客户的币因客户进行 双重支付而无效，却又没有办法向客户撤单，他们也不会接受这种做法。
这是一个版本 2 的问题，我相信对大多数应用来说，可以相当 令人满意地解决。
这场竞赛在于先把你的交易传播到网络中。想想 6 个 自由度——它会指数式传播。一笔交易大概只需 2 分钟 就能传播得足够广，以至于较晚起步的竞争者在前一笔交易 席卷整个网络之前，几乎没有机会抢占很多节点。 在这 2 分钟内，商家的节点可以监视是否有 双重支付交易。双重支付者无法在不让商家 收到的情况下，把他的替代交易猛然广播给全世界， 所以他必须先等待再开始。
如果真实交易触达 90% 的节点，而双重支付交易触达 10%，双重支付者只有 10% 的机会不用付款，而有 90% 的概率其钱会被花掉。对于几乎任何类型的商品，这 对骗子来说都不值得。
网站访问权限或下载内容之类的基于信息的商品 是无法设防的。没有人能够靠 窃取网站访问权限或下载内容谋生。他们可以去文件 共享网络窃取那些东西。大多数即时访问型产品都不会 产生巨大的盗窃诱因。
如果商家确实遇到盗窃问题，可以让 客户等待 2 分钟，或者等待电子邮件中的某些内容，许多商家 已经这样做了。如果他们确实想优化，而商品是一个很大的 下载文件，那么当交易返回为双重支付时，他们可以中途取消 下载。如果商品是网站访问权限， 通常让客户先访问 5 分钟，然后在交易被拒绝时切断访问 也不是什么大问题。反正许多这类网站都提供免费试用。
Satoshi Nakamoto
英文原文
展开英文原文
Ray Dillinger wrote:
One way to do this would be to have the person recieving the coin generate an asymmetric key pair, and then have half of it published with the transaction. In order to spend the coin later, s/he must demonstrate posession of the other half of the asymmetric key pair, probably by using it to sign the key provided by the new seller.
Right, it's ECC digital signatures. A new key pair is used for every transaction.
It's not pseudonymous in the sense of nyms identifying people, but it is at least a little pseudonymous in that the next action on a coin can be identified as being from the owner of that coin.
Mmmm. I don't know if I'm comfortable with that. You're saying there's no effort to identify and exclude nodes that don't cooperate? I suspect this will lead to trouble and possible DOS attacks.
There is no reliance on identifying anyone. As you've said, it's futile and can be trivially defeated with sock puppets.
The credential that establishes someone as real is the ability to supply CPU power.
Until.... until what? How does anybody know when a transaction has become irrevocable? Is "a few" blocks three? Thirty? A hundred? Does it depend on the number of nodes? Is it logarithmic or linear in number of nodes?
Section 11 calculates the worst case under attack. Typically, 5 or 10 blocks is enough for that. If you're selling something that doesn't merit a network-scale attack to steal it, in practice you could cut it closer.
But in the absence of identity, there's no downside to them if spends become invalid, if they've already received the goods they double-spent for (access to website, download, whatever). The merchants are left holding the bag with "invalid" coins, unless they wait that magical "few blocks" (and how can they know how many?) before treating the spender as having paid.
The consumers won't do this if they spend their coin and it takes an hour to clear before they can do what they spent their coin on. The merchants won't do it if there's no way to charge back a customer when they find the that their coin is invalid because the customer has doublespent.
This is a version 2 problem that I believe can be solved fairly satisfactorily for most applications.
The race is to spread your transaction on the network first. Think 6 degrees of freedom -- it spreads exponentially. It would only take something like 2 minutes for a transaction to spread widely enough that a competitor starting late would have little chance of grabbing very many nodes before the first one is overtaking the whole network. During those 2 minutes, the merchant's nodes can be watching for a double-spent transaction. The double-spender would not be able to blast his alternate transaction out to the world without the merchant getting it, so he has to wait before starting.
If the real transaction reaches 90% and the double-spent tx reaches 10%, the double-spender only gets a 10% chance of not paying, and 90% chance his money gets spent. For almost any type of goods, that's not going to be worth it for the scammer.
Information based goods like access to website or downloads are non-fencible. Nobody is going to be able to make a living off stealing access to websites or downloads. They can go to the file sharing networks to steal that. Most instant-access products aren't going to have a huge incentive to steal.
If a merchant actually has a problem with theft, they can make the customer wait 2 minutes, or wait for something in e-mail, which many already do. If they really want to optimize, and it's a large download, they could cancel the download in the middle if the transaction comes back double-spent. If it's website access, typically it wouldn't be a big deal to let the customer have access for 5 minutes and then cut off access if it's rejected. Many such sites have a free trial anyway.
Satoshi Nakamoto